nucleus-core-ts 0.10.151 → 0.10.152

package/dist/index.js

@@ -26,7 +26,7 @@ and limitations under the License.
 `):lines;for(let line of redacted.slice(context.length))this.addRaw(line,source);let carried=[...new Set(open)];context=carried.reduce((sum,line)=>sum+line.length+1,0)<limit/2?carried:[],run=[],runLength=context.reduce((sum,line)=>sum+line.length+1,0)};for(let line of stripAnsi(text).split(`
 `)){if(line.length>limit){flush(),this.addRaw(line,source);continue}if(run.length>0&&runLength+line.length+1>limit)flush();if(runLength+line.length+1>limit)context=[],runLength=0;run.push(line),runLength+=line.length+1,trackOpenLists(open,line)}flush()}matches(record,query,needle){if(query.levels&&query.levels.length>0&&!query.levels.includes(record.level))return!1;if(query.minLevel&&LOG_LEVEL_PRIORITY[record.level]<LOG_LEVEL_PRIORITY[query.minLevel])return!1;if(query.source&&record.source!==query.source)return!1;if(query.scope){let scope=record.scope??"";if(scope!==query.scope&&!scope.startsWith(`${query.scope}.`))return!1}if(needle){if(!fold([record.message,record.scope??"",record.service??"",record.error?.name??"",record.error?.message??"",record.correlationId??""].join(" ")).includes(needle))return!1}return!0}query(query={}){let limit=Math.min(Math.max(1,query.limit??200),1000),needle=query.search?.trim()?fold(query.search.trim()):null,filtered=this.records.filter((record)=>this.matches(record,query,needle)),window2,hasMore;if(query.after!==void 0){let fresh=filtered.filter((record)=>record.seq>query.after);hasMore=fresh.length>limit,window2=fresh.slice(0,limit)}else{let older=query.before!==void 0?filtered.filter((record)=>record.seq<query.before):filtered;hasMore=older.length>limit,window2=older.slice(Math.max(0,older.length-limit)).reverse()}return{records:window2,matched:filtered.length,buffered:this.records.length,capacity:this.capacity,evicted:this.evicted,latestSeq:this.seq,oldestSeq:this.records[0]?.seq??0,hasMore}}scopes(){let seen=new Set;for(let record of this.records)if(record.scope)seen.add(record.scope);return[...seen].sort()}levelCounts(){let counts={debug:0,info:0,warn:0,error:0,fatal:0};for(let record of this.records)counts[record.level]+=1;return counts}clear(){this.records=[]}subscribe(subscriber){return this.subscribers.add(subscriber),()=>{this.subscribers.delete(subscriber)}}subscriberCount(){return this.subscribers.size}}function getServerLogBuffer(options){if(!sharedBuffer)sharedBuffer=new ServerLogBuffer(options);else if(options?.capacity)sharedBuffer.setCapacity(options.capacity);return sharedBuffer}function attachStreamCapture(buffer){if(detachCapture)return detachCapture;let wire=(stream,source)=>{let original=stream.write.bind(stream),patched=(chunk,encoding,callback)=>{if(!isLoggerEmitting())try{let text=typeof chunk==="string"?chunk:chunk instanceof Uint8Array?new TextDecoder().decode(chunk):"";buffer.addRawChunk(text,source)}catch{}return original(chunk,encoding,callback)};return stream.write=patched,()=>{stream.write=original}},restoreOut=wire(process.stdout,"stdout"),restoreErr=wire(process.stderr,"stderr");return detachCapture=()=>{restoreOut(),restoreErr(),detachCapture=null},detachCapture}var DEFAULT_CAPACITY=2000,DEFAULT_MAX_LINE=8000,RAW_REDACT_WINDOW=57344,MAX_CARRIED_OPENERS=16,ANSI_PATTERN,loggerEmitDepth=0,sharedBuffer=null,detachCapture=null;var init_ServerLogBuffer=__esm(()=>{init_markers();init_redactSecrets();init_types();ANSI_PATTERN=/\x1B\[[0-9;]*[A-Za-z]/g});function redactSensitiveData(obj,redactKeys=DEFAULT_REDACT_KEYS,seen=new WeakSet){return redactWalk(obj,redactKeys,seen,!1)}function redactLogContext(obj,redactKeys=DEFAULT_REDACT_KEYS){return redactWalk(obj,redactKeys,new WeakSet,!0)}function redactErrorInfo(info,redactKeys=DEFAULT_REDACT_KEYS){let options={extraNames:redactKeys},out={...info,message:redactSecretsInText(info.message,options)};if(info.stack!==void 0)out.stack=redactSecretsInText(info.stack,options);if(info.cause)out.cause=redactErrorInfo(info.cause,redactKeys);return out}function redactWalk(obj,redactKeys,seen,scrubText){if(obj===null||obj===void 0)return obj;if(scrubText&&typeof obj==="string")return redactSecretsInText(obj,{extraNames:redactKeys});if(obj instanceof Error){let code=obj.code;return redactWalk({name:obj.name,message:obj.message,stack:obj.stack,...code!==void 0?{code}:{}},redactKeys,seen,scrubText)}if(typeof obj==="bigint")return obj.toString();if(typeof obj!=="object")return obj;if(scrubText){let options={extraNames:redactKeys};if(obj instanceof URL)return redactUrl(obj.href,options);if(obj instanceof URLSearchParams)return redactQueryString(obj.toString(),options);if(obj instanceof Headers)return redactHeaders(obj,options)}if(seen.has(obj))return"[Circular]";if(seen.add(obj),Array.isArray(obj))return obj.map((item)=>redactWalk(item,redactKeys,seen,scrubText));let proto=Object.getPrototypeOf(obj);if(proto!==Object.prototype&&proto!==null)return typeof obj.toISOString==="function"?obj.toISOString():obj;let result={};for(let[key,value]of Object.entries(obj))if(redactKeys.some((redactKey)=>key.toLowerCase().includes(redactKey.toLowerCase())))result[key]="[REDACTED]";else if(value instanceof Error||typeof value==="object"&&value!==null)result[key]=redactWalk(value,redactKeys,seen,scrubText);else if(scrubText&&typeof value==="string")result[key]=redactSecretsInText(value,{extraNames:redactKeys});else result[key]=value;return result}function getCallerInfo(){let stack=Error().stack;if(!stack)return{file:"unknown",line:0,function:"unknown"};let lines=stack.split(`
 `).slice(1);for(let line of lines){let match=line.match(/at\s+(?:(.+?)\s+)?\(?(.+?):(\d+):(\d+)\)?/);if(!match)continue;let[,fnName,filePath,lineNum]=match,fileName=filePath?filePath.split("/").pop()||filePath:"unknown";if(LOGGER_INTERNAL_FILES.includes(fileName))continue;return{file:fileName,line:parseInt(lineNum||"0",10),function:fnName?.replace(/^Object\./,"")||"anonymous"}}return{file:"unknown",line:0,function:"unknown"}}function formatCause(cause,depth,seen){if(cause===void 0||cause===null)return;if(depth>4||seen.has(cause))return;if(seen.add(cause),cause instanceof Error)return{name:cause.name,message:cause.message,code:cause.code,cause:formatCause(cause.cause,depth+1,seen)};return{name:"Error",message:typeof cause==="string"?cause:String(cause)}}function formatError(error){if(error instanceof Error)return{name:error.name,message:error.message,stack:error.stack,code:error.code,cause:formatCause(error.cause,1,new Set([error]))};if(typeof error==="string")return{name:"Error",message:error};return{name:"UnknownError",message:String(error)}}function mergeContext(base,additional){if(!base&&!additional)return;if(!base)return additional;if(!additional)return base;return{...base,...additional}}function formatDuration(ms){if(ms<1)return`${(ms*1000).toFixed(2)}\xB5s`;if(ms<1000)return`${ms.toFixed(2)}ms`;return`${(ms/1000).toFixed(2)}s`}function safeStringify(obj,indent){let seen=new WeakSet;return JSON.stringify(obj,(_,value)=>{if(typeof value==="object"&&value!==null){if(seen.has(value))return"[Circular]";seen.add(value)}if(typeof value==="bigint")return value.toString();if(value instanceof Error)return{name:value.name,message:value.message,stack:value.stack};return value},indent)}var DEFAULT_REDACT_KEYS,LOGGER_INTERNAL_FILES;var init_utils=__esm(()=>{init_redactSecrets();DEFAULT_REDACT_KEYS=["password","secret","token","apiKey","api_key","authorization","cookie","credit_card","creditCard","ssn","privateKey","private_key"];LOGGER_INTERNAL_FILES=["Logger.ts","transports.ts","utils.ts"]});class ConsoleTransport{name="console";colorize;prettyPrint;constructor(options={}){this.colorize=options.colorize??!0,this.prettyPrint=options.prettyPrint??!0}log(entry){beginLoggerEmit();try{if(this.prettyPrint)this.logPretty(entry);else this.logJson(entry)}finally{endLoggerEmit()}}logJson(entry){let output=safeStringify(entry);this.getConsoleMethod(entry.level)(output)}logPretty(entry){let method=this.getConsoleMethod(entry.level),color=this.colorize?LOG_LEVEL_COLORS[entry.level]:"",reset=this.colorize?RESET_COLOR:"",dim=this.colorize?DIM_COLOR:"",bold=this.colorize?BOLD_COLOR:"",time=new Date(entry.timestamp).toLocaleTimeString("en-US",{hour12:!1,hour:"2-digit",minute:"2-digit",second:"2-digit"}),levelStr=entry.level.toUpperCase().padEnd(5),serviceStr=entry.service?`[${entry.service}]`:"",correlationStr=entry.correlationId?`${dim}(${entry.correlationId.slice(0,8)})${reset}`:"",durationStr=entry.duration!==void 0?`${dim}${formatDuration(entry.duration)}${reset}`:"",line=`${dim}${time}${reset} ${color}${bold}${levelStr}${reset} ${serviceStr}${correlationStr} ${entry.message} ${durationStr}`;if(method(line.trim()),entry.caller)method(`  ${dim}at ${entry.caller.function} (${entry.caller.file}:${entry.caller.line})${reset}`);if(entry.context&&Object.keys(entry.context).length>0)method(`  ${dim}context:${reset}`,entry.context);if(entry.error){if(method(`  ${color}${entry.error.name}: ${entry.error.message}${reset}`),entry.error.stack){let stackLines=entry.error.stack.split(`
-`).slice(1,4);for(let stackLine of stackLines)method(`  ${dim}${stackLine.trim()}${reset}`)}let cause=entry.error.cause,indent="  ";while(cause){indent+="  ";let code=cause.code!==void 0?` [${cause.code}]`:"";method(`${indent}${color}caused by: ${cause.name}${code}: ${cause.message}${reset}`),cause=cause.cause}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);case"info":return console.info.bind(console);case"warn":return console.warn.bind(console);case"error":case"fatal":return console.error.bind(console);default:return console.log.bind(console)}}}class ServerLogTransport{name="server-log-buffer";buffer;constructor(buffer){this.buffer=buffer}log(entry){this.buffer.add(entry)}}class DatabaseAuditTransport{name="database";db;table;enabled;dedupEnabled;dedupWindowMs;dedupSlots=new Map;lastSweep=0;constructor(options){this.db=options.db,this.table=options.table,this.enabled=options.enabled??!0,this.dedupEnabled=options.dedup?.enabled??!1,this.dedupWindowMs=Math.max(1,options.dedup?.windowSeconds??60)*1000}setDb(db){this.db=db}setTable(table){this.table=table}setEnabled(enabled){this.enabled=enabled}setDedup(dedup){if(this.dedupEnabled=dedup.enabled??this.dedupEnabled,dedup.windowSeconds!=null)this.dedupWindowMs=Math.max(1,dedup.windowSeconds)*1000}isDedupable(entry){return this.dedupEnabled&&(entry.category==="auth"||entry.category==="authz"||entry.category==="security_anomaly")}sweep(now){if(now-this.lastSweep<this.dedupWindowMs)return;this.lastSweep=now;for(let[key,slot]of this.dedupSlots)if(slot.expiresAt<=now)this.dedupSlots.delete(key)}async write(entry){if(!this.enabled||!this.db||!this.table)return;try{let now=Date.now();if(this.isDedupable(entry)){this.sweep(now);let key=`${entry.ipAddress}|${entry.operation}|${entry.summary}|${entry.userId??""}`,slot=this.dedupSlots.get(key);if(slot&&slot.expiresAt>now){slot.count+=1,await this.bumpOccurrence(slot.rowId,slot.count,now);return}this.dedupSlots.set(key,{rowId:entry.id,count:1,expiresAt:now+this.dedupWindowMs})}await this.db.insert(this.table).values({id:entry.id,entityId:entry.entityId,entityName:entry.entityName,operationType:entry.operation,userId:entry.userId,ipAddress:entry.ipAddress,userAgent:entry.userAgent,summary:entry.summary,severity:entry.severity,category:entry.category,occurrenceCount:1,oldValues:entry.oldValues,newValues:entry.newValues,path:entry.path,query:entry.query})}catch(error){console.error("Audit log write failed:",error)}}async bumpOccurrence(rowId,count,nowMs){try{let{eq}=await import("drizzle-orm"),idCol=this.table.id;await this.db.update(this.table).set({occurrenceCount:count,lastOccurrenceAt:new Date(nowMs)}).where(eq(idCol,rowId))}catch(error){console.error("Audit dedup update failed:",error)}}}class ConsoleAuditTransport{name="console-audit";enabled;constructor(options={}){this.enabled=options.enabled??!0}write(entry){if(!this.enabled)return;let reset=RESET_COLOR,dim=DIM_COLOR,color={info:"\x1B[35m",low:"\x1B[90m",medium:"\x1B[33m",high:"\x1B[31m",critical:"\x1B[1m\x1B[31m"}[entry.severity]??"\x1B[35m",sev=entry.severity.toUpperCase(),actor=entry.userId||"anonymous",cat=entry.category;console.log(`${dim}${entry.timestamp}${reset} ${color}AUDIT\xB7${sev}${reset} ${dim}(${cat})${reset} [${entry.operation}] ${entry.entityName}${entry.entityId?`:${entry.entityId}`:""} ${dim}by ${actor}${reset}${entry.summary?` ${dim}\u2014${reset} ${entry.summary}`:""}`)}}var init_transports=__esm(()=>{init_ServerLogBuffer();init_types();init_utils()});class Logger{config;transports;auditTransports;context;correlationId;static instance=null;constructor(config={},context={},correlationId){this.config={...DEFAULT_CONFIG,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||[]])],this.context=context,this.correlationId=correlationId,this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint})],this.auditTransports=[new ConsoleAuditTransport({enabled:this.config.prettyPrint})]}static getInstance(config){if(!Logger.instance)Logger.instance=new Logger(config);return Logger.instance}static resetInstance(){Logger.instance=null}configure(config){return this.config={...this.config,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||this.config.redactKeys||[]])],this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint}),...this.transports.filter((t)=>t.name!=="console")],this}child(context,correlationId){let childLogger=new Logger(this.config,mergeContext(this.context,context)||{},correlationId||this.correlationId);return childLogger.transports=this.transports,childLogger.auditTransports=this.auditTransports,childLogger}withCorrelationId(correlationId){return this.child({},correlationId)}addTransport(transport){this.transports.push(transport)}addAuditTransport(transport){this.auditTransports.push(transport)}setLevel(level){this.config.level=level}setAuditEnabled(enabled){this.config.auditEnabled=enabled}isAuditEnabled(){return this.config.auditEnabled}setAuditSuppressReasons(reasons){this.config.auditSuppressReasons=reasons}setAuditMinSeverity(severity){this.config.auditMinSeverity=severity}shouldLog(level){return LOG_LEVEL_PRIORITY[level]>=LOG_LEVEL_PRIORITY[this.config.level]}shouldLogScope(scope){if(!scope)return!0;return matchesScope(scope,this.config.enabledScopes)}setEnabledScopes(scopes){this.config.enabledScopes=scopes}getEnabledScopes(){return this.config.enabledScopes}scoped(scope){return new ScopedLogger(this,scope)}createEntry(level,message,context,error,startTime,scope){let entry={timestamp:new Date().toISOString(),level,message:redactSecretsInText(message,{extraNames:this.config.redactKeys}),scope,service:this.config.service,correlationId:this.correlationId},mergedContext=mergeContext(this.context,context);if(mergedContext&&Object.keys(mergedContext).length>0)entry.context=redactLogContext(mergedContext,this.config.redactKeys);if(this.config.includeCallerInfo)entry.caller=getCallerInfo();if(error)entry.error=redactErrorInfo(formatError(error),this.config.redactKeys);if(startTime!==void 0)entry.duration=performance.now()-startTime;return entry}log(level,message,context,error,startTime,scope){if(!this.shouldLog(level))return;if(!this.shouldLogScope(scope))return;let entry=this.createEntry(level,message,context,error,startTime,scope);for(let transport of this.transports)try{transport.log(entry)}catch(err){console.error(`Logger transport "${transport.name}" failed:`,err)}}debug(message,context){this.log("debug",message,context)}info(message,context){this.log("info",message,context)}warn(message,context){this.log("warn",message,context)}error(message,error,context){this.log("error",message,context,error)}fatal(message,error,context){this.log("fatal",message,context,error)}time(label){let start=performance.now();return()=>{this.log("debug",`${label} completed`,void 0,void 0,start)}}async timeAsync(label,fn,context){let start=performance.now();try{let result=await fn();return this.log("debug",`${label} completed`,context,void 0,start),result}catch(error){throw this.log("error",`${label} failed`,context,error,start),error}}request(options){let level=options.statusCode>=500?"error":options.statusCode>=400?"warn":"info";this.log(level,`${options.method} ${options.path} ${options.statusCode}`,{method:options.method,path:options.path,statusCode:options.statusCode,durationMs:options.duration,correlationId:options.correlationId,userId:options.userId,ip:options.ip,userAgent:options.userAgent})}db(options){let level=options.error?"error":"debug";this.log(level,`DB ${options.operation} on ${options.table}`,{operation:options.operation,table:options.table,durationMs:options.duration,rowCount:options.rowCount},options.error)}async flush(){for(let transport of this.transports)if(transport.flush)await transport.flush()}async audit(options){let summary=options.summary||`${options.operation} on ${options.entityName}`;if(this.config.auditSuppressReasons?.includes(summary))return;let derived=classifyAudit(options.operation,summary),severity=options.severity??derived.severity,category=options.category??derived.category;if(severityRank(severity)<severityRank(this.config.auditMinSeverity))return;let scrub={extraNames:this.config.redactKeys},entry={id:randomId(),timestamp:new Date().toISOString(),entityName:options.entityName,entityId:options.entityId??null,operation:options.operation,userId:options.userId??null,summary:redactSecretsInText(summary,scrub),severity,category,oldValues:redactSensitiveData(options.oldValues||{},this.config.redactKeys),newValues:redactSensitiveData(options.newValues||{},this.config.redactKeys),ipAddress:options.ipAddress||"unknown",userAgent:options.userAgent||"unknown",path:redactUrl(options.path||"",scrub),query:redactQueryString(options.query||"",scrub),correlationId:this.correlationId};for(let transport of this.auditTransports)try{await transport.write(entry)}catch(err){console.error(`Audit transport "${transport.name}" failed:`,err)}}auditOnly(options){this.audit(options)}async trace(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)await this.audit(options.audit)}traceSync(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)this.audit(options.audit)}}class ScopedLogger{parent;scope;constructor(parent,scope){this.parent=parent,this.scope=scope}debug(message,context){this.parent.log("debug",message,context,void 0,void 0,this.scope)}info(message,context){this.parent.log("info",message,context,void 0,void 0,this.scope)}warn(message,context){this.parent.log("warn",message,context,void 0,void 0,this.scope)}error(message,error,context){this.parent.log("error",message,context,error,void 0,this.scope)}}var DEFAULT_CONFIG,logger;var init_Logger=__esm(()=>{init_redactSecrets();init_auditTaxonomy();init_scopes();init_transports();init_types();init_utils();DEFAULT_CONFIG={level:"info",service:"nucleus",environment:"development",redactKeys:[],colorize:!0,prettyPrint:!0,includeCallerInfo:!0,asyncBufferSize:100,flushIntervalMs:1000,auditEnabled:!1,auditSuppressReasons:DEFAULT_AUDIT_SUPPRESS_REASONS,auditMinSeverity:"info",enabledScopes:["*"]};logger=Logger.getInstance()});var require_auto_promise=__commonJS((exports,module)=>{var slice=Array.prototype.slice;module.exports=function(fn,makeResult){return function(){var promise,args=arguments,n=args.length;if(n!==0&&typeof args[n-1]!=="function")args=slice.call(arguments),promise=new Promise(function(resolve,reject){args.push(function(err,result){if(err!=null)reject(err);else resolve(makeResult!==void 0?makeResult.apply(this,slice.call(arguments,1)):result)})});return fn.apply(this,args),promise}}});var require_smb2_message=__commonJS((exports,module)=>{var protocolId=Buffer.from([254,83,77,66]),headerTranslates={Command:{NEGOTIATE:0,SESSION_SETUP:1,LOGOFF:2,TREE_CONNECT:3,TREE_DISCONNECT:4,CREATE:5,CLOSE:6,FLUSH:7,READ:8,WRITE:9,LOCK:10,IOCTL:11,CANCEL:12,ECHO:13,QUERY_DIRECTORY:14,CHANGE_NOTIFY:15,QUERY_INFO:16,SET_INFO:17,OPLOCK_BREAK:18}},headerLength=64,headerSync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["ProcessId",4,processId],["TreeId",4,0],["SessionId",8,sessionId],["Signature",16,0]]},headerASync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["AsyncId",8],["SessionId",8,sessionId],["Signature",16,0]]},SMB2Message=module.exports=function(options){if(this.headers={},options&&options.headers)this.setHeaders(options.headers);if(this.request={},options&&options.request)this.setRequest(options.request);this.response={}},proto=SMB2Message.prototype={};proto.setHeaders=function(obj){for(var key in obj)this.headers[key]=obj[key];this.structure=__require("../structures/"+this.headers.Command.toLowerCase())};proto.getHeaders=function(){return this.headers};proto.setRequest=function(request){this.request=request};proto.getResponse=function(){return this.response};proto.getBuffer=function(connection){var buffer=Buffer.allocUnsafe(65535),length=0;if(!this.isMessageIdSetted)this.isMessageIdSetted=!0,this.headers.MessageId=connection.messageId++;length+=writeHeaders(this,buffer),length+=writeRequest(this,buffer,headerLength);var output=Buffer.allocUnsafe(length);return buffer.copy(output,0,0,length),output};proto.parseBuffer=function(buffer){readHeaders(this,buffer),readResponse(this,buffer,headerLength)};function dataToBuffer(data,length){if(Buffer.isBuffer(data))return data;if(typeof data==="string")return Buffer.from(data);var result=Buffer.allocUnsafe(length);for(var i=0;i<length;i++)result.writeUInt8(255&data>>i*8,i);return result}function bufferToData(buffer){if(!Buffer.isBuffer(buffer))return buffer;var result=0;for(var i=0;i<buffer.length;i++)result+=buffer.readUInt8(i)<<i*8;return result}function writeData(buffer,data,offset,length){dataToBuffer(data,length).copy(buffer,offset,0)}function readData(buffer,offset,length){return buffer.slice(offset,offset+length)}function translate(key,value){if(headerTranslates[key]&&typeof headerTranslates[key][value]<"u")return headerTranslates[key][value];return value}function unTranslate(key,value){if(headerTranslates[key]){for(var t in headerTranslates[key])if(headerTranslates[key][t]===value)return t}return null}function readHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1];if(message.headers[key]=readData(buffer,offset,length),length<=8)message.headers[key]=unTranslate(key,bufferToData(message.headers[key]))||message.headers[key];offset+=length}message.structure=__require("../structures/"+message.headers.Command.toLowerCase())}function writeHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1],defaultValue=header[i][2]||0;writeData(buffer,translate(key,message.headers[key]||defaultValue),offset,length),offset+=length}return offset}function readResponse(message,buffer,offset){for(var i in message.structure.response){var key=message.structure.response[i][0],length=message.structure.response[i][1]||1;if(typeof length==="string")length=bufferToData(message.response[length]);message.response[key]=readData(buffer,offset,length),offset+=length}}function writeRequest(message,buffer,offset){var initOffset=offset,needsRewrite=!1,tmpBuffer=Buffer.allocUnsafe(buffer.length);offset=0;for(var i in message.structure.request){var key=message.structure.request[i][0],length=message.structure.request[i][1]||1,defaultValue=message.structure.request[i][2]||0;if(typeof length==="string"){if(message.request[key]=message.request[key]||"",message.request[length]!==message.request[key].length)message.request[length]=message.request[key].length,needsRewrite=!0;length=message.request[key].length}else message.request[key]=message.request[key]||defaultValue;writeData(tmpBuffer,message.request[key],offset,length),offset+=length}if(needsRewrite)writeRequest(message,tmpBuffer,0);return tmpBuffer.copy(buffer,initOffset,0,offset),offset}});var require_smb2_forge=__commonJS((exports,module)=>{var SMB2Message=require_smb2_message(),SMB2Forge=module.exports={};SMB2Forge.request=function(messageName,params,connection,cb){var msg=__require("../messages/"+messageName),smbMessage=msg.generate(connection,params);sendNetBiosMessage(connection,smbMessage);var error=Error();error.messageName=messageName,error.params=params,getResponse(connection,smbMessage.getHeaders().MessageId,msg.parse(connection,cb,error))};SMB2Forge.response=function(c){return c.responses={},c.responsesCB={},c.responseBuffer=Buffer.allocUnsafe(0),function(response){c.responseBuffer=Buffer.concat([c.responseBuffer,response]);var extract=!0;while(extract)if(extract=!1,c.responseBuffer.length>=4){var msgLength=(c.responseBuffer.readUInt8(1)<<16)+c.responseBuffer.readUInt16BE(2);if(c.responseBuffer.length>=msgLength+4){extract=!0;var r=c.responseBuffer.slice(4,msgLength+4),message=new SMB2Message;if(message.parseBuffer(r),c.debug)console.log("--response"),console.log(r.toString("hex"));var mId=message.getHeaders().MessageId.toString("hex");if(c.responsesCB[mId])c.responsesCB[mId](message),delete c.responsesCB[mId];else c.responses[mId]=message;c.responseBuffer=c.responseBuffer.slice(msgLength+4)}}}};function sendNetBiosMessage(connection,message){var smbRequest=message.getBuffer(connection);if(connection.debug)console.log("--request"),console.log(smbRequest.toString("hex"));var buffer=Buffer.allocUnsafe(smbRequest.length+4);return buffer.writeUInt8(0,0),buffer.writeUInt8((16711680&smbRequest.length)>>16,1),buffer.writeUInt16BE(65535&smbRequest.length,2),smbRequest.copy(buffer,4,0,smbRequest.length),connection.newResponse=!1,connection.socket.write(buffer),!0}function getResponse(c,mId,cb){var messageId=Buffer.allocUnsafe(4);if(messageId.writeUInt32LE(mId,0),messageId=messageId.toString("hex"),c.responses[messageId])cb(c.responses[messageId]),delete c.responses[messageId];else c.responsesCB[messageId]=cb}});var require_smb2_connection=__commonJS((exports,module)=>{var net=__require("net"),SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,SMB2Connection=module.exports={};SMB2Connection.close=function(connection){if(clearAutoCloseTimeout(connection),connection.connected)connection.connected=!1,connection.socket.end()};SMB2Connection.requireConnect=function(method){return function(){var connection=this,args=Array.prototype.slice.call(arguments);connect(connection,function(err){var cb=args.pop();if(typeof cb!=="function")args.push(cb),cb=function(err2){if(err2){if(!(err2 instanceof Error))err2=Error(String(err2));throw err2}};if(cb=scheduleAutoClose(connection,cb),args.push(cb),err)cb(err);else method.apply(connection,args)})}};SMB2Connection.init=function(connection){connection.connected=!1,connection.socket=new net.Socket({allowHalfOpen:!0}),connection.socket.on("data",SMB2Forge.response(connection)),connection.errorHandler=[],connection.socket.on("error",function(err){if(connection.errorHandler.length>0)connection.errorHandler[0].call(null,err);if(connection.debug)console.log("-- error"),console.log(arguments)})};function connect(connection,cb){if(connection.connected){cb&&cb(null);return}cb=scheduleAutoClose(connection,cb),connection.messageId=0,connection.SessionId=Math.floor(Math.random()*256)&255,connection.socket.connect(connection.port,connection.ip),SMB2Request("negotiate",{},connection,function(err){if(err)cb&&cb(err);else SMB2Request("session_setup_step1",{},connection,function(err2){if(err2)cb&&cb(err2);else SMB2Request("session_setup_step2",{},connection,function(err3){if(err3)cb&&cb(err3);else SMB2Request("tree_connect",{},connection,function(err4){if(err4)cb&&cb(err4);else connection.connected=!0,cb&&cb(null)})})})})}function clearAutoCloseTimeout(connection){if(connection.scheduledAutoClose)clearTimeout(connection.scheduledAutoClose),connection.scheduledAutoClose=null}function setAutoCloseTimeout(connection){if(clearAutoCloseTimeout(connection),connection.autoCloseTimeout!==0)connection.scheduledAutoClose=setTimeout(function(){SMB2Connection.close(connection)},connection.autoCloseTimeout)}function scheduleAutoClose(connection,cb){return addErrorListener(connection,cb),clearAutoCloseTimeout(connection),function(){removeErrorListener(connection),setAutoCloseTimeout(connection),cb.apply(null,arguments)}}function addErrorListener(connection,callback){connection.errorHandler.unshift(callback)}function removeErrorListener(connection){connection.errorHandler.shift()}});var require_disconnect=__commonJS((exports,module)=>{var SMB2Connection=require_smb2_connection();module.exports=function(){SMB2Connection.close(this)}});var require_exists=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,cb){var connection=this;SMB2Request("open",{path},connection,function(err,file){if(err!=null){if(err.code==="STATUS_OBJECT_NAME_NOT_FOUND"||err.code==="STATUS_OBJECT_PATH_NOT_FOUND")return cb&&cb(null,!1);return cb&&cb(err)}SMB2Request("close",file,connection,function(){cb&&cb(null,!0)})})}});var require_bigint=__commonJS((exports,module)=>{var BigInt2=module.exports=function(n,v){if(BigInt2.isBigInt(n))this.buffer=Buffer.allocUnsafe(n.buffer.length),n.buffer.copy(this.buffer,0),this.sign=n.sign;else if(this.buffer=Buffer.alloc(n),this.sign=1,v=v||0,v!==0){if(v<0)this.sign=-1,v=-v;v=v.toString(16);var size=Math.ceil(v.length/2),carry=size*2-v.length;for(var i=0;i<size;i++){var start=(size-i-1)*2-carry;this.buffer.writeUInt8(parseInt(start===-1?v.substr(0,1):v.substr(start,2),16),i)}}};BigInt2.isBigInt=function(v){return v&&v.buffer&&Buffer.isBuffer(v.buffer)};BigInt2.toBigInt=function(n,v){return new BigInt2(n,v)};BigInt2.fromBuffer=function(b,sign){sign=typeof sign>"u"?1:sign;var bi=new BigInt2(0);return bi.sign=sign,bi.buffer=b,bi};BigInt2.prototype.add=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.neg().sub(v);var carry=0,n=Math.max(v.buffer.length,this.buffer.length),result=new BigInt2(n);for(var i=0;i<n;i++){var r=(i<this.buffer.length?this.buffer.readUInt8(i):0)+(i<v.buffer.length?v.buffer.readUInt8(i):0)+carry;result.buffer.writeUInt8(r&255,i),carry=r>>8}return result.sign=this.sign,result};BigInt2.prototype.neg=function(){var result=new BigInt2(this);return result.sign*=-1,result};BigInt2.prototype.abs=function(){var result=new BigInt2(this);return result.sign=1,result};BigInt2.prototype.sub=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.add(v.neg());var carry=0,a=new BigInt2(this),b=new BigInt2(v),n=Math.max(a.buffer.length,b.buffer.length),result=new BigInt2(n),sign=this.sign;if(a.abs().lt(b.abs())){var t=a;a=b,b=t,sign*=-1}for(var i=0;i<n;i++){var va=i<a.buffer.length?a.buffer.readUInt8(i):0,vb=i<b.buffer.length?b.buffer.readUInt8(i):0,c=0,r=va-vb-carry;while(r<0)r+=255,c--;result.buffer.writeUInt8(r&255,i),carry=(r>>8)+c}return result.sign=sign,result};BigInt2.prototype.toBuffer=function(){return this.buffer};BigInt2.prototype.toNumber=function(){var b=Buffer.allocUnsafe(this.buffer.length);for(var i=0;i<this.buffer.length;i++)b.writeUInt8(this.buffer.readUInt8(this.buffer.length-i-1),i);return parseInt(b.toString("hex"),16)};BigInt2.prototype.compare=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);var n=Math.max(v.buffer.length,this.buffer.length);if(this.sign>v.sign)return 1;if(this.sign<v.sign)return-1;for(var i=n-1;i>=0;i--){var a=i<this.buffer.length?this.buffer.readUInt8(i):0,b=i<v.buffer.length?v.buffer.readUInt8(i):0;if(a!==b)return a>b?this.sign:-this.sign}return 0};BigInt2.prototype.lt=function(v){return this.compare(v)<0};BigInt2.prototype.le=function(v){return this.compare(v)<=0};BigInt2.prototype.gt=function(v){return this.compare(v)>0};BigInt2.prototype.ge=function(v){return this.compare(v)>=0}});var require_constants=__commonJS((exports,module)=>{module.exports={FILE_SUPERSEDE:0,FILE_OPEN:1,FILE_CREATE:2,FILE_OPEN_IF:3,FILE_OVERWRITE:4,FILE_OVERWRITE_IF:5,MAX_READ_LENGTH:65536,MAX_WRITE_LENGTH:65423,FILE_SHARE_NONE:0,FILE_SHARE_READ:1,FILE_SHARE_WRITE:2,FILE_SHARE_DELETE:4,DELETE:65536,FILE_APPEND_DATA:4,FILE_DELETE_CHILD:64,FILE_READ_ATTRIBUTES:128,FILE_READ_DATA:1,FILE_READ_EA:8,FILE_WRITE_ATTRIBUTES:256,FILE_WRITE_DATA:2,FILE_WRITE_EA:16,READ_CONTROL:131072,SYNCHRONIZE:1048576,WRITE_DAC:262144,DIRECTORY:16}});var require_rename=__commonJS((exports,module)=>{var BigInt2=require_bigint(),SMB2Request=require_smb2_forge().request,constants=require_constants();module.exports=function(oldPath,newPath,options,cb){if(typeof options==="function")cb=options,options={};var connection=this;SMB2Request("open_folder",{path:oldPath},connection,function(err,file){if(err)SMB2Request("create",{path:oldPath,createDisposition:constants.FILE_OPEN,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err2,file2){if(err2)cb&&cb(err2);else rename_(connection,file2,newPath,options,cb)});else rename_(connection,file,newPath,options,cb)})};function rename_(connection,file,newPath,options,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileRenameInformation",Buffer:renameBuffer(newPath,options)},connection,function(err){SMB2Request("close",file,connection,function(){if(err)cb&&cb(err);else cb&&cb(null)})})}function renameBuffer(newPath,options){var filename=Buffer.from(newPath,"ucs2");return Buffer.concat([new BigInt2(1,options.replace?1:0).toBuffer(),new BigInt2(7,0).toBuffer(),new BigInt2(8,0).toBuffer(),new BigInt2(4,filename.length).toBuffer(),filename])}});var require_readFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(filename,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};SMB2Request("open",{path:filename},connection,function(err,file){if(err)cb&&cb(err);else{var fileLength=0,offset=new BigInt2(8),stop=!1,nbRemainingPackets=0;for(var i=0;i<file.EndofFile.length;i++)fileLength+=file.EndofFile[i]*Math.pow(2,i*8);var result=Buffer.allocUnsafe(fileLength),callback=function(offset2){return function(err2,content){if(stop)return;if(err2)cb&&cb(err2),stop=!0;else content.copy(result,offset2.toNumber()),nbRemainingPackets--,checkDone()}},checkDone=function(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))SMB2Request("close",file,connection,function(){if(options.encoding)result=result.toString(options.encoding);cb&&cb(null,result)})},createPackets=function(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=offset.sub(fileLength).neg(),packetSize=rest.gt(MAX_READ_LENGTH)?MAX_READ_LENGTH:rest.toNumber();SMB2Request("read",{FileId:file.FileId,Length:packetSize,Offset:offset.toBuffer()},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}};checkDone()}})}});var require_createReadStream=__commonJS((exports,module)=>{var Readable=__require("stream").Readable,BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};else if(options==null)options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onOpen(err,file){if(err!=null)return cb(err);var offset=options.start||0,fileSize=BigInt2.fromBuffer(file.EndofFile).toNumber(),end=fileSize;if(options.end<end)end=options.end+1;var close=request.bind(void 0,"close",file,connection),stream=new Readable;if(stream.fileSize=fileSize,shouldClose)stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})};var running=!1;stream._read=function(size){if(running)return;if(offset>=end)return shouldClose?close(function(){stream.push(null)}):stream.push(null);running=!0,request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,size,end-offset),Offset:new BigInt2(8,offset).toBuffer()},connection,function(err2,content){if(running=!1,err2!=null)return process.nextTick(stream.emit.bind(stream,"error",err2));offset+=content.length,stream.push(content)})},cb(null,stream)}if(isFd)onOpen(null,fd);else request("open",{path},connection,onOpen)}});var require_parse_flags=__commonJS((exports,module)=>{var c=require_constants();module.exports=function(flags){var chars={__proto__:null};for(var i=0,n=flags.length;i<n;++i)chars[flags[i]]=!0;if("r"in chars)return c.FILE_OPEN;if("x"in chars)return c.FILE_CREATE;if("a"in chars)return c.FILE_OPEN_IF;if("w"in chars)return c.FILE_OVERWRITE_IF;throw Error("invalid flags")}});var require_createWriteStream=__commonJS((exports,module)=>{var Writable=__require("stream").Writable,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onCreate(err,file){if(err!=null)return cb(err);var offset=new BigInt2(8,options!=null&&options.start||0);function write(buffer,i,cb2){var j=i+constants.MAX_WRITE_LENGTH,chunk=buffer.slice(i,j);request("write",{Buffer:chunk,FileId:file.FileId,Offset:offset.toBuffer()},connection,function(err2){if(err2!=null)return cb2(err2);if(offset=offset.add(chunk.length),j<buffer.length)return write(buffer,j,cb2);cb2()})}var stream=new Writable;if(shouldClose){var close=request.bind(void 0,"close",file,connection);stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})},stream._final=close}stream._write=function(chunk,encoding,next){write(Buffer.isBuffer(chunk)?chunk:Buffer.from(chunk,encoding),0,next)},cb(null,stream)}if(isFd)onCreate(null,fd);else request("create",{createDisposition:parseFlags(options!=null&&options.flags||"wx"),path},connection,onCreate)}});var require_writeFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags();module.exports=function(filename,data,options,cb){if(typeof options==="function")cb=options,options={};options.encoding=options.encoding||"utf8";var connection=this,file,fileContent=Buffer.isBuffer(data)?data:Buffer.from(data,options.encoding),fileLength=new BigInt2(8,fileContent.length);function createFile(fileCreated){SMB2Request("create",{createDisposition:parseFlags(options!=null&&(options.flags||options.flag)||"wx"),path:filename},connection,function(err,f){if(err)cb&&cb(err);else file=f,fileCreated()})}function closeFile(fileClosed){SMB2Request("close",file,connection,function(err){if(err)cb&&cb(err);else file=null,fileClosed()})}function setFileSize(fileSizeSetted){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,function(err){if(err)cb&&cb(err);else fileSizeSetted()})}function writeFile(fileWritten){var offset=new BigInt2(8),stop=!1,nbRemainingPackets=0,maxPacketSize=new BigInt2(8,constants.MAX_WRITE_LENGTH);function callback(){return function(err){if(stop)return;if(err)cb&&cb(err),stop=!0;else nbRemainingPackets--,checkDone()}}function checkDone(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))fileWritten()}function createPackets(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=fileLength.sub(offset),packetSize=rest.gt(maxPacketSize)?maxPacketSize:rest;SMB2Request("write",{FileId:file.FileId,Offset:offset.toBuffer(),Buffer:fileContent.slice(offset.toNumber(),offset.add(packetSize).toNumber())},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}}checkDone()}createFile(function(){setFileSize(function(){writeFile(function(){closeFile(cb)})})})}});var require_unlink=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants();module.exports=function(path,cb){var connection=this;SMB2Request("create",{path,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)cb&&cb(err2);else cb&&cb(null,files)})})})}});var require_convert_time=__commonJS((exports,module)=>{var winTicks=1e7,uEpoch=11644473600;module.exports=function(time){var unixTime=time/winTicks-uEpoch;return new Date(unixTime*1000)}});var require_stats=__commonJS((exports,module)=>{var convert=require_convert_time(),BigInt2=require_bigint(),DIRECTORY=require_constants().DIRECTORY;module.exports=function(file){return{birthtime:convert(BigInt2.fromBuffer(file.CreationTime).toNumber()),atime:convert(BigInt2.fromBuffer(file.LastAccessTime).toNumber()),mtime:convert(BigInt2.fromBuffer(file.LastWriteTime).toNumber()),ctime:convert(BigInt2.fromBuffer(file.ChangeTime).toNumber()),size:BigInt2.fromBuffer(file.EndofFile).toNumber(),isDirectory:function(){var attr=file.FileAttributes;if(typeof attr!=="number")attr=BigInt2.fromBuffer(attr).toNumber();return(attr&DIRECTORY)==DIRECTORY}}}});var require_readdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,stats=require_stats();module.exports=function(path,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};var mapping=options.stats?function(v){var obj=stats(v);return obj.name=v.Filename,obj}:function(v){return v.Filename};function queryDirectory(filesBatch,file,connection2,cb2){SMB2Request("query_directory",file,connection2,function(err,files){if(err)if(err.code==="STATUS_NO_MORE_FILES")cb2(null,filesBatch);else cb2(err);else filesBatch.push(files.filter(function(v){return v.Filename!=="."&&v.Filename!==".."}).map(mapping)),queryDirectory(filesBatch,file,connection2,cb2)})}function openDirectory(path2,connection2,cb2){SMB2Request("open",{path:path2},connection2,function(err,file){if(err)cb2(err);else return cb2(null,file)})}function closeDirectory(file,connection2,cb2){SMB2Request("close",file,connection2,function(err,res){if(err){if(err.code!=="STATUS_FILE_CLOSED")cb2(err)}cb2(null,res)})}openDirectory(path,connection,function(err,file){var totalFiles=[],filesBatch=[];if(err)cb(err);else queryDirectory(filesBatch,file,connection,function(err2,file2){if(err2)cb(err2);else closeDirectory(file2,connection,function(err3,file3){if(err3)cb(err3);else totalFiles=[].concat(...filesBatch),cb(null,totalFiles)})})})}});var require_rmdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint();module.exports=function(path,cb){var connection=this;SMB2Request("open_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)return cb(err2);cb(null,files)})})})}});var require_mkdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,mode,cb){if(typeof mode==="function")cb=mode,mode="0777";var connection=this;SMB2Request("create_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("close",file,connection,function(){cb&&cb(null)})})}});var require_getSize=__commonJS((exports,module)=>{var BigInt2=require_bigint(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,BigInt2.fromBuffer(file.EndofFile).toNumber())})})}});var require_stat=__commonJS((exports,module)=>{var stats=require_stats(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,stats(file))})})}});var require_open=__commonJS((exports,module)=>{var parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,flags,cb){if(typeof flags==="function")cb=flags,flags=void 0;request("create",{createDisposition:parseFlags(flags||"r"),path},this,cb)}});var require_read=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){assert(start!==null,"null pos is not supported");var connection=this,end=Math.min(start+length,BigInt2.fromBuffer(file.EndofFile).toNumber()),pos=start;function onRead(err,chunk){if(err!=null)return cb(err,pos-start,buffer);chunk.copy(buffer,offset);var n=chunk.length;offset+=n,pos+=n,readChunk()}function readChunk(){if(pos>=end)return cb(null,pos-start,buffer);request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,end-pos),Offset:new BigInt2(8,pos).toBuffer()},connection,onRead)}process.nextTick(readChunk)}});var require_write=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_WRITE_LENGTH=require_constants().MAX_WRITE_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){if(assert(Buffer.isBuffer(buffer)),offset==null)offset=0;else assert.strictEqual(typeof offset,"number"),assert(offset>0),assert(offset<buffer.length);if(length==null)length=buffer.length-offset;else assert.strictEqual(typeof length,"number"),assert(length>0),length=Math.min(length,buffer.length-offset);assert.strictEqual(typeof start,"number");var connection=this,pos=start,chunkLength;function onWrite(err){if(err!=null)return cb(err,pos-start,buffer);length-=chunkLength,offset+=chunkLength,pos+=chunkLength,writeChunk()}function writeChunk(){if(length<=0)return cb(null,pos-start,buffer);chunkLength=Math.min(MAX_WRITE_LENGTH,length),request("write",{Buffer:buffer.slice(offset,offset+chunkLength),FileId:file.FileId,Offset:new BigInt2(8,pos).toBuffer()},connection,onWrite)}process.nextTick(writeChunk)}});var require_close=__commonJS((exports,module)=>{var request=require_smb2_forge().request;module.exports=function(file,cb){request("close",file,this,cb)}});var require_truncate=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),FILE_WRITE_DATA=require_constants().FILE_WRITE_DATA;function setFileSize(file,fileLength,connection,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,cb)}module.exports=function(path,length,cb){var connection=this;SMB2Request("open",{path,desiredAccess:FILE_WRITE_DATA},connection,function(err,file){if(err!=null)return cb(err);setFileSize(file,new BigInt2(8,length),connection,function(err2){SMB2Request("close",file,connection,function(){cb(err2)})})})}});var require_smb2=__commonJS((exports,module)=>{var shareRegExp=/\\\\([^\\]*)\\([^\\]*)\\?/,port=445,packetConcurrency=20,autoCloseTimeout=1e4,autoPromise=require_auto_promise(),SMB2Connection=require_smb2_connection(),SMB=module.exports=function(opt){opt=opt||{};var matches;if(!opt.share||!(matches=opt.share.match(shareRegExp)))throw Error("the share is not valid");if(this.ip=matches[1],this.port=opt.port||port,this.share=matches[2],this.fullPath=opt.share,this.packetConcurrency=opt.packetConcurrency||packetConcurrency,opt.autoCloseTimeout!==void 0)this.autoCloseTimeout=opt.autoCloseTimeout;else this.autoCloseTimeout=autoCloseTimeout;this.domain=opt.domain,this.username=opt.username,this.password=opt.password,this.ProcessId=Buffer.from([Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&254]),this.debug=opt.debug,SMB2Connection.init(this)},proto=SMB.prototype={};proto.disconnect=require_disconnect();proto.exists=autoPromise(SMB2Connection.requireConnect(require_exists()));proto.rename=autoPromise(SMB2Connection.requireConnect(require_rename()));proto.readFile=autoPromise(SMB2Connection.requireConnect(require_readFile()));proto.createReadStream=autoPromise(SMB2Connection.requireConnect(require_createReadStream()));proto.createWriteStream=autoPromise(SMB2Connection.requireConnect(require_createWriteStream()));proto.writeFile=autoPromise(SMB2Connection.requireConnect(require_writeFile()));proto.unlink=autoPromise(SMB2Connection.requireConnect(require_unlink()));proto.readdir=autoPromise(SMB2Connection.requireConnect(require_readdir()));proto.rmdir=autoPromise(SMB2Connection.requireConnect(require_rmdir()));proto.mkdir=autoPromise(SMB2Connection.requireConnect(require_mkdir()));proto.getSize=autoPromise(SMB2Connection.requireConnect(require_getSize()));proto.stat=autoPromise(SMB2Connection.requireConnect(require_stat()));proto.open=autoPromise(SMB2Connection.requireConnect(require_open()));proto.read=autoPromise(require_read(),function(bytesRead,buffer){return{bytesRead,buffer}});proto.write=autoPromise(require_write(),function(bytesWritten,buffer){return{bytesWritten,buffer}});proto.close=autoPromise(require_close());proto.truncate=autoPromise(SMB2Connection.requireConnect(require_truncate()))});import{createHash,randomBytes}from"crypto";var API_KEY_BYTE_LENGTH=32,HASH_ALGORITHM="sha256",generateApiKey=(prefix="nk_live")=>{let randomPart=randomBytes(API_KEY_BYTE_LENGTH).toString("hex"),rawKey=`${prefix}_${randomPart}`,keyHash=hashApiKey(rawKey),keyPreview=`${prefix}_...${randomPart.slice(-4)}`;return{rawKey,keyHash,keyPreview}},hashApiKey=(rawKey)=>{return createHash(HASH_ALGORITHM).update(rawKey).digest("hex")},validateApiKeyFormat=(rawKey)=>{return/^nk_(live|test)_[a-f0-9]{64}$/.test(rawKey)},extractApiKeyFromHeader=(headers)=>{let apiKeyHeader=headers.get("x-api-key");if(apiKeyHeader&&validateApiKeyFormat(apiKeyHeader))return apiKeyHeader;let authHeader=headers.get("authorization");if(authHeader){let bearerMatch=authHeader.match(/^Bearer\s+(nk_(?:live|test)_[a-f0-9]{64})$/);if(bearerMatch?.[1])return bearerMatch[1]}return null},validateApiKeyRecord=(record)=>{if(!record.isActive)return{valid:!1,reason:"API key is inactive"};if(record.revokedAt)return{valid:!1,reason:"API key has been revoked"};if(record.expiresAt&&new Date(record.expiresAt)<new Date)return{valid:!1,reason:"API key has expired"};return{valid:!0,record}},intersectPermissions=(userPermissions,keyPermissions)=>{let userSet=new Set(userPermissions);return keyPermissions.filter((p)=>userSet.has(p))};var init_ApiKey=()=>{};var normalize=(value)=>{return value?.trim().toLowerCase()||"unknown"},extractHeaderValue=(headers,key)=>{return headers[key.toLowerCase()]??headers[key]};import crypto2 from"crypto";var generateDeviceFingerprint=(input)=>{let payload=JSON.stringify({userAgent:normalize(input.userAgent),extra:input.extra??{}});return{hash:crypto2.createHash("sha256").update(payload).digest("base64url"),components:input}};var init_Generate=()=>{};var validateDeviceFingerprint=({savedFingerprint,requestIp,headers})=>{let userAgent=extractHeaderValue(headers,"user-agent"),forwardedFor=extractHeaderValue(headers,"x-forwarded-for")??requestIp??void 0,currentFingerprint=generateDeviceFingerprint({userAgent,ipAddress:forwardedFor}),componentMismatch=[{field:"userAgent",saved:savedFingerprint.components.userAgent,received:userAgent},{field:"ipAddress",saved:savedFingerprint.components.ipAddress,received:forwardedFor}].find(({saved,received})=>saved??(received??"")!=="");if(componentMismatch)return{isValid:!1,reason:`${componentMismatch.field} mismatch`,currentFingerprint};return{isValid:!0,currentFingerprint}};var init_Validate=__esm(()=>{init_Generate()});var init_Fingerprint=__esm(()=>{init_Generate();init_Validate()});import crypto3 from"crypto";var base64UrlEncode=(data)=>{return(Buffer.isBuffer(data)?data.toString("base64"):Buffer.from(data).toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},base64UrlDecode=(data)=>{let padding="=".repeat((4-data.length%4)%4),base64=data.replace(/-/g,"+").replace(/_/g,"/")+padding;return Buffer.from(base64,"base64").toString("utf-8")},createSignature=(data,secret,algorithm)=>{let hmacAlgorithm=algorithm.replace("HS","sha"),hmac=crypto3.createHmac(hmacAlgorithm,secret);return hmac.update(data),base64UrlEncode(hmac.digest())},verifySignature=(data,signature,secret,algorithm)=>{let expectedSignature=createSignature(data,secret,algorithm),sigBuf=Buffer.from(signature),expBuf=Buffer.from(expectedSignature);if(sigBuf.length!==expBuf.length)return!1;return crypto3.timingSafeEqual(sigBuf,expBuf)},encodeHeader=(header)=>{return base64UrlEncode(JSON.stringify(header))},encodePayload=(payload)=>{return base64UrlEncode(JSON.stringify(payload))},decodeHeader=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}},decodePayload=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}};var init_utils2=()=>{};var decodeJWT=(token)=>{let parts=token.split(".");if(parts.length!==3)return null;let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return null;let header=decodeHeader(encodedHeader),payload=decodePayload(encodedPayload);if(!header||!payload)return null;return{header,payload,signature}};var init_Decode=__esm(()=>{init_utils2()});import{randomUUID}from"crypto";var signJWT=(options,secret,algorithm="HS256")=>{let header={alg:algorithm,typ:"JWT"},now=Math.floor(Date.now()/1000),payload={sub:options.subject,iat:now,...options.expiresInSeconds===null?{}:{exp:now+options.expiresInSeconds},iss:options.issuer,aud:options.audience,jti:options.jwtId||randomUUID(),sessionId:options.sessionId,...options.customClaims},encodedHeader=encodeHeader(header),encodedPayload=encodePayload(payload),dataToSign=`${encodedHeader}.${encodedPayload}`,signature=createSignature(dataToSign,secret,algorithm);return`${dataToSign}.${signature}`};var init_Sign=__esm(()=>{init_utils2()});var audienceMatches=(aud,expected)=>{if(typeof aud==="string")return aud===expected;if(Array.isArray(aud))return aud.includes(expected);return!1},verifyJWT=(token,secret,expected)=>{let parts=token.split(".");if(parts.length!==3)return{valid:!1,error:"Invalid token format: expected 3 parts"};let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return{valid:!1,error:"Invalid token format: missing parts"};let header=decodeHeader(encodedHeader);if(!header)return{valid:!1,error:"Invalid header: failed to decode"};if(header.typ!=="JWT")return{valid:!1,error:"Invalid header: typ must be JWT"};if(!["HS256","HS384","HS512"].includes(header.alg))return{valid:!1,error:`Unsupported algorithm: ${header.alg}`};let dataToVerify=`${encodedHeader}.${encodedPayload}`;if(!verifySignature(dataToVerify,signature,secret,header.alg))return{valid:!1,error:"Invalid signature"};let payload=decodePayload(encodedPayload);if(!payload)return{valid:!1,error:"Invalid payload: failed to decode"};let now=Math.floor(Date.now()/1000);if(payload.exp&&payload.exp<now)return{valid:!1,error:"Token expired"};if(payload.iat&&payload.iat>now+60)return{valid:!1,error:"Token issued in the future"};if(expected?.issuer&&payload.iss!==expected.issuer)return{valid:!1,error:"Invalid issuer"};if(expected?.audience&&!audienceMatches(payload.aud,expected.audience))return{valid:!1,error:"Invalid audience"};return{valid:!0,payload}};var init_Verify=__esm(()=>{init_utils2()});var exports_JWT={};__export(exports_JWT,{verifyJWT:()=>verifyJWT,signJWT:()=>signJWT,decodeJWT:()=>decodeJWT});var init_JWT=__esm(()=>{init_Decode();init_Sign();init_Verify()});var init_Generate2=()=>{};var init_Password=__esm(()=>{init_Generate2()});var init_Logger2=__esm(()=>{init_auditTaxonomy();init_Logger();init_ServerLogBuffer();init_transports();init_utils();init_scopes()});var DEFAULT_DAPR_HOST="127.0.0.1",DEFAULT_DAPR_PORT="3500",DEFAULT_MAX_BODY_SIZE_MB=4,DEFAULT_STATE_STORE="statestore-redis",DEFAULT_PUBSUB_NAME="pubsub-rabbitmq",DEFAULT_SECRET_STORE="secretstore",DEFAULT_CONFIG_STORE="configstore-redis",ENV_DAPR_HOST="DAPR_HOST",ENV_DAPR_HTTP_PORT="DAPR_HTTP_PORT",ENV_DAPR_HTTP_ENDPOINT="DAPR_HTTP_ENDPOINT",ENV_DAPR_GRPC_ENDPOINT="DAPR_GRPC_ENDPOINT",ENV_DAPR_API_TOKEN="DAPR_API_TOKEN",DEFAULT_OPERATION_TIMEOUT_MS=30000,DEFAULT_CONNECTION_TIMEOUT_MS=1e4,DEFAULT_HEALTH_CHECK_TIMEOUT_MS=5000,CONNECTION_STATUS,HEALTH_STATUS,ERROR_CODES;var init_constants=__esm(()=>{CONNECTION_STATUS={CONNECTED:"connected",DISCONNECTED:"disconnected",CONNECTING:"connecting",ERROR:"error"},HEALTH_STATUS={HEALTHY:"healthy",UNHEALTHY:"unhealthy"},ERROR_CODES={CONNECTION_ERROR:"DAPR_CONNECTION_ERROR",TIMEOUT_ERROR:"DAPR_TIMEOUT_ERROR",STATE_ERROR:"DAPR_STATE_ERROR",PUBSUB_ERROR:"DAPR_PUBSUB_ERROR",BINDING_ERROR:"DAPR_BINDING_ERROR",SECRET_ERROR:"DAPR_SECRET_ERROR",CONFIG_ERROR:"DAPR_CONFIG_ERROR",INVOKE_ERROR:"DAPR_INVOKE_ERROR",CRYPTO_ERROR:"DAPR_CRYPTO_ERROR",LOCK_ERROR:"DAPR_LOCK_ERROR",WORKFLOW_ERROR:"DAPR_WORKFLOW_ERROR",VALIDATION_ERROR:"DAPR_VALIDATION_ERROR"}});var DaprManagerError,createConnectionError=(message,details)=>new DaprManagerError(ERROR_CODES.CONNECTION_ERROR,message,details),createTimeoutError=(message,details)=>new DaprManagerError(ERROR_CODES.TIMEOUT_ERROR,message,details),createStateError=(message,details)=>new DaprManagerError(ERROR_CODES.STATE_ERROR,message,details),createPubSubError=(message,details)=>new DaprManagerError(ERROR_CODES.PUBSUB_ERROR,message,details),createBindingError=(message,details)=>new DaprManagerError(ERROR_CODES.BINDING_ERROR,message,details),createSecretError=(message,details)=>new DaprManagerError(ERROR_CODES.SECRET_ERROR,message,details),createConfigError=(message,details)=>new DaprManagerError(ERROR_CODES.CONFIG_ERROR,message,details),createInvokeError=(message,details)=>new DaprManagerError(ERROR_CODES.INVOKE_ERROR,message,details),createCryptoError=(message,details)=>new DaprManagerError(ERROR_CODES.CRYPTO_ERROR,message,details),createLockError=(message,details)=>new DaprManagerError(ERROR_CODES.LOCK_ERROR,message,details),createWorkflowError=(message,details)=>new DaprManagerError(ERROR_CODES.WORKFLOW_ERROR,message,details),safeExecute=async(operation,errorCreator)=>{try{return await operation()}catch(error){let errorMessage=error instanceof Error?error.message:String(error);throw errorCreator(errorMessage,error)}};var init_error_handling=__esm(()=>{init_constants();DaprManagerError=class DaprManagerError extends Error{code;details;constructor(code,message,details){super(message);this.name="DaprManagerError",this.code=code,this.details=details}toJSON(){return{code:this.code,message:this.message,details:this.details}}}});var LOG_LEVEL_PRIORITY2,createDefaultLogger=(minLevel="info")=>{let minPriority=LOG_LEVEL_PRIORITY2[minLevel],scoped=logger.scoped("dapr.client"),logWithLevel=(level)=>(message,...meta)=>{if(LOG_LEVEL_PRIORITY2[level]<minPriority)return;let context=meta.length>0?{meta}:void 0;if(level==="error")scoped.error(message,void 0,context);else scoped[level](message,context)};return{debug:logWithLevel("debug"),info:logWithLevel("info"),warn:logWithLevel("warn"),error:logWithLevel("error")}},withTimeout=async(fn,timeoutMs,errorMessage="Operation timed out")=>{return Promise.race([fn(),new Promise((_,reject)=>{setTimeout(()=>{reject(createTimeoutError(errorMessage))},timeoutMs)})])},validateRequired=(params,requiredKeys,entityName)=>{let missingKeys=requiredKeys.filter((key)=>params[key]===void 0);if(missingKeys.length>0)throw Error(`Missing required ${entityName} parameters: ${missingKeys.join(", ")}`)};var init_utils3=__esm(()=>{init_Logger2();init_constants();init_error_handling();LOG_LEVEL_PRIORITY2={debug:0,info:1,warn:2,error:3}});class DaprBindingClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(name,operation,data,options={}){return validateRequired({name,operation},["name","operation"],"binding invoke"),safeExecute(async()=>{this.logger.debug("Invoking binding",{name,operation});let response=await(await this.client()).binding.send(name,operation,data,options.metadata);return this.logger.debug("Binding invoked successfully",{name,operation}),response},(message,details)=>createBindingError(`Failed to invoke binding ${name}: ${message}`,details))}}var init_binding_client=__esm(()=>{init_error_handling();init_utils3()});class DaprConfigClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(keys,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"config get"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting configuration",{keys,storeName});let response=await(await this.client()).configuration.get(storeName,keys);return this.logger.debug("Configuration retrieved",{keys,storeName,itemCount:Object.keys(response.items||{}).length}),response.items||{}},(message,details)=>createConfigError(`Failed to get configuration: ${message}`,details))}async subscribeWithKeys(keys,callback,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,callback,storeName},["keys","callback","storeName"],"config subscribeWithKeys"),keys.length===0)throw createConfigError("At least one key must be provided for subscription");return safeExecute(async()=>{this.logger.debug("Subscribing to configuration updates",{keys,storeName});let stream=await(await this.client()).configuration.subscribeWithKeys(storeName,keys,async(data)=>{try{this.logger.debug("Received configuration update",{storeName,updatedKeys:Object.keys(data.items||{})}),await callback(data)}catch(error){this.logger.error("Error in configuration subscription callback",error)}});return this.logger.debug("Configuration subscription established",{keys,storeName}),{stop:()=>{this.logger.debug("Stopping configuration subscription",{keys,storeName}),stream.stop()}}},(message,details)=>createConfigError(`Failed to subscribe to configuration updates: ${message}`,details))}async getValue(key,storeName=DEFAULT_CONFIG_STORE){return(await this.get([key],storeName))[key]?.value}async getValues(keys,storeName=DEFAULT_CONFIG_STORE){let items=await this.get(keys,storeName),values={};for(let key in items)if(items[key]?.value!==void 0)values[key]=items[key].value;return values}}var init_config_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprCryptoClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async encrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto encrypt"),safeExecute(async()=>{this.logger.debug("Encrypting data",{componentName:options.componentName,keyName:options.keyName,keyWrapAlgorithm:options.keyWrapAlgorithm});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let encryptedData=await client.crypto.encrypt(inputData,cryptoOptions);return this.logger.debug("Data encrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:encryptedData.length}),encryptedData},(message,details)=>createCryptoError(`Failed to encrypt data: ${message}`,details))}async decrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto decrypt"),safeExecute(async()=>{this.logger.debug("Decrypting data",{componentName:options.componentName});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let decryptedData=await client.crypto.decrypt(inputData,cryptoOptions);return this.logger.debug("Data decrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:decryptedData.length}),decryptedData},(message,details)=>createCryptoError(`Failed to decrypt data: ${message}`,details))}async encryptString(plaintext,options){return(await this.encrypt(plaintext,options)).toString("base64")}async decryptString(ciphertext,options){let encryptedBuffer=Buffer.from(ciphertext,"base64");return(await this.decrypt(encryptedBuffer,options)).toString("utf-8")}}var init_crypto_client=__esm(()=>{init_error_handling();init_utils3()});function dapr(){if(!cachedDapr)cachedDapr=__require("@dapr/dapr");return cachedDapr}class DaprInvokeClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(appId,methodName,httpMethod,data,options={}){httpMethod??=dapr().HttpMethod.POST,validateRequired({appId,methodName,httpMethod},["appId","methodName","httpMethod"],"invoke service");let timeoutMs=options.timeout||DEFAULT_OPERATION_TIMEOUT_MS;return safeExecute(async()=>{this.logger.debug("Invoking service",{appId,methodName,httpMethod,hasData:data!==void 0});let fullMethodName=methodName;if(options.queryParams&&Object.keys(options.queryParams).length>0){let queryString=Object.entries(options.queryParams).map(([key,value])=>`${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");fullMethodName=`${methodName}?${queryString}`}let client=await this.client(),response=await withTimeout(()=>client.invoker.invoke(appId,fullMethodName,httpMethod,data,options.headers),timeoutMs,`Service invocation timed out after ${timeoutMs}ms`);if(this.logger.debug("Service invoked successfully",{appId,methodName,httpMethod,status:response?.status}),!response)return;if("data"in response)return response.data;return response},(message,details)=>createInvokeError(`Failed to invoke service ${appId}.${methodName}: ${message}`,details))}async get(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.GET,void 0,options)}async post(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.POST,data,options)}async put(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.PUT,data,options)}async delete(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.DELETE,void 0,options)}}var cachedDapr=null;var init_invoke_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprLockClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async lock(storeName,resourceId,lockOwner,options){return validateRequired({storeName,resourceId,lockOwner,expiryInSeconds:options.expiryInSeconds},["storeName","resourceId","lockOwner","expiryInSeconds"],"lock"),safeExecute(async()=>{this.logger.debug("Acquiring lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.lock(storeName,resourceId,lockOwner,options.expiryInSeconds);return this.logger.debug("Lock acquisition result",{storeName,resourceId,lockOwner,success:response.success}),{success:response.success}},(message,details)=>createLockError(`Failed to acquire lock for resource ${resourceId}: ${message}`,details))}async unlock(storeName,resourceId,lockOwner){return validateRequired({storeName,resourceId,lockOwner},["storeName","resourceId","lockOwner"],"unlock"),safeExecute(async()=>{this.logger.debug("Releasing lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.unlock(storeName,resourceId,lockOwner);return this.logger.debug("Lock release result",{storeName,resourceId,lockOwner,status:this.getLockStatusName(response.status)}),{status:response.status}},(message,details)=>createLockError(`Failed to release lock for resource ${resourceId}: ${message}`,details))}getLockStatusName(status){switch(status){case 0:return"Success";case 1:return"LockDoesNotExist";case 2:return"LockBelongsToOthers";default:return"InternalError"}}}var init_lock_client=__esm(()=>{init_error_handling();init_utils3()});class DaprPubSubClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async publish(topic,data,options={},pubsubName=DEFAULT_PUBSUB_NAME){return validateRequired({topic,data,pubsubName},["topic","data","pubsubName"],"pubsub publish"),safeExecute(async()=>{this.logger.debug("Publishing message to topic",{topic,pubsubName}),await(await this.client()).pubsub.publish(pubsubName,topic,data,{metadata:options.metadata,contentType:options.contentType}),this.logger.debug("Message published successfully",{topic,pubsubName})},(message,details)=>createPubSubError(`Failed to publish message to topic ${topic}: ${message}`,details))}async publishBulk(topic,messages,pubsubName=DEFAULT_PUBSUB_NAME){if(validateRequired({topic,messages,pubsubName},["topic","messages","pubsubName"],"pubsub publishBulk"),messages.length===0)return{failedEntries:[]};return safeExecute(async()=>{this.logger.debug("Publishing bulk messages to topic",{topic,pubsubName,messageCount:messages.length});let client=await this.client(),daprMessages=messages.map((msg)=>{if(typeof msg==="object"&&"event"in msg)return{entryID:msg.entryId,event:msg.event,contentType:msg.contentType,metadata:msg.metadata};return{event:msg}}),response=await client.pubsub.publishBulk(pubsubName,topic,daprMessages),failedCount=response.failedMessages?.length||0;if(failedCount>0)this.logger.warn("Some messages failed to publish",{topic,pubsubName,failedCount,totalCount:messages.length});else this.logger.debug("All bulk messages published successfully",{topic,pubsubName,messageCount:messages.length});return{failedEntries:(response.failedMessages||[]).map((failed)=>({entryId:failed.message.entryID||"",error:failed.error?.message||"Unknown error"}))}},(message,details)=>createPubSubError(`Failed to publish bulk messages to topic ${topic}: ${message}`,details))}createBulkPublishMessage(event,entryId,contentType,metadata){return{entryId,event,contentType,metadata}}}var init_pubsub_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprSecretClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(key,options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({key,storeName},["key","storeName"],"secret get"),safeExecute(async()=>{this.logger.debug("Getting secret",{key,storeName});let client=await this.client(),metadataStr=options.metadata?JSON.stringify(options.metadata):void 0,result=await client.secret.get(storeName,key,metadataStr);return this.logger.debug("Secret retrieved",{key,storeName}),result},(message,details)=>createSecretError(`Failed to get secret ${key}: ${message}`,details))}async getBulk(_options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({storeName},["storeName"],"secret getBulk"),safeExecute(async()=>{this.logger.debug("Getting all secrets",{storeName});let result=await(await this.client()).secret.getBulk(storeName);return this.logger.debug("All secrets retrieved",{storeName,secretCount:Object.keys(result).length}),result},(message,details)=>createSecretError(`Failed to get all secrets: ${message}`,details))}}var init_secret_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprStateClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async save(stateItems,options={},storeName=DEFAULT_STATE_STORE){if(validateRequired({stateItems,storeName},["stateItems","storeName"],"state save"),stateItems.length===0)return;return safeExecute(async()=>{this.logger.debug("Saving state items",{count:stateItems.length,storeName}),await(await this.client()).state.save(storeName,stateItems,options),this.logger.debug("State items saved successfully",{count:stateItems.length,storeName})},(message,details)=>createStateError(`Failed to save state items: ${message}`,details))}async get(key,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state get"),safeExecute(async()=>{this.logger.debug("Getting state item",{key,storeName});let result=await(await this.client()).state.get(storeName,key);if(this.logger.debug("State item retrieved",{key,storeName,found:result!==void 0}),result===void 0||result===null)return;if(typeof result==="string")try{return JSON.parse(result)}catch{return result}if(typeof result==="object")return result;return result},(message,details)=>createStateError(`Failed to get state item ${key}: ${message}`,details))}async getBulk(keys,storeName=DEFAULT_STATE_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"state getBulk"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting bulk state items",{count:keys.length,storeName});let results=await(await this.client()).state.getBulk(storeName,keys),resultMap={};return results.forEach((item)=>{if(item.data!==void 0)resultMap[item.key]=item.data}),this.logger.debug("Bulk state items retrieved",{count:keys.length,found:Object.keys(resultMap).length,storeName}),resultMap},(message,details)=>createStateError(`Failed to get bulk state items: ${message}`,details))}async delete(key,etag,metadata,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state delete"),safeExecute(async()=>{this.logger.debug("Deleting state item",{key,storeName});let client=await this.client(),options={};if(etag)options.etag=etag;if(metadata)options.metadata=metadata;await client.state.delete(storeName,key,options),this.logger.debug("State item deleted",{key,storeName})},(message,details)=>createStateError(`Failed to delete state item ${key}: ${message}`,details))}async transaction(operations,storeName=DEFAULT_STATE_STORE){if(validateRequired({operations,storeName},["operations","storeName"],"state transaction"),operations.length===0)return;return safeExecute(async()=>{this.logger.debug("Executing state transaction",{operationCount:operations.length,storeName});let client=await this.client(),daprOperations=operations.map((op)=>({operation:op.operation,request:{key:op.request.key,value:op.request.value,etag:op.request.etag?{value:op.request.etag}:void 0,metadata:op.request.metadata}}));await client.state.transaction(storeName,daprOperations),this.logger.debug("State transaction executed successfully",{operationCount:operations.length,storeName})},(message,details)=>createStateError(`Failed to execute state transaction: ${message}`,details))}async query(query,storeName=DEFAULT_STATE_STORE){return validateRequired({query,storeName},["query","storeName"],"state query"),safeExecute(async()=>{this.logger.debug("Querying state store",{storeName});let result=await(await this.client()).state.query(storeName,query);return this.logger.debug("State query executed",{storeName,resultCount:result.results?.length||0}),(result.results||[]).map((item)=>item.data)},(message,details)=>createStateError(`Failed to query state store: ${message}`,details))}async saveItem(key,value,options={},storeName=DEFAULT_STATE_STORE){let stateItem={key,value};return this.save([stateItem],options,storeName)}async upsert(key,value,options={},storeName=DEFAULT_STATE_STORE){return this.saveItem(key,value,options,storeName)}}var init_state_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprWorkflowClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async start(workflowName,input,options={}){return validateRequired({workflowName},["workflowName"],"workflow start"),safeExecute(async()=>{this.logger.debug("Starting workflow",{workflowName,instanceId:options.instanceId||"auto-generated",workflowComponent:options.workflowComponent});let instanceId=await(await this.client()).workflow.start(workflowName,input,options.instanceId);return this.logger.debug("Workflow started",{workflowName,instanceId}),instanceId},(message,details)=>createWorkflowError(`Failed to start workflow ${workflowName}: ${message}`,details))}async get(instanceId){return validateRequired({instanceId},["instanceId"],"workflow get"),safeExecute(async()=>{this.logger.debug("Getting workflow instance",{instanceId});let instance=await(await this.client()).workflow.get(instanceId);return this.logger.debug("Workflow instance retrieved",{instanceId,workflowName:instance.workflowName,runtimeStatus:instance.runtimeStatus}),{instanceId:instance.instanceID,workflowName:instance.workflowName,createdAt:new Date(instance.createdAt),lastUpdatedAt:new Date(instance.lastUpdatedAt),runtimeStatus:instance.runtimeStatus,properties:instance.properties||{}}},(message,details)=>createWorkflowError(`Failed to get workflow instance ${instanceId}: ${message}`,details))}async terminate(instanceId){return validateRequired({instanceId},["instanceId"],"workflow terminate"),safeExecute(async()=>{this.logger.debug("Terminating workflow instance",{instanceId}),await(await this.client()).workflow.terminate(instanceId),this.logger.debug("Workflow instance terminated",{instanceId})},(message,details)=>createWorkflowError(`Failed to terminate workflow instance ${instanceId}: ${message}`,details))}async pause(instanceId){return validateRequired({instanceId},["instanceId"],"workflow pause"),safeExecute(async()=>{this.logger.debug("Pausing workflow instance",{instanceId}),await(await this.client()).workflow.pause(instanceId),this.logger.debug("Workflow instance paused",{instanceId})},(message,details)=>createWorkflowError(`Failed to pause workflow instance ${instanceId}: ${message}`,details))}async resume(instanceId){return validateRequired({instanceId},["instanceId"],"workflow resume"),safeExecute(async()=>{this.logger.debug("Resuming workflow instance",{instanceId}),await(await this.client()).workflow.resume(instanceId),this.logger.debug("Workflow instance resumed",{instanceId})},(message,details)=>createWorkflowError(`Failed to resume workflow instance ${instanceId}: ${message}`,details))}async purge(instanceId){return validateRequired({instanceId},["instanceId"],"workflow purge"),safeExecute(async()=>{this.logger.debug("Purging workflow instance",{instanceId}),await(await this.client()).workflow.purge(instanceId),this.logger.debug("Workflow instance purged",{instanceId})},(message,details)=>createWorkflowError(`Failed to purge workflow instance ${instanceId}: ${message}`,details))}async raiseEvent(instanceId,eventName,eventData){return validateRequired({instanceId,eventName},["instanceId","eventName"],"workflow raiseEvent"),safeExecute(async()=>{this.logger.debug("Raising event for workflow instance",{instanceId,eventName}),await(await this.client()).workflow.raise(instanceId,eventName,eventData),this.logger.debug("Event raised for workflow instance",{instanceId,eventName})},(message,details)=>createWorkflowError(`Failed to raise event ${eventName} for workflow instance ${instanceId}: ${message}`,details))}}var init_workflow_client=__esm(()=>{init_error_handling();init_utils3()});function dapr2(){if(!cachedDapr2)cachedDapr2=__require("@dapr/dapr");return cachedDapr2}class DaprConnectionManager{client=null;daprHost;daprPort;communicationProtocolOption;maxBodySizeMb;daprApiToken;logger;connectionStatus=CONNECTION_STATUS.DISCONNECTED;connectionPromise=null;constructor(options={}){this.daprHost=options.daprHost||process.env[ENV_DAPR_HOST]||DEFAULT_DAPR_HOST,this.daprPort=options.daprPort||process.env[ENV_DAPR_HTTP_PORT]||DEFAULT_DAPR_PORT,this.communicationProtocolOption=options.communicationProtocol,this.maxBodySizeMb=options.maxBodySizeMb||DEFAULT_MAX_BODY_SIZE_MB,this.daprApiToken=options.daprApiToken||process.env[ENV_DAPR_API_TOKEN],this.logger=options.logger||createDefaultLogger(),this.logger.info("DaprConnectionManager initialized",{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocolOption??"default (HTTP)"})}get communicationProtocol(){return this.communicationProtocolOption??dapr2().CommunicationProtocolEnum.HTTP}async getClient(){if(!this.client||this.connectionStatus!==CONNECTION_STATUS.CONNECTED)await this.connect();if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");return this.client}async connect(){if(this.connectionPromise)return this.connectionPromise;if(this.client&&this.connectionStatus===CONNECTION_STATUS.CONNECTED)return Promise.resolve();this.connectionStatus=CONNECTION_STATUS.CONNECTING,this.connectionPromise=this.establishConnection();try{await this.connectionPromise,this.connectionStatus=CONNECTION_STATUS.CONNECTED}catch(error){throw this.connectionStatus=CONNECTION_STATUS.ERROR,error}finally{this.connectionPromise=null}}async establishConnection(){try{this.logger.info("Connecting to Dapr sidecar",{daprHost:this.daprHost,daprPort:this.daprPort,protocol:this.communicationProtocol});let protocols=dapr2().CommunicationProtocolEnum,useEndpointFromEnv=process.env[ENV_DAPR_HTTP_ENDPOINT]&&this.communicationProtocol===protocols.HTTP||process.env[ENV_DAPR_GRPC_ENDPOINT]&&this.communicationProtocol===protocols.GRPC,clientOptions={communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,logger:{level:dapr2().LogLevel.Warn}};if(!useEndpointFromEnv)clientOptions.daprHost=this.daprHost,clientOptions.daprPort=this.daprPort;if(this.daprApiToken)clientOptions.daprApiToken=this.daprApiToken;await withTimeout(async()=>{this.client=new(dapr2()).DaprClient(clientOptions)},DEFAULT_CONNECTION_TIMEOUT_MS,"Connection to Dapr sidecar timed out"),await this.healthCheck(),this.logger.info("Successfully connected to Dapr sidecar")}catch(error){throw this.logger.error("Failed to connect to Dapr sidecar",error),this.client=null,createConnectionError(`Failed to connect to Dapr sidecar at ${this.daprHost}:${this.daprPort}`,error)}}async disconnect(){if(!this.client)return;try{this.logger.info("Disconnecting from Dapr sidecar"),this.client=null,this.connectionStatus=CONNECTION_STATUS.DISCONNECTED,this.logger.info("Disconnected from Dapr sidecar")}catch(error){throw this.logger.error("Error during disconnect",error),createConnectionError("Failed to disconnect from Dapr sidecar",error)}}isConnected(){return this.client!==null&&this.connectionStatus===CONNECTION_STATUS.CONNECTED}getConnectionStatus(){return this.connectionStatus}async healthCheck(){if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");try{return await withTimeout(async()=>{if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");let response=await this.client.invoker.invoke("healthz","healthz",dapr2().HttpMethod.GET);return{status:response.status===204?HEALTH_STATUS.HEALTHY:HEALTH_STATUS.UNHEALTHY,version:response.headers?.["dapr-version"]||"unknown"}},DEFAULT_HEALTH_CHECK_TIMEOUT_MS,"Health check timed out")}catch(error){return this.logger.error("Health check failed",error),{status:HEALTH_STATUS.UNHEALTHY,version:"unknown"}}}getClientConfig(){return{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,hasApiToken:!!this.daprApiToken,connectionStatus:this.connectionStatus}}}var cachedDapr2=null;var init_connection_manager=__esm(()=>{init_constants();init_error_handling();init_utils3()});var init_types2=()=>{};class DaprManager{connectionManager;logger;_state;_pubsub;_binding;_secret;_config;_invoke;_lock;_crypto;_workflow;constructor(options={}){this.logger=options.logger||createDefaultLogger(),this.connectionManager=new DaprConnectionManager(options);let clientProvider=async()=>{return this.connectionManager.getClient()};this._state=new DaprStateClient(clientProvider,this.logger),this._pubsub=new DaprPubSubClient(clientProvider,this.logger),this._binding=new DaprBindingClient(clientProvider,this.logger),this._secret=new DaprSecretClient(clientProvider,this.logger),this._config=new DaprConfigClient(clientProvider,this.logger),this._invoke=new DaprInvokeClient(clientProvider,this.logger),this._lock=new DaprLockClient(clientProvider,this.logger),this._crypto=new DaprCryptoClient(clientProvider,this.logger),this._workflow=new DaprWorkflowClient(clientProvider,this.logger)}async connect(){await this.connectionManager.connect()}async disconnect(){await this.connectionManager.disconnect()}isConnected(){return this.connectionManager.isConnected()}getConnectionStatus(){return this.connectionManager.getConnectionStatus()}async healthCheck(){return this.connectionManager.healthCheck()}getClientConfig(){return this.connectionManager.getClientConfig()}get state(){return this._state}get pubsub(){return this._pubsub}get binding(){return this._binding}get secret(){return this._secret}get config(){return this._config}get invoke(){return this._invoke}get lock(){return this._lock}get crypto(){return this._crypto}get workflow(){return this._workflow}}function getDaprManager(){if(!daprManagerInstance)daprManagerInstance=new DaprManager;return daprManagerInstance}var daprManagerInstance=null,daprManager;var init_Dapr=__esm(()=>{init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_connection_manager();init_utils3();init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_constants();init_error_handling();init_types2();daprManager=new Proxy({},{get(_target,property,receiver){let value=Reflect.get(getDaprManager(),property,receiver);return typeof value==="function"?value.bind(getDaprManager()):value},has(_target,property){return property in getDaprManager()}})});import Redis from"ioredis";class DirectRedisStore{client;constructor(client){this.client=client}async create(key,value,ttlSeconds){try{return{success:!0,data:ttlSeconds?await this.client.set(key,JSON.stringify(value),"EX",ttlSeconds):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async read(key){try{let raw=await this.client.get(key);return{success:!0,data:raw?JSON.parse(raw):null}}catch(error){return{success:!1,error:error.message}}}async update(key,value,preserveTtl=!0){try{return{success:!0,data:preserveTtl?await this.client.set(key,JSON.stringify(value),"KEEPTTL"):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return{success:!0,data:await this.client.del(key)}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.client.exists(key)===1}}catch(error){return{success:!1,error:error.message}}}getClient(){return this.client}}class DaprRedisStore{storeName;keyPrefix;dapr;constructor(storeName,keyPrefix=""){this.storeName=storeName;this.keyPrefix=keyPrefix;this.dapr=new DaprManager}k(key){return this.keyPrefix+key}async get(key){let data=await this.dapr.state.get(this.k(key),this.storeName);return data===void 0||data===null||data===""?null:data}async create(key,value,ttlSeconds){try{let metadata=ttlSeconds?{ttlInSeconds:String(ttlSeconds)}:void 0;return await this.dapr.state.save([{key:this.k(key),value,metadata}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async read(key){try{return{success:!0,data:await this.get(key)}}catch(error){return{success:!1,error:error.message}}}async update(key,value,_preserveTtl=!0){try{return await this.dapr.state.save([{key:this.k(key),value}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return await this.dapr.state.delete(this.k(key),void 0,void 0,this.storeName),{success:!0,data:1}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.get(key)!==null}}catch(error){return{success:!1,error:error.message}}}}class RedisManager{static instance=null;store;directClient=null;useDapr;constructor(config){if(RedisManager.instance){this.store=RedisManager.instance.store,this.directClient=RedisManager.instance.directClient,this.useDapr=RedisManager.instance.useDapr;return}if(!config)throw Error("Redis config must be provided for first initialization.");assertRedisConfig(config),this.useDapr=config.withDapr??!1;let keyPrefix=config.keyPrefix||"";if(config.withDapr)this.store=new DaprRedisStore(config.stateStoreName??"statestore",keyPrefix);else{let client=config.url?new Redis(config.url,keyPrefix?{keyPrefix}:{}):new Redis({host:config.host,port:config.port,...config.password?{password:config.password}:{},...config.username?{username:config.username}:{},...config.tls?{tls:{}}:{},...keyPrefix?{keyPrefix}:{}});this.directClient=client,this.store=new DirectRedisStore(client)}RedisManager.instance=this}static async reset(){let current=RedisManager.instance;if(RedisManager.instance=null,!current?.directClient)return;try{await current.directClient.quit()}catch{}}async create(key,value,ttlSeconds){return this.store.create(key,value,ttlSeconds)}async read(key){return this.store.read(key)}async update(key,value,preserveTtl=!0){return this.store.update(key,value,preserveTtl)}async remove(key){return this.store.remove(key)}async exists(key){return this.store.exists(key)}async readCounters(keys){return(await Promise.all(keys.map((k)=>this.read(k)))).map((r)=>{let v=r.success?r.data:null,n=typeof v==="number"?v:Number.parseFloat(String(v??""));return Number.isFinite(n)?n:0})}async incrementCounter(key,delta,ttlSeconds){if(!this.useDapr&&this.directClient){let v=await this.directClient.incrbyfloat(key,delta);if(ttlSeconds&&ttlSeconds>0)try{await this.directClient.expire(key,ttlSeconds)}catch{}return Number(v)}let cur=await this.read(key),raw=cur.success?cur.data:null,base=typeof raw==="number"?raw:Number.parseFloat(String(raw??"")),next=(Number.isFinite(base)?base:0)+delta;return await this.create(key,next,ttlSeconds),next}getDirectClient(){return this.directClient}async reauthenticate(username,password){if(this.directClient)await this.directClient.auth(username,password)}async keys(pattern){if(this.useDapr||!this.directClient)return logger.scoped("database.redis").warn("keys() not supported in Dapr mode",{pattern}),[];try{return await this.directClient.keys(pattern)}catch(error){return logger.scoped("database.redis").error("keys() failed",error,{pattern}),[]}}async acquireLock(lockKey,ttlSeconds=10){if(this.useDapr||!this.directClient){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(existsResult.data)return{success:!0,data:!1};if((await this.create(lockKey,"1",ttlSeconds)).success)return{success:!0,data:!0};return{success:!1,error:"Failed to acquire lock"}}try{return{success:!0,data:await this.directClient.set(lockKey,"1","EX",ttlSeconds,"NX")==="OK"}}catch(error){return{success:!1,error:error.message}}}async releaseLock(lockKey){return this.remove(lockKey)}async waitForLock(lockKey,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(!existsResult.data)return{success:!0,data:!0};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:!1}}async getOrWait(key,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let readResult=await this.read(key);if(!readResult.success)return{success:!1,error:readResult.error};if(readResult.data!==null)return{success:!0,data:readResult.data};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:null}}}var assertRedisConfig=(config)=>{if(!config)throw Error("Redis config must be provided.");if(config.withDapr){if(!config.stateStoreName)throw Error("Dapr mode requires stateStoreName.");return}let hasUrl=Boolean(config.url),hasHostPort=Boolean(config.host)&&typeof config.port==="number";if(!hasUrl&&!hasHostPort)throw Error("Redis config requires either url or host and port.")};var init_Redis=__esm(()=>{init_Logger2();init_Dapr()});var init_Delete=__esm(()=>{init_Redis()});var init_Generate3=__esm(()=>{init_Redis();init_JWT()});var init_Read=__esm(()=>{init_Redis();init_JWT();init_Delete()});var init_Validate2=__esm(()=>{init_Read()});var init_RefreshToken=__esm(()=>{init_Delete();init_Generate3();init_Read();init_Validate2()});var DEFAULT_EXPIRY_SECONDS=86400,buildSessionKey=(sessionId)=>`session:${sessionId}`,buildRefreshChainKey=(sessionId)=>`refresh-chain:${sessionId}`,serializeSession=(record)=>JSON.stringify(record),deserializeSession=(data)=>{if(!data)return null;if(typeof data==="object")return data;try{return JSON.parse(data)}catch{return null}};var deleteSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),removeResult=await manager.remove(key);return await manager.remove(buildRefreshChainKey(options.sessionId)).catch(()=>{return}),removeResult.success&&removeResult.data>0},forgetSessionsInRedis=async(sessionIds)=>{for(let id of sessionIds){if(!id)continue;try{await deleteSession({sessionId:String(id)})}catch{}}};var init_Delete2=__esm(()=>{init_Redis()});import crypto4 from"crypto";var generateSession=async(options)=>{let manager=new RedisManager,sessionId=options.sessionId??crypto4.randomUUID(),now=Date.now(),nowIso=new Date(now).toISOString(),never=options.expiresInSeconds===null,ttlSeconds=never?void 0:options.expiresInSeconds??DEFAULT_EXPIRY_SECONDS,record={id:sessionId,userId:options.userId,createdAt:nowIso,expiresAt:never?null:new Date(now+ttlSeconds*1000).toISOString(),lastActiveAt:nowIso,clientMeta:options.clientMeta,fingerprintHash:options.fingerprintHash,deviceInfo:options.deviceInfo,refreshTokenHash:options.refreshTokenHash,loginMethod:options.loginMethod,rememberMe:options.rememberMe},writeResult=await manager.create(buildSessionKey(sessionId),serializeSession(record),ttlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:record}};var init_Generate4=__esm(()=>{init_Redis()});var init_Issue=__esm(()=>{init_JWT();init_Generate3();init_Delete2();init_Generate4()});var init_Session=__esm(()=>{init_Issue()});var lookupSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),readResult=await manager.read(key);if(!readResult.success)return{state:"unavailable",error:readResult.error??"session store read failed"};if(!readResult.data)return{state:"missing"};let record=deserializeSession(readResult.data);if(!record)return{state:"missing"};if(record.expiresAt&&new Date(record.expiresAt).getTime()<=Date.now())return await deleteSession({sessionId:options.sessionId}),{state:"missing"};return{state:"found",record}},readSession=async(options)=>{let lookup=await lookupSession(options);return lookup.state==="found"?lookup.record:null};var init_Read2=__esm(()=>{init_Redis();init_Delete2()});var updateSession=async(options)=>{let existing=await readSession({sessionId:options.sessionId});if(!existing)return{success:!1,error:"Session not found"};let updated={...existing,...options.updates,lastActiveAt:options.updates.lastActiveAt??new Date().toISOString()},manager=new RedisManager,remainingTtlSeconds=updated.expiresAt?Math.max(60,Math.ceil((new Date(updated.expiresAt).getTime()-Date.now())/1000)):void 0,writeResult=await manager.create(buildSessionKey(options.sessionId),serializeSession(updated),remainingTtlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:updated}},updateLastActiveAt=async(sessionId)=>{return updateSession({sessionId,updates:{lastActiveAt:new Date().toISOString()}})};var init_Update=__esm(()=>{init_Redis();init_Read2()});var validateSession=async(options)=>{let jwtResult=verifyJWT(options.jwtToken,options.jwtSecret);if(!jwtResult.valid)return{isValid:!1,reason:jwtResult.error};let session=await readSession({sessionId:options.sessionId});if(!session)return{isValid:!1,reason:"Session not found"};let fingerprintValid;if(options.savedFingerprint&&options.headers&&options.requestIp){let sanitizedHeaders={};for(let[key,value]of Object.entries(options.headers))if(value!==void 0)sanitizedHeaders[key]=value;let fingerprintResult=validateDeviceFingerprint({savedFingerprint:options.savedFingerprint,headers:sanitizedHeaders,requestIp:options.requestIp});if(fingerprintValid=fingerprintResult.isValid,!fingerprintResult.isValid)return{isValid:!1,reason:fingerprintResult.reason??"Fingerprint mismatch"}}return{isValid:!0,context:{userId:session.userId,sessionId:session.id,fingerprintValid}}};var init_Validate3=__esm(()=>{init_Validate();init_JWT();init_Read2()});var exports_SessionStore={};__export(exports_SessionStore,{validateSession:()=>validateSession,updateSession:()=>updateSession,updateLastActiveAt:()=>updateLastActiveAt,readSession:()=>readSession,lookupSession:()=>lookupSession,generateSession:()=>generateSession,forgetSessionsInRedis:()=>forgetSessionsInRedis,deleteSession:()=>deleteSession});var init_SessionStore=__esm(()=>{init_Delete2();init_Generate4();init_Read2();init_Update();init_Validate3()});var init_Auth=__esm(()=>{init_Fingerprint();init_JWT();init_Password();init_RefreshToken();init_Session();init_SessionStore()});import{eq}from"drizzle-orm";function buildClaimAction(method,entity,field,relation,relationField,isBulk){let parts=[method.toLowerCase()];if(isBulk)parts.push("bulk");if(parts.push(entity),relation){if(parts.push("with"),parts.push(relation),relationField)parts.push(relationField)}else if(field)parts.push(field);return parts.join(".")}function buildClaimPath(entity,isBulk,hasId){if(isBulk)return`/${entity}/bulk`;if(hasId)return`/${entity}/:id`;return`/${entity}`}function generateEntityClaims(entity,config,schemaRelations){let claims=[],tableName=entity.table_name,excludedMethods=entity.excluded_methods||[];for(let method of HTTP_METHODS){if(excludedMethods.includes(method))continue;let needsId=method==="PUT"||method==="PATCH"||method==="DELETE";if(claims.push({action:buildClaimAction(method,tableName),description:`${method} access to ${tableName}`,path:buildClaimPath(tableName,!1,needsId&&method!=="DELETE"),method}),method==="GET"&&entity.columns){for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName),method})}let relationKey=`${tableName.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}Relations`;if(schemaRelations[relationKey]){let relationConfig=schemaRelations[relationKey];if(relationConfig?.config?.referencedTable?._?.name){let relationName=relationConfig.config.referencedTable._.name;claims.push({action:buildClaimAction(method,tableName,void 0,relationName),description:`${method} access to ${tableName} with ${relationName}`,path:buildClaimPath(tableName),method})}}}if(method==="POST"||method==="PUT"||method==="PATCH"){if(entity.columns)for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName,!1,method!=="POST"),method})}}}if(entity.bulk_endpoints_enabled===!0)for(let method of BULK_METHODS){if(excludedMethods.includes(method))continue;claims.push({action:buildClaimAction(method,tableName,void 0,void 0,void 0,!0),description:`Bulk ${method} access to ${tableName}`,path:buildClaimPath(tableName,!0),method})}return claims}async function seedClaims(db,schemaTables,schemaRelations,entities,config,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return logger2.warn("[Authorization] Claims table not found in schema"),{total:0,created:0,existing:0,claims:[]};let allClaims=[];for(let entity of entities){if(config.skipTables.includes(entity.table_name))continue;let entityClaims=generateEntityClaims(entity,config,schemaRelations);allClaims.push(...entityClaims)}let uniqueClaims=allClaims.filter((claim,index,self2)=>index===self2.findIndex((c)=>c.action===claim.action)),created=0,existing=0,claimActions=[];for(let claim of uniqueClaims)try{if((await db.select().from(claimsTable).where(eq(claimsTable.action,claim.action)).limit(1)).length===0)await db.insert(claimsTable).values(claim),created++,claimActions.push(claim.action),logger2.debug(`[Authorization] Created claim: ${claim.action}`);else existing++}catch(error){logger2.error(`[Authorization] Failed to create claim: ${claim.action}`,error)}return logger2.info(`[Authorization] Claims seeded: ${created} created, ${existing} existing, ${uniqueClaims.length} total`),{total:uniqueClaims.length,created,existing,claims:claimActions}}var HTTP_METHODS,BULK_METHODS;var init_ClaimSeeder=__esm(()=>{HTTP_METHODS=["GET","POST","PUT","PATCH","DELETE"],BULK_METHODS=["POST","PUT","DELETE"]});function parseStoredJson(stored){if(stored===null||stored===void 0)return null;if(typeof stored==="object")return stored;if(typeof stored==="string"){if(stored.length===0)return null;try{return JSON.parse(stored)}catch{return null}}if(typeof stored==="number"||typeof stored==="boolean")return stored;return null}import{and,eq as eq2,isNull,or}from"drizzle-orm";function activeRowsPredicate(table){let column=table?.isActive;if(!column)return;return or(isNull(column),eq2(column,!0))}function activeGrantPredicate(tables){return and(activeRowsPredicate(tables.userRoles),activeRowsPredicate(tables.roleClaims),activeRowsPredicate(tables.claims))}var init_activeRows=()=>{};var exports_ClaimsCache={};__export(exports_ClaimsCache,{ClaimsCache:()=>ClaimsCache});import{and as and2,eq as eq3}from"drizzle-orm";class ClaimsCache{prefix;redis;db;schemaTables;logger;constructor(config){this.prefix=config.prefix||DEFAULT_PREFIX,this.redis=config.redis,this.db=config.db,this.schemaTables=config.schemaTables,this.logger=config.logger}key(suffix){return`${this.prefix}:${suffix}`}async buildCache(){let rolesTable=this.schemaTables.roles,roleClaimsTable=this.schemaTables.roleClaims,claimsTable=this.schemaTables.claims;if(!rolesTable||!roleClaimsTable||!claimsTable)return this.logger.warn("[ClaimsCache] Required tables not found, skipping cache build"),{version:0,roleCount:0,totalMappings:0};let allRoles=await this.db.select().from(rolesTable),roleNames=[],totalMappings=0;for(let role of allRoles){let r=role,roleId=r.id,roleName=r.name;roleNames.push(roleName);let roleClaimRows=await this.db.select().from(roleClaimsTable).innerJoin(claimsTable,eq3(roleClaimsTable.claimId,claimsTable.id)).where(and2(eq3(roleClaimsTable.roleId,roleId),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable}))),claimActions=[];for(let row of roleClaimRows){let action=row.claims?.action;if(action)claimActions.push(action)}await this.redis.set(this.key(`role:${roleName}`),JSON.stringify(claimActions)),totalMappings+=claimActions.length}await this.redis.set(this.key("roles"),JSON.stringify(roleNames));let newVersion=storedVersionNumber(await this.redis.get(this.key("version")))+1;return await this.redis.set(this.key("version"),String(newVersion)),this.logger.info("[ClaimsCache] Cache built",{version:newVersion,roleCount:roleNames.length,totalMappings}),{version:newVersion,roleCount:roleNames.length,totalMappings}}async getVersion(){return storedVersionNumber(await this.redis.get(this.key("version")))}async resolveClaimsForRoles(roleNames){let allClaims=new Set;for(let roleName of roleNames){let claims=parseStoredJson(await this.redis.get(this.key(`role:${roleName}`)));if(Array.isArray(claims))for(let c of claims)allClaims.add(c);else if(claims!==null)this.logger.warn("[ClaimsCache] Cached role entry unreadable, ignoring",{roleName})}return Array.from(allClaims)}async invalidate(){return(await this.buildCache()).version}getPrefix(){return this.prefix}}var DEFAULT_PREFIX="nucleus:claims",storedVersionNumber=(stored)=>{let value=parseStoredJson(stored),parsed=typeof value==="number"?value:Number.parseInt(String(value??""),10);return Number.isFinite(parsed)?parsed:0};var init_ClaimsCache=__esm(()=>{init_activeRows()});var DEFAULT_AUTHORIZATION_CONFIG,AUTHORIZATION_TABLE_KEYS,GODMIN_ROLE_NAME="godmin";var init_types3=__esm(()=>{DEFAULT_AUTHORIZATION_CONFIG={enabled:!1,autoSeedClaims:!0,skipTables:["audit_logs"],skipColumns:["id","created_at","updated_at","is_active","password","version"],excludedPaths:[],publicPaths:["/auth/login","/auth/register"]},AUTHORIZATION_TABLE_KEYS={users:"users",roles:"roles",claims:"claims",userRoles:"userRoles",roleClaims:"roleClaims"}});var{password}=globalThis.Bun;import{and as and3,eq as eq4}from"drizzle-orm";async function setupGodmin(db,schemaTables,config,logger2){if(!config.godminEmail||!config.godminPassword)return logger2.warn("[Authorization] Godmin email or password not configured, skipping godmin setup"),{success:!1};let{roles:rolesTable,users:usersTable,userRoles:userRolesTable}=schemaTables;if(!rolesTable||!usersTable||!userRolesTable)return logger2.error("[Authorization] Required tables not found for godmin setup"),{success:!1};try{let roleId,existingRole=await db.select().from(rolesTable).where(eq4(rolesTable.name,GODMIN_ROLE_NAME)).limit(1);if(existingRole.length===0){let[newRole]=await db.insert(rolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();roleId=newRole.id,logger2.info(`[Authorization] Created godmin role: ${roleId}`)}else roleId=existingRole[0].id,logger2.debug(`[Authorization] Godmin role already exists: ${roleId}`);let userId,existingUser=await db.select().from(usersTable).where(eq4(usersTable.email,config.godminEmail)).limit(1);if(existingUser.length===0){let hashedPassword=await password.hash(config.godminPassword,{algorithm:"bcrypt",cost:10}),[newUser]=await db.insert(usersTable).values({email:config.godminEmail,password:hashedPassword,verifiedAt:new Date,isActive:!0,isGod:!0}).returning();userId=newUser.id,logger2.info(`[Authorization] Created godmin user: ${userId}`)}else{if(userId=existingUser[0].id,!existingUser[0].isGod)await db.update(usersTable).set({isGod:!0}).where(eq4(usersTable.id,userId)),logger2.info(`[Authorization] Marked existing godmin user as isGod=true: ${userId}`);logger2.debug(`[Authorization] Godmin user already exists: ${userId}`)}if(!((await db.select().from(userRolesTable).where(and3(eq4(userRolesTable.userId,userId),eq4(userRolesTable.roleId,roleId))).limit(1)).length>0))await db.insert(userRolesTable).values({userId,roleId}),logger2.info(`[Authorization] Assigned godmin role to user: ${userId}`);return{success:!0,userId,roleId}}catch(error){return logger2.error("[Authorization] Failed to setup godmin",error),{success:!1}}}function isGodminRole(roleName){return roleName===GODMIN_ROLE_NAME}var init_GodminSetup=__esm(()=>{init_types3()});import{and as and4,eq as eq5,inArray,sql}from"drizzle-orm";function isSelfReference(value){return value.startsWith(SELF_PREFIX)}function parseSelfReference(value){return{field:value.slice(SELF_PREFIX.length)}}function parseScopeWithSelf(scope){if(!scope)return{};let params=new URLSearchParams(scope),result={};for(let[key,value]of params.entries())if(isSelfReference(value))result[key]=parseSelfReference(value);else result[key]=value;return result}function resolveScopeWithSelf(parsedScope,userData,logger2){let resolved={},unresolved=[];for(let[key,value]of Object.entries(parsedScope))if(typeof value==="object"&&"field"in value){if(!userData){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - userData not provided`),unresolved.push(key);continue}let lookup=lookupUserDataField(userData,value.field);if(!lookup.found){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - field not found in userData`),unresolved.push(key);continue}resolved[key]=lookup.value,logger2.debug(`[Authorization] Resolved self:${value.field} -> ${String(lookup.value)}`)}else resolved[key]=value;return{resolved,unresolved}}function resolveClaimScopes(rows,userData,logger2){let claimScopes={},dropped=new Set,unrestricted=new Set;for(let{action,scope}of rows){if(!scope){unrestricted.add(action);continue}if(!scope.includes("="))continue;let parsed=parseScopeWithSelf(scope),{resolved,unresolved}=resolveScopeWithSelf(parsed,userData,logger2);if(unresolved.length>0){dropped.add(action);continue}claimScopes[action]={...claimScopes[action]??{},...resolved}}for(let a of unrestricted)delete claimScopes[a],dropped.delete(a);for(let a of dropped)delete claimScopes[a];return{claimScopes,dropped:Array.from(dropped)}}function mergeGrantingScopes(grantingActions,claimScopes){if(!claimScopes)return;let merged={},any=!1;for(let action of grantingActions){let s=claimScopes[action];if(!s||Object.keys(s).length===0)return;Object.assign(merged,s),any=!0}return any?merged:void 0}function buildClaimPattern(method,entity,field,relation){let parts=[method.toLowerCase(),entity];if(relation)parts.push("with",relation);else if(field)parts.push(field);return parts.join(".")}function claimMatches(userClaim,requiredPattern,requireSpecificity=!1){if(userClaim===requiredPattern)return!0;let userParts=userClaim.split("."),requiredParts=requiredPattern.split(".");if(userParts.length>requiredParts.length)return!1;if(requireSpecificity&&userParts.length<2&&requiredParts.length>=2)return!1;for(let i=0;i<userParts.length;i++)if(userParts[i]!==requiredParts[i])return!1;return!0}async function checkAuthorization(params){let{userId,method,entity,requestedFields,requestedRelations,db,schemaTables,logger:logger2,getUserData}=params,reqSpec=params.requireClaimSpecificity??!1,ceiling=params.claimCeiling?new Set(params.claimCeiling):void 0,userData=params.userData,ensureUserData=async()=>{if(userData!==void 0)return;if(getUserData)try{userData=await getUserData()}catch(err){logger2.warn("[Authorization] getUserData callback failed",{userId,error:err instanceof Error?err.message:String(err)})}},rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles],userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],roleClaimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roleClaims],claimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.claims];if(!rolesTable||!userRolesTable||!roleClaimsTable||!claimsTable)return logger2.error("[Authorization] Required tables not found"),{authorized:!1,reason:"Authorization tables not configured"};try{let userRolesCols=userRolesTable,rolesCols=rolesTable,userRoles=await db.select({roleId:userRolesCols.roleId,roleName:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq5(userRolesCols.roleId,rolesCols.id)).where(and4(eq5(userRolesCols.userId,userId),activeGrantPredicate({userRoles:userRolesTable})));if(userRoles.length===0)return{authorized:!1,reason:"User has no roles assigned"};if(userRoles.some((ur)=>isGodminRole(ur.roleName))&&!ceiling)return logger2.debug(`[Authorization] User ${userId} has godmin role, bypassing checks`),{authorized:!0};let roleIds=userRoles.map((ur)=>ur.roleId),roleClaimsCols=roleClaimsTable,claimsCols=claimsTable,ownerGrants=await db.select({claimAction:claimsCols.action,scope:roleClaimsCols.scope}).from(roleClaimsTable).innerJoin(claimsTable,eq5(roleClaimsCols.claimId,claimsCols.id)).where(and4(inArray(roleClaimsCols.roleId,roleIds),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable})));if(ownerGrants.length===0)return{authorized:!1,reason:"User roles have no claims assigned"};let roleClaims=ceiling?ownerGrants.filter((rc)=>ceiling.has(rc.claimAction)):ownerGrants;if(roleClaims.length===0)return{authorized:!1,reason:"API key carries none of its owner's claims"};let entityClaimPattern=buildClaimPattern(method,entity),hasEntityAccess=roleClaims.some((rc)=>claimMatches(rc.claimAction,entityClaimPattern,reqSpec)),allowedFields=[],allowedRelations=[],scopeFilters={},unresolvedSelf=[],fieldPatterns=(requestedFields??[]).map((field)=>({field,pattern:buildClaimPattern(method,entity,field)})),relationPatterns=(requestedRelations??[]).map((relation)=>({relation,pattern:buildClaimPattern(method,entity,void 0,relation)})),claimCouldGrant=(action)=>claimMatches(action,entityClaimPattern,reqSpec)||fieldPatterns.some((f)=>claimMatches(action,f.pattern,reqSpec))||relationPatterns.some((r)=>claimMatches(action,r.pattern,reqSpec));if(roleClaims.some((rc)=>{let scope=rc.scope;return!!scope&&scope.includes("self:")&&claimCouldGrant(rc.claimAction)}))await ensureUserData();let applyClaimScope=(rc)=>{let parsedScope=parseScopeWithSelf(rc.scope),{resolved,unresolved}=resolveScopeWithSelf(parsedScope,userData,logger2);Object.assign(scopeFilters,resolved),unresolvedSelf.push(...unresolved)},denyOnUnresolvedSelf=()=>{if(unresolvedSelf.length===0)return null;return logger2.warn("[Authorization] Denying request: unresolvable self: scope (failing closed)",{userId,method,entity,unresolved:unresolvedSelf}),{authorized:!1,reason:"Ownership scope could not be resolved"}};if(hasEntityAccess){let unrestricted=!1;for(let rc of roleClaims){if(!claimMatches(rc.claimAction,entityClaimPattern,reqSpec))continue;if(!rc.scope){unrestricted=!0;continue}applyClaimScope(rc)}if(unrestricted)return{authorized:!0};let denied=denyOnUnresolvedSelf();if(denied)return denied;return{authorized:!0,scopeFilters:Object.keys(scopeFilters).length>0?scopeFilters:void 0}}let unrestrictedField=!1;for(let{field,pattern}of fieldPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedFields.push(field),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}for(let{relation,pattern}of relationPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedRelations.push(relation),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}if(!unrestrictedField){let denied=denyOnUnresolvedSelf();if(denied)return denied}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,scopeFilters:!unrestrictedField&&Object.keys(scopeFilters).length>0?scopeFilters:void 0}}catch(error){return logger2.error("[Authorization] Check failed",error),{authorized:!1,reason:"Authorization check failed"}}}function checkAuthorizationFromJWT(params){let{userClaims,userRoles,method,entity,requestedFields,requestedRelations,logger:logger2}=params,reqSpec=params.requireClaimSpecificity??!1,claimScopes=params.claimScopes;if(userClaims.length===0&&userRoles.length===0)return{authorized:!1,reason:"No roles or claims in token"};if(userRoles.some((r)=>isGodminRole(r)))return logger2.debug("[Authorization:JWT] User has godmin role, bypassing checks"),{authorized:!0};let entityClaimPattern=buildClaimPattern(method,entity),entityGranting=userClaims.filter((c)=>claimMatches(c,entityClaimPattern,reqSpec));if(entityGranting.length>0){let scopeFilters2=mergeGrantingScopes(entityGranting,claimScopes);return{authorized:!0,...scopeFilters2?{scopeFilters:scopeFilters2}:{}}}let allowedFields=[],allowedRelations=[],grantingActions=[];if(requestedFields)for(let field of requestedFields){let fieldPattern=buildClaimPattern(method,entity,field),granting=userClaims.filter((c)=>claimMatches(c,fieldPattern,reqSpec));if(granting.length>0)allowedFields.push(field),grantingActions.push(...granting)}if(requestedRelations)for(let relation of requestedRelations){let relationPattern=buildClaimPattern(method,entity,void 0,relation),granting=userClaims.filter((c)=>claimMatches(c,relationPattern,reqSpec));if(granting.length>0)allowedRelations.push(relation),grantingActions.push(...granting)}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};let scopeFilters=mergeGrantingScopes(grantingActions,claimScopes);return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,...scopeFilters?{scopeFilters}:{}}}async function checkAuthorizationViaIDP(params){let{idpUrl,accessToken,method,entity,requestedFields,requestedRelations,logger:logger2}=params;try{let response=await fetch(`${idpUrl}/auth/check`,{method:"POST",headers:{"Content-Type":"application/json",Cookie:`access_token=${accessToken}`},body:JSON.stringify({entity,method,fields:requestedFields,relations:requestedRelations})});if(!response.ok)return logger2.warn(`[Authorization:IDP] IDP /auth/check returned ${response.status}`),{authorized:!1,reason:`IDP authorization check failed (${response.status})`};let payload=await response.json();return unwrapIdpCheckResponse(payload)}catch(error){let msg=error instanceof Error?error.message:String(error);return logger2.error(`[Authorization:IDP] Failed to reach IDP: ${msg}`),{authorized:!1,reason:"IDP authorization service unavailable"}}}function filterResponseFields(data,allowedFields){if(!allowedFields||allowedFields.length===0)return data;let fieldsToInclude=[...new Set([...["id"],...allowedFields])],toCamel=(value)=>value.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase()),allowedKeys=new Set;for(let field of fieldsToInclude)allowedKeys.add(field),allowedKeys.add(toCamel(field));let filterSingle=(item)=>{let filtered={};for(let key of Object.keys(item))if(allowedKeys.has(key))filtered[key]=item[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function filterResponseRelations(data,allowedRelations){if(!allowedRelations)return data;let filterSingle=(item)=>{let filtered={...item};for(let key of Object.keys(filtered))if(typeof filtered[key]==="object"&&filtered[key]!==null&&!allowedRelations.includes(key))delete filtered[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function buildScopeConditions(scopeFilters,resolveColumn){let conditions=[],unresolvedFields=[];if(!scopeFilters)return{conditions,unresolvedFields};for(let[field,value]of Object.entries(scopeFilters)){let col=resolveColumn(field);if(col)conditions.push(eq5(col,value));else unresolvedFields.push(field),conditions.push(sql`1 = 0`)}return{conditions,unresolvedFields}}var SELF_PREFIX="self:",toCamelCase2=(value)=>value.replace(/_([a-z])/g,(_,c)=>c.toUpperCase()),toSnakeCase=(value)=>value.replace(/([A-Z])/g,(_,c)=>`_${c.toLowerCase()}`),lookupUserDataField=(userData,fieldName)=>{if(fieldName in userData)return{found:!0,value:userData[fieldName]};let camel=toCamelCase2(fieldName);if(camel!==fieldName&&camel in userData)return{found:!0,value:userData[camel]};let snake=toSnakeCase(fieldName);if(snake!==fieldName&&snake in userData)return{found:!0,value:userData[snake]};return{found:!1}},unwrapIdpCheckResponse=(payload)=>{if(!payload||typeof payload!=="object")return{authorized:!1,reason:"IDP returned malformed response"};let envelope=payload;if(envelope.data&&typeof envelope.data==="object"){let data=envelope.data;if(typeof data.authorized==="boolean")return data}let flat=payload;if(typeof flat.authorized==="boolean")return flat;return{authorized:!1,reason:"IDP returned unrecognised response shape"}};var init_Middleware=__esm(()=>{init_activeRows();init_GodminSetup();init_types3()});var exports_SeedRunner={};__export(exports_SeedRunner,{runSeed:()=>runSeed,expandClaimPatterns:()=>expandClaimPatterns});import{and as and5,eq as eq6}from"drizzle-orm";function expandClaimPatterns(patterns,allActions){let out=new Set;for(let pattern of patterns)if(pattern.endsWith(".*")){let prefix=pattern.slice(0,-2);for(let action of allActions)if(action===prefix||action.startsWith(`${prefix}.`))out.add(action)}else out.add(pattern);return[...out]}async function runSeed(db,schemaTables,seedConfig,logger2){let{roles:rolesTable,claims:claimsTable,roleClaims:roleClaimsTable}=schemaTables,result={rolesCreated:0,rolesExisting:0,claimsCreated:0,claimsExisting:0,assignmentsCreated:0,assignmentsExisting:0,assignmentsUpdated:0};if(seedConfig.roles?.length&&rolesTable)for(let roleDef of seedConfig.roles)try{if((await db.select().from(rolesTable).where(eq6(rolesTable.name,roleDef.name)).limit(1)).length===0)await db.insert(rolesTable).values({name:roleDef.name,description:roleDef.description||""}),result.rolesCreated++,logger2.info(`[Seed] Created role: ${roleDef.name}`);else result.rolesExisting++}catch(error){logger2.error(`[Seed] Failed to seed role: ${roleDef.name}`,error)}if(seedConfig.claims?.length&&claimsTable)for(let claimDef of seedConfig.claims)try{let existing=await db.select().from(claimsTable).where(eq6(claimsTable.action,claimDef.action)).limit(1);if(existing.length===0)await db.insert(claimsTable).values({action:claimDef.action,path:claimDef.path,method:claimDef.method,description:claimDef.description||`${claimDef.method} ${claimDef.path}`,...claimDef.policy!==void 0?{policy:claimDef.policy}:{}}),result.claimsCreated++,logger2.info(`[Seed] Created claim: ${claimDef.action}`);else if(claimDef.policy!==void 0){let existingRow=existing[0],currentPolicy=JSON.stringify(existingRow.policy??null),desiredPolicy=JSON.stringify(claimDef.policy??null);if(currentPolicy!==desiredPolicy)await db.update(claimsTable).set({policy:claimDef.policy}).where(eq6(claimsTable.action,claimDef.action)),result.claimsExisting++,logger2.warn(`[Seed] Reconciled policy for claim: ${claimDef.action}`);else result.claimsExisting++}else result.claimsExisting++}catch(error){logger2.error(`[Seed] Failed to seed claim: ${claimDef.action}`,error)}if(seedConfig.roleClaimAssignments?.length&&rolesTable&&claimsTable&&roleClaimsTable){let allClaimActions=(await db.select().from(claimsTable)).map((c)=>String(c.action??""));for(let assignment of seedConfig.roleClaimAssignments){let role=(await db.select().from(rolesTable).where(eq6(rolesTable.name,assignment.role)).limit(1))[0];if(!role){logger2.warn(`[Seed] Role not found for assignment: ${assignment.role}`);continue}let roleId=role.id,resolvedActions=expandClaimPatterns(assignment.claims,allClaimActions);for(let pattern of assignment.claims)if(pattern.endsWith(".*")&&!resolvedActions.some((a)=>a.startsWith(pattern.slice(0,-1))))logger2.warn(`[Seed] No claim matched prefix pattern: ${pattern}`);for(let claimAction of resolvedActions)try{let claim=(await db.select().from(claimsTable).where(eq6(claimsTable.action,claimAction)).limit(1))[0];if(!claim){logger2.warn(`[Seed] Claim not found for assignment: ${claimAction}`);continue}let claimId=claim.id,existingAssignment=await db.select().from(roleClaimsTable).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))).limit(1);if(existingAssignment.length===0)await db.insert(roleClaimsTable).values({roleId,claimId,scope:assignment.scope||null}),result.assignmentsCreated++;else{let existingRow=existingAssignment[0],desiredScope=assignment.scope||null,currentScope=existingRow.scope??null;if(currentScope!==desiredScope)await db.update(roleClaimsTable).set({scope:desiredScope}).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))),result.assignmentsUpdated++,logger2.warn(`[Seed] Reconciled scope for ${assignment.role} -> ${claimAction}: ${JSON.stringify(currentScope)} => ${JSON.stringify(desiredScope)}`);else result.assignmentsExisting++}}catch(error){logger2.error(`[Seed] Failed to assign claim ${claimAction} to role ${assignment.role}`,error)}if(result.assignmentsCreated>0)logger2.info(`[Seed] Role "${assignment.role}": assigned ${result.assignmentsCreated} claims`)}}return result}var init_SeedRunner=()=>{};var init_Authorization=__esm(()=>{init_ClaimSeeder();init_ClaimsCache();init_GodminSetup();init_Middleware();init_SeedRunner();init_types3()});function parseField(raw,spec){let out=new Set;for(let part of raw.split(",")){if(part==="")return null;let[rangePart,stepPart,...extra]=part.split("/");if(extra.length>0||rangePart===void 0)return null;let step=1;if(stepPart!==void 0){if(!/^\d+$/.test(stepPart))return null;if(step=Number.parseInt(stepPart,10),step<1)return null}let from,to;if(rangePart==="*")from=spec.min,to=spec.max;else if(rangePart.includes("-")){let[a,b,...rest]=rangePart.split("-");if(rest.length>0||!isIntInRange(a,spec)||!isIntInRange(b,spec))return null;if(from=namedToNumber(a,spec),to=namedToNumber(b,spec),from>to)return null}else{if(!isIntInRange(rangePart,spec))return null;from=namedToNumber(rangePart,spec),to=stepPart===void 0?from:spec.max}for(let v=from;v<=to;v+=step)out.add(v)}return out.size>0?out:null}function isIntInRange(value,spec){if(value===void 0)return!1;let n=namedToNumber(value,spec);return n!==null&&n>=spec.min&&n<=spec.max}function namedToNumber(value,spec){if(/^\d+$/.test(value))return Number.parseInt(value,10);let lower=value.toLowerCase();if(spec===MONTH){let i=MONTH_NAMES.indexOf(lower);return i===-1?null:i+1}if(spec===WEEKDAY){let i=DAY_NAMES.indexOf(lower);return i===-1?null:i}return null}function parseCron(expression){let trimmed=expression.trim(),parts=(MACROS[trimmed.toLowerCase()]??trimmed).split(/\s+/);if(parts.length!==5)return null;let[minRaw,hourRaw,dayRaw,monthRaw,weekdayRaw]=parts,minute=parseField(minRaw,MINUTE),hour=parseField(hourRaw,HOUR),day=parseField(dayRaw,DAY),month=parseField(monthRaw,MONTH),weekdayRawSet=parseField(weekdayRaw,WEEKDAY);if(!minute||!hour||!day||!month||!weekdayRawSet)return null;let weekday=new Set([...weekdayRawSet].map((d)=>d===7?0:d));return{minute,hour,day,month,weekday,dayUnrestricted:dayRaw==="*",weekdayUnrestricted:weekdayRaw==="*"}}function formatterFor(timeZone){let cached=formatterCache.get(timeZone);if(cached)return cached;try{let fmt=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short"});return formatterCache.set(timeZone,fmt),fmt}catch{return null}}function partsIn(ts,fmt){let parts=fmt.formatToParts(new Date(ts)),get=(type)=>parts.find((p)=>p.type===type)?.value??"0",hour=Number.parseInt(get("hour"),10)%24;return{year:Number.parseInt(get("year"),10),month:Number.parseInt(get("month"),10),day:Number.parseInt(get("day"),10),hour,minute:Number.parseInt(get("minute"),10),weekday:WEEKDAY_INDEX[get("weekday")]??0}}function offsetMsAt(ts,fmt){let p=partsIn(ts,fmt);return Date.UTC(p.year,p.month-1,p.day,p.hour,p.minute,new Date(ts).getUTCSeconds())-Math.floor(ts/1000)*1000}function zonedWallTimeToInstant(year,month,day,hour,minute,fmt){let naive=Date.UTC(year,month-1,day,hour,minute,0,0),ts=naive-offsetMsAt(naive,fmt),corrected=naive-offsetMsAt(ts,fmt);if(corrected!==ts)ts=corrected;let target=stamp(year,month,day,hour,minute),localStamp=(at)=>{let p=partsIn(at,fmt);return stamp(p.year,p.month,p.day,p.hour,p.minute)};if(localStamp(ts)===target)return ts;let probe=Math.min(ts,naive-offsetMsAt(naive,fmt));for(let i=0;i<=240;i++){if(localStamp(probe)>=target)return probe;probe+=60000}return ts}function stamp(year,month,day,hour,minute){return((year*100+month)*100+day)*1e4+hour*100+minute}function dayMatches(fields,wall){if(!fields.month.has(wall.month))return!1;let domOk=fields.day.has(wall.day),dowOk=fields.weekday.has(wall.weekday);if(fields.dayUnrestricted&&fields.weekdayUnrestricted)return!0;if(fields.dayUnrestricted)return dowOk;if(fields.weekdayUnrestricted)return domOk;return domOk||dowOk}function nextCronRun(expression,from=new Date,timeZone="UTC"){let fields=parseCron(expression);if(!fields)return null;let fmt=formatterFor(timeZone)??formatterFor("UTC");if(!fmt)return null;let hours=[...fields.hour].sort((a,b)=>a-b),minutes=[...fields.minute].sort((a,b)=>a-b),fromTs=from.getTime();if(!Number.isFinite(fromTs))return null;let cursor=partsIn(fromTs,fmt);for(let dayIndex=0;dayIndex<2929;dayIndex++){if(dayMatches(fields,cursor))for(let hour of hours)for(let minute of minutes){let ts=zonedWallTimeToInstant(cursor.year,cursor.month,cursor.day,hour,minute,fmt);if(ts>fromTs)return new Date(ts)}let nextDayUtc=Date.UTC(cursor.year,cursor.month-1,cursor.day+1,12,0,0),probe=new Date(nextDayUtc);cursor={year:probe.getUTCFullYear(),month:probe.getUTCMonth()+1,day:probe.getUTCDate(),hour:0,minute:0,weekday:probe.getUTCDay()}}return null}var MINUTE,HOUR,DAY,MONTH,WEEKDAY,MONTH_NAMES,DAY_NAMES,MACROS,formatterCache,WEEKDAY_INDEX;var init_cron=__esm(()=>{MINUTE={min:0,max:59},HOUR={min:0,max:23},DAY={min:1,max:31},MONTH={min:1,max:12},WEEKDAY={min:0,max:7};MONTH_NAMES=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"],DAY_NAMES=["sun","mon","tue","wed","thu","fri","sat"];MACROS={"@yearly":"0 0 1 1 *","@annually":"0 0 1 1 *","@monthly":"0 0 1 * *","@weekly":"0 0 * * 0","@daily":"0 0 * * *","@midnight":"0 0 * * *","@hourly":"0 * * * *"};formatterCache=new Map;WEEKDAY_INDEX={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6}});import{createCipheriv,createDecipheriv,randomBytes as randomBytes2,scryptSync}from"crypto";var MAGIC,IV_LEN=12,TAG_LEN=16,deriveKey=(secret)=>scryptSync(secret,"nucleus-backup-v1",32),encryptBackup=(plaintext,secret)=>{if(!secret)throw Error("backup encryption key is empty");let key=deriveKey(secret),iv=randomBytes2(IV_LEN),cipher=createCipheriv("aes-256-gcm",key,iv),ciphertext=Buffer.concat([cipher.update(plaintext,"utf-8"),cipher.final()]),tag=cipher.getAuthTag();return Buffer.concat([MAGIC,iv,tag,ciphertext])},isEncryptedBackup=(buf)=>buf.length>=MAGIC.length+IV_LEN+TAG_LEN&&buf.subarray(0,MAGIC.length).equals(MAGIC),decryptBackup=(blob,secret)=>{if(!secret)throw Error("backup encryption key is empty");if(!isEncryptedBackup(blob))throw Error("not an encrypted backup");let key=deriveKey(secret),iv=blob.subarray(MAGIC.length,MAGIC.length+IV_LEN),tag=blob.subarray(MAGIC.length+IV_LEN,MAGIC.length+IV_LEN+TAG_LEN),ciphertext=blob.subarray(MAGIC.length+IV_LEN+TAG_LEN),decipher=createDecipheriv("aes-256-gcm",key,iv);return decipher.setAuthTag(tag),Buffer.concat([decipher.update(ciphertext),decipher.final()]).toString("utf-8")};var init_encryption=__esm(()=>{MAGIC=Buffer.from("NXB1")});import{mkdir as mkdir3,readFile,stat as stat2,unlink as unlink3,writeFile}from"fs/promises";import{join as join4}from"path";import{eq as eq7,getTableColumns,sql as sql2}from"drizzle-orm";function nextHopMs(delayMs){if(!Number.isFinite(delayMs)||delayMs<=0)return 0;return Math.min(delayMs,MAX_TIMEOUT_MS)}function reviveRowTypes(table,rows){let columns;try{columns=getTableColumns(table)}catch{return rows}let dateColumns=Object.entries(columns).filter(([,col2])=>col2?.dataType==="date").map(([name])=>name);if(dateColumns.length===0)return rows;return rows.map((row)=>{let copy=null;for(let name of dateColumns){let value=row[name];if(typeof value!=="string")continue;let parsed=new Date(value);if(Number.isNaN(parsed.getTime()))continue;if(!copy)copy={...row};copy[name]=parsed}return copy??row})}function normalizeTableName(name){return name.replace(/[^a-z0-9]/gi,"").toLowerCase()}function selectBackupTables(tables,excludeTables){let excluded=new Set(excludeTables.map(normalizeTableName));return Object.keys(tables).filter((name)=>{if(excluded.has(normalizeTableName(name)))return!1;let val=tables[name];if(!val||typeof val!=="object")return!1;return Object.getOwnPropertySymbols(val).length>0})}class BackupService{db;logger;config;schemaTables;schemaName;backupLogsTable;cronTimer=null;schedulerActive=!1;lock;constructor(serviceConfig){this.db=serviceConfig.db,this.logger=serviceConfig.logger,this.config=serviceConfig.config,this.schemaTables=serviceConfig.schemaTables,this.schemaName=serviceConfig.schemaName,this.backupLogsTable=serviceConfig.backupLogsTable,this.lock=serviceConfig.lock}async createBackup(trigger="manual",performedBy,targetSchemaName,targetSchemaTables){let resolvedSchema=targetSchemaName||this.schemaName,resolvedTables=targetSchemaTables||this.schemaTables,now=new Date,backupId=crypto.randomUUID(),timestamp=now.toISOString().replace(/[:.]/g,"-"),backupName=`${resolvedSchema}_${timestamp}`,fileName=`${backupName}.json`,filePath=join4(this.config.storagePath,fileName),logRecord={id:backupId,backupName,fileName,schemaName:resolvedSchema,format:this.config.format,status:"running",trigger,sizeBytes:null,tableCount:null,rowCount:null,includedTables:[],excludedTables:this.config.excludeTables,errorMessage:null,startedAt:now.toISOString(),completedAt:null,performedBy:performedBy||null,cronExpression:trigger==="scheduled"?this.config.schedule.cron:null,retentionDays:this.config.schedule.retentionDays};await this.insertLogRecord(logRecord);try{await mkdir3(this.config.storagePath,{recursive:!0});let tableNames=this.getBackupTableNames(resolvedTables),backupData=[],totalRows=0;for(let tableName of tableNames){let table=resolvedTables[tableName];if(!table)continue;try{let rows=await this.db.select().from(table),columns=Object.keys(table).filter((k)=>!k.startsWith("_")&&typeof table[k]!=="function");backupData.push({tableName,columns,rows}),totalRows+=rows.length}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to export table ${tableName}: ${msg}`)}}let backupFile={manifest:{version:"1.0",createdAt:now.toISOString(),schemaName:resolvedSchema,format:this.config.format,tables:backupData.map((t)=>({tableName:t.tableName,rowCount:t.rows.length,columns:t.columns})),totalRows},data:backupData},jsonContent=JSON.stringify(backupFile,null,2);if(this.config.encryptionKey)await writeFile(filePath,encryptBackup(jsonContent,this.config.encryptionKey));else await writeFile(filePath,jsonContent,"utf-8");let fileStats=await stat2(filePath);return logRecord.status="completed",logRecord.completedAt=new Date().toISOString(),logRecord.tableCount=backupData.length,logRecord.rowCount=totalRows,logRecord.sizeBytes=fileStats.size,logRecord.includedTables=tableNames,await this.updateLogRecord(logRecord),this.logger.info("[Backup] Backup completed",{backupId,schemaName:resolvedSchema,tables:backupData.length,rows:totalRows,sizeBytes:fileStats.size}),await this.enforceMaxBackups(),logRecord}catch(err){let msg=err instanceof Error?err.message:String(err);return logRecord.status="failed",logRecord.errorMessage=msg,logRecord.completedAt=new Date().toISOString(),await this.updateLogRecord(logRecord),this.logger.error("[Backup] Backup failed",err,{backupId,schemaName:resolvedSchema}),logRecord}}async restoreFromBackup(backupId,performedBy,targetSchemaName,targetSchemaTables){if(!this.config.allowRestore)return{success:!1,message:"Restore is disabled in configuration"};let resolvedTables=targetSchemaTables||this.schemaTables,logRecord=await this.getLogRecord(backupId);if(!logRecord)return{success:!1,message:"Backup not found"};if(logRecord.status!=="completed")return{success:!1,message:`Cannot restore from backup with status: ${logRecord.status}`};let filePath=join4(this.config.storagePath,logRecord.fileName);try{let raw=await readFile(filePath),content;if(isEncryptedBackup(raw)){if(!this.config.encryptionKey)return{success:!1,message:"Backup is encrypted but no encryption key is configured"};content=decryptBackup(raw,this.config.encryptionKey)}else content=raw.toString("utf-8");let backupFile=JSON.parse(content);await this.createBackup("pre_restore",performedBy,targetSchemaName,targetSchemaTables);let tablesRestored=0,rowsRestored=0,ordered=backupFile.data.map((tableData)=>({tableData,table:resolvedTables[tableData.tableName]})).filter((entry)=>{if(!entry.table)return this.logger.warn(`[Backup] Skipping restore for ${entry.tableData.tableName}: table not found in schema`),!1;return!0});return await this.db.transaction(async(tx)=>{for(let{table}of[...ordered].reverse())await tx.delete(table);for(let{tableData,table}of ordered){if(tableData.rows.length===0)continue;let chunkSize=500;for(let i=0;i<tableData.rows.length;i+=chunkSize){let chunk=reviveRowTypes(table,tableData.rows.slice(i,i+chunkSize));await tx.insert(table).values(chunk)}tablesRestored++,rowsRestored+=tableData.rows.length}}),logRecord.status="restored",await this.updateLogRecord(logRecord),this.logger.info("[Backup] Restore completed",{backupId,tablesRestored,rowsRestored}),{success:!0,message:`Restored ${tablesRestored} tables with ${rowsRestored} rows`,tablesRestored,rowsRestored}}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.error("[Backup] Restore failed",err,{backupId}),{success:!1,message:`Restore failed: ${msg}`}}}async listBackups(){if(!this.backupLogsTable)return[];return await this.db.select().from(this.backupLogsTable).orderBy(sql2`created_at DESC`).limit(100)}async getBackupFilePath(backupId){let record=await this.getLogRecord(backupId);if(!record)return null;return join4(this.config.storagePath,record.fileName)}async deleteBackup(backupId){let record=await this.getLogRecord(backupId);if(!record)return!1;let filePath=join4(this.config.storagePath,record.fileName);try{await unlink3(filePath)}catch{}if(this.backupLogsTable)await this.db.delete(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId));return!0}startScheduler(){if(!this.config.schedule.enabled||!this.config.schedule.cron)return;if(!parseCron(this.config.schedule.cron))this.logger.error("[Backup] Cron expression not understood \u2014 falling back to the default",{cron:this.config.schedule.cron,fallback:DEFAULT_CRON,expected:'five fields ("0 2 * * *", "0 3 * * MON", "*/15 * * * *") or a macro (@daily, @weekly, @monthly)'}),this.config={...this.config,schedule:{...this.config.schedule,cron:DEFAULT_CRON}};this.logger.info("[Backup] Scheduler started",{cron:this.config.schedule.cron,timeZone:this.scheduleTimeZone(),retentionDays:this.config.schedule.retentionDays,replicaSafe:Boolean(this.lock)}),this.schedulerActive=!0,this.scheduleNextRun()}scheduleTimeZone(){return this.config.schedule.timeZone||"UTC"}scheduleNextRun(){if(!this.schedulerActive)return;let now=new Date,nextRun=nextCronRun(this.config.schedule.cron,now,this.scheduleTimeZone());if(!nextRun){this.logger.error("[Backup] Cron expression matches no future time \u2014 scheduler stopped",{cron:this.config.schedule.cron}),this.schedulerActive=!1;return}let delayMs=nextRun.getTime()-now.getTime();this.logger.debug?.("[Backup] Next scheduled backup",{at:nextRun.toISOString(),inMs:delayMs});let hop=nextHopMs(delayMs);this.cronTimer=setTimeout(async()=>{if(Date.now()<nextRun.getTime()){this.scheduleNextRun();return}try{if(await this.claimScheduledRun(nextRun))this.logger.info("[Backup] Scheduled backup starting..."),await this.createBackup("scheduled"),await this.cleanupExpiredBackups()}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.error("[Backup] Scheduled backup failed",{error:msg})}finally{this.scheduleNextRun()}},hop)}async claimScheduledRun(fireTime){if(!this.lock)return!0;let key=`nucleus:backup:schedule:${this.schemaName}:${fireTime.toISOString()}`;try{let result=await this.lock.acquireLock(key,3600);if(result.success&&result.data===!1)return this.logger.info("[Backup] Another replica owns this run \u2014 skipping",{fireTime:fireTime.toISOString()}),!1;return!0}catch(err){return this.logger.warn("[Backup] Lock unavailable \u2014 running anyway",{error:err instanceof Error?err.message:String(err)}),!0}}stopScheduler(){if(this.schedulerActive=!1,this.cronTimer)clearTimeout(this.cronTimer),this.cronTimer=null,this.logger.info("[Backup] Scheduler stopped")}getBackupTableNames(tables){return selectBackupTables(tables,this.config.excludeTables)}async insertLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.insert(this.backupLogsTable).values({id:record.id,backupName:record.backupName,fileName:record.fileName,schemaName:record.schemaName,format:record.format,status:record.status,trigger:record.trigger,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),excludedTables:JSON.stringify(record.excludedTables),errorMessage:record.errorMessage,startedAt:record.startedAt?new Date(record.startedAt):null,completedAt:record.completedAt?new Date(record.completedAt):null,performedBy:record.performedBy,cronExpression:record.cronExpression,retentionDays:record.retentionDays,createdAt:new Date,updatedAt:new Date})}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to insert backup log: ${msg}`)}}async updateLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.update(this.backupLogsTable).set({status:record.status,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),errorMessage:record.errorMessage,completedAt:record.completedAt?new Date(record.completedAt):null,updatedAt:new Date}).where(eq7(col(this.backupLogsTable,"id"),record.id))}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to update backup log: ${msg}`)}}async getLogRecord(backupId){if(!this.backupLogsTable)return null;return(await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId)).limit(1))[0]||null}async enforceMaxBackups(){if(!this.backupLogsTable)return;let allBackups=await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"status"),"completed")).orderBy(sql2`created_at DESC`);if(allBackups.length>this.config.maxBackups){let toDelete=allBackups.slice(this.config.maxBackups);for(let backup of toDelete){let b=backup;await this.deleteBackup(b.id)}this.logger.info("[Backup] Old backups cleaned up",{deleted:toDelete.length})}}async cleanupExpiredBackups(){if(!this.backupLogsTable||!this.config.schedule.retentionDays)return;let cutoff=new Date;cutoff.setDate(cutoff.getDate()-this.config.schedule.retentionDays);let{lt}=await import("drizzle-orm"),expired=await this.db.select().from(this.backupLogsTable).where(lt(col(this.backupLogsTable,"createdAt"),cutoff));for(let backup of expired){let b=backup;await this.deleteBackup(b.id)}if(expired.length>0)this.logger.info("[Backup] Expired backups cleaned up",{deleted:expired.length,retentionDays:this.config.schedule.retentionDays})}}var col=(table,name)=>table[name],MAX_TIMEOUT_MS=2147483647,DEFAULT_CRON="0 2 * * *";var init_BackupService=__esm(()=>{init_cron();init_encryption()});var init_Backup=__esm(()=>{init_BackupService()});function parseTimeToSeconds(time){let match=time.match(/^(\d+)(s|m|h|d)$/);if(!match||!match[1]||!match[2])return 300;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value;case"m":return value*60;case"h":return value*3600;case"d":return value*86400;default:return 300}}function generateSecureId(){let bytes=new Uint8Array(24);return crypto.getRandomValues(bytes),Array.from(bytes).map((b)=>b.toString(16).padStart(2,"0")).join("")}function hashAnswer(answer){let hasher=new Bun.CryptoHasher("sha256");return hasher.update(answer),hasher.digest("hex")}function timingSafeEqual(a,b){if(a.length!==b.length){let dummy=new Uint8Array(32);return crypto.getRandomValues(dummy),!1}let encoder=new TextEncoder,bufA=encoder.encode(a),bufB=encoder.encode(b),result=0;for(let i=0;i<bufA.length;i++)result|=(bufA[i]??0)^(bufB[i]??0);return result===0}function getSecureRandomInt(min,max){let range=max-min+1,bytesNeeded=Math.ceil(Math.log2(range)/8)||1,maxValue=256**bytesNeeded,limit=maxValue-maxValue%range,randomValue,bytes=new Uint8Array(bytesNeeded);do crypto.getRandomValues(bytes),randomValue=bytes.reduce((acc,byte,i)=>acc+byte*256**i,0);while(randomValue>=limit);return min+randomValue%range}function generateMathChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],{min,max}=config.mathRange,operations=["+","-","\xD7"],operation=operations[getSecureRandomInt(0,operations.length-1)],num1=getSecureRandomInt(min,max),num2=getSecureRandomInt(min,max),answer;switch(operation){case"+":answer=num1+num2;break;case"-":if(num1<num2)[num1,num2]=[num2,num1];answer=num1-num2;break;case"\xD7":num1=getSecureRandomInt(1,12),num2=getSecureRandomInt(1,12),answer=num1*num2;break;default:answer=num1+num2}return{question:`${num1} ${operation} ${num2} = ?`,answer:answer.toString()}}function generateTextChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],text="";for(let i=0;i<config.textLength;i++)text+=CHARACTERS.charAt(getSecureRandomInt(0,CHARACTERS.length-1));return{question:text,answer:text}}function generateImageChallenge(difficulty){let textChallenge=generateTextChallenge(difficulty),width=200,height=60,svgContent=generateCaptchaSVG(textChallenge.answer,200,60),imageData=`data:image/svg+xml;base64,${Buffer.from(svgContent).toString("base64")}`;return{question:"Enter the text shown in the image",answer:textChallenge.answer,imageData}}function getSecureFloat(){let bytes=new Uint32Array(1);return crypto.getRandomValues(bytes),(bytes[0]??0)/4294967295}function generateCaptchaSVG(text,width,height){let bgR=240+getSecureFloat()*15,bgG=240+getSecureFloat()*15,bgB=240+getSecureFloat()*15,bgColor=`rgb(${bgR}, ${bgG}, ${bgB})`,noiseLines="";for(let i=0;i<12;i++){let x1=getSecureFloat()*width,y1=getSecureFloat()*height,x2=getSecureFloat()*width,y2=getSecureFloat()*height,r=getSecureFloat()*100+100,g=getSecureFloat()*100+100,b=getSecureFloat()*100+100,strokeWidth=1+getSecureFloat()*2;noiseLines+=`<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="rgb(${r},${g},${b})" stroke-width="${strokeWidth}"/>`}let noiseCurves="";for(let i=0;i<4;i++){let startX2=getSecureFloat()*width,startY=getSecureFloat()*height,cp1X=getSecureFloat()*width,cp1Y=getSecureFloat()*height,cp2X=getSecureFloat()*width,cp2Y=getSecureFloat()*height,endX=getSecureFloat()*width,endY=getSecureFloat()*height,r=getSecureFloat()*80+80,g=getSecureFloat()*80+80,b=getSecureFloat()*80+80;noiseCurves+=`<path d="M${startX2},${startY} C${cp1X},${cp1Y} ${cp2X},${cp2Y} ${endX},${endY}" stroke="rgb(${r},${g},${b})" stroke-width="2" fill="none"/>`}let noiseDots="";for(let i=0;i<80;i++){let x=getSecureFloat()*width,y=getSecureFloat()*height,r=getSecureFloat()*150+50,g=getSecureFloat()*150+50,b=getSecureFloat()*150+50,radius=getSecureFloat()*3+1;noiseDots+=`<circle cx="${x}" cy="${y}" r="${radius}" fill="rgb(${r},${g},${b})"/>`}let textElements="",charWidth=width/(text.length+2),startX=charWidth;for(let i=0;i<text.length;i++){let x=startX+i*charWidth+(getSecureFloat()-0.5)*15,y=height/2+8+(getSecureFloat()-0.5)*12,rotation=(getSecureFloat()-0.5)*40,fontSize=22+getSecureFloat()*10,r=getSecureFloat()*80,g=getSecureFloat()*80,b=getSecureFloat()*80,skewX=(getSecureFloat()-0.5)*15,scaleY=0.9+getSecureFloat()*0.3;textElements+=`<text x="${x}" y="${y}" font-family="Arial, Helvetica, sans-serif" font-size="${fontSize}" font-weight="bold" fill="rgb(${r},${g},${b})" transform="rotate(${rotation}, ${x}, ${y}) skewX(${skewX}) scale(1, ${scaleY})" style="font-style: ${getSecureFloat()>0.5?"italic":"normal"}">${text[i]}</text>`}let overlayLines="";for(let i=0;i<3;i++){let y=10+getSecureFloat()*(height-20),r=getSecureFloat()*60+60,g=getSecureFloat()*60+60,b=getSecureFloat()*60+60;overlayLines+=`<line x1="0" y1="${y}" x2="${width}" y2="${y+(getSecureFloat()-0.5)*20}" stroke="rgb(${r},${g},${b})" stroke-width="1.5"/>`}return`<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">
+`).slice(1,4);for(let stackLine of stackLines)method(`  ${dim}${stackLine.trim()}${reset}`)}let cause=entry.error.cause,indent="  ";while(cause){indent+="  ";let code=cause.code!==void 0?` [${cause.code}]`:"";method(`${indent}${color}caused by: ${cause.name}${code}: ${cause.message}${reset}`),cause=cause.cause}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);case"info":return console.info.bind(console);case"warn":return console.warn.bind(console);case"error":case"fatal":return console.error.bind(console);default:return console.log.bind(console)}}}class ServerLogTransport{name="server-log-buffer";buffer;constructor(buffer){this.buffer=buffer}log(entry){this.buffer.add(entry)}}class DatabaseAuditTransport{name="database";db;table;enabled;dedupEnabled;dedupWindowMs;dedupSlots=new Map;lastSweep=0;constructor(options){this.db=options.db,this.table=options.table,this.enabled=options.enabled??!0,this.dedupEnabled=options.dedup?.enabled??!1,this.dedupWindowMs=Math.max(1,options.dedup?.windowSeconds??60)*1000}setDb(db){this.db=db}setTable(table){this.table=table}setEnabled(enabled){this.enabled=enabled}setDedup(dedup){if(this.dedupEnabled=dedup.enabled??this.dedupEnabled,dedup.windowSeconds!=null)this.dedupWindowMs=Math.max(1,dedup.windowSeconds)*1000}isDedupable(entry){return this.dedupEnabled&&(entry.category==="auth"||entry.category==="authz"||entry.category==="security_anomaly")}sweep(now){if(now-this.lastSweep<this.dedupWindowMs)return;this.lastSweep=now;for(let[key,slot]of this.dedupSlots)if(slot.expiresAt<=now)this.dedupSlots.delete(key)}async write(entry){if(!this.enabled||!this.db||!this.table)return;try{let now=Date.now();if(this.isDedupable(entry)){this.sweep(now);let key=`${entry.ipAddress}|${entry.operation}|${entry.summary}|${entry.userId??""}`,slot=this.dedupSlots.get(key);if(slot&&slot.expiresAt>now){slot.count+=1,await this.bumpOccurrence(slot.rowId,slot.count,now);return}this.dedupSlots.set(key,{rowId:entry.id,count:1,expiresAt:now+this.dedupWindowMs})}await this.db.insert(this.table).values({id:entry.id,entityId:entry.entityId,entityName:entry.entityName,operationType:entry.operation,userId:entry.userId,ipAddress:entry.ipAddress,userAgent:entry.userAgent,summary:entry.summary,severity:entry.severity,category:entry.category,occurrenceCount:1,oldValues:entry.oldValues,newValues:entry.newValues,path:entry.path,query:entry.query})}catch(error){console.error("Audit log write failed:",error)}}async bumpOccurrence(rowId,count,nowMs){try{let{eq}=await import("drizzle-orm"),idCol=this.table.id;await this.db.update(this.table).set({occurrenceCount:count,lastOccurrenceAt:new Date(nowMs)}).where(eq(idCol,rowId))}catch(error){console.error("Audit dedup update failed:",error)}}}class ConsoleAuditTransport{name="console-audit";enabled;constructor(options={}){this.enabled=options.enabled??!0}write(entry){if(!this.enabled)return;let reset=RESET_COLOR,dim=DIM_COLOR,color={info:"\x1B[35m",low:"\x1B[90m",medium:"\x1B[33m",high:"\x1B[31m",critical:"\x1B[1m\x1B[31m"}[entry.severity]??"\x1B[35m",sev=entry.severity.toUpperCase(),actor=entry.userId||"anonymous",cat=entry.category;console.log(`${dim}${entry.timestamp}${reset} ${color}AUDIT\xB7${sev}${reset} ${dim}(${cat})${reset} [${entry.operation}] ${entry.entityName}${entry.entityId?`:${entry.entityId}`:""} ${dim}by ${actor}${reset}${entry.summary?` ${dim}\u2014${reset} ${entry.summary}`:""}`)}}var init_transports=__esm(()=>{init_ServerLogBuffer();init_types();init_utils()});class Logger{config;transports;auditTransports;context;correlationId;static instance=null;constructor(config={},context={},correlationId){this.config={...DEFAULT_CONFIG,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||[]])],this.context=context,this.correlationId=correlationId,this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint})],this.auditTransports=[new ConsoleAuditTransport({enabled:this.config.prettyPrint})]}static getInstance(config){if(!Logger.instance)Logger.instance=new Logger(config);return Logger.instance}static resetInstance(){Logger.instance=null}configure(config){return this.config={...this.config,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||this.config.redactKeys||[]])],this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint}),...this.transports.filter((t)=>t.name!=="console")],this}child(context,correlationId){let childLogger=new Logger(this.config,mergeContext(this.context,context)||{},correlationId||this.correlationId);return childLogger.transports=this.transports,childLogger.auditTransports=this.auditTransports,childLogger}withCorrelationId(correlationId){return this.child({},correlationId)}addTransport(transport){this.transports.push(transport)}addAuditTransport(transport){this.auditTransports.push(transport)}setLevel(level){this.config.level=level}setAuditEnabled(enabled){this.config.auditEnabled=enabled}isAuditEnabled(){return this.config.auditEnabled}setAuditSuppressReasons(reasons){this.config.auditSuppressReasons=reasons}setAuditMinSeverity(severity){this.config.auditMinSeverity=severity}shouldLog(level){return LOG_LEVEL_PRIORITY[level]>=LOG_LEVEL_PRIORITY[this.config.level]}shouldLogScope(scope){if(!scope)return!0;return matchesScope(scope,this.config.enabledScopes)}setEnabledScopes(scopes){this.config.enabledScopes=scopes}getEnabledScopes(){return this.config.enabledScopes}scoped(scope){return new ScopedLogger(this,scope)}createEntry(level,message,context,error,startTime,scope){let entry={timestamp:new Date().toISOString(),level,message:redactSecretsInText(message,{extraNames:this.config.redactKeys}),scope,service:this.config.service,correlationId:this.correlationId},mergedContext=mergeContext(this.context,context);if(mergedContext&&Object.keys(mergedContext).length>0)entry.context=redactLogContext(mergedContext,this.config.redactKeys);if(this.config.includeCallerInfo)entry.caller=getCallerInfo();if(error)entry.error=redactErrorInfo(formatError(error),this.config.redactKeys);if(startTime!==void 0)entry.duration=performance.now()-startTime;return entry}log(level,message,context,error,startTime,scope){if(!this.shouldLog(level))return;if(!this.shouldLogScope(scope))return;let entry=this.createEntry(level,message,context,error,startTime,scope);for(let transport of this.transports)try{transport.log(entry)}catch(err){console.error(`Logger transport "${transport.name}" failed:`,err)}}debug(message,context){this.log("debug",message,context)}info(message,context){this.log("info",message,context)}warn(message,context){this.log("warn",message,context)}error(message,error,context){this.log("error",message,context,error)}fatal(message,error,context){this.log("fatal",message,context,error)}time(label){let start=performance.now();return()=>{this.log("debug",`${label} completed`,void 0,void 0,start)}}async timeAsync(label,fn,context){let start=performance.now();try{let result=await fn();return this.log("debug",`${label} completed`,context,void 0,start),result}catch(error){throw this.log("error",`${label} failed`,context,error,start),error}}request(options){let level=options.statusCode>=500?"error":options.statusCode>=400?"warn":"info";this.log(level,`${options.method} ${options.path} ${options.statusCode}`,{method:options.method,path:options.path,statusCode:options.statusCode,durationMs:options.duration,correlationId:options.correlationId,userId:options.userId,ip:options.ip,userAgent:options.userAgent})}db(options){let level=options.error?"error":"debug";this.log(level,`DB ${options.operation} on ${options.table}`,{operation:options.operation,table:options.table,durationMs:options.duration,rowCount:options.rowCount},options.error)}async flush(){for(let transport of this.transports)if(transport.flush)await transport.flush()}async audit(options){let summary=options.summary||`${options.operation} on ${options.entityName}`;if(this.config.auditSuppressReasons?.includes(summary))return;let derived=classifyAudit(options.operation,summary),severity=options.severity??derived.severity,category=options.category??derived.category;if(severityRank(severity)<severityRank(this.config.auditMinSeverity))return;let scrub={extraNames:this.config.redactKeys},entry={id:randomId(),timestamp:new Date().toISOString(),entityName:options.entityName,entityId:options.entityId??null,operation:options.operation,userId:options.userId??null,summary:redactSecretsInText(summary,scrub),severity,category,oldValues:redactSensitiveData(options.oldValues||{},this.config.redactKeys),newValues:redactSensitiveData(options.newValues||{},this.config.redactKeys),ipAddress:options.ipAddress||"unknown",userAgent:options.userAgent||"unknown",path:redactUrl(options.path||"",scrub),query:redactQueryString(options.query||"",scrub),correlationId:this.correlationId};for(let transport of this.auditTransports)try{await transport.write(entry)}catch(err){console.error(`Audit transport "${transport.name}" failed:`,err)}}auditOnly(options){this.audit(options)}async trace(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)await this.audit(options.audit)}traceSync(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)this.audit(options.audit)}}class ScopedLogger{parent;scope;constructor(parent,scope){this.parent=parent,this.scope=scope}debug(message,context){this.parent.log("debug",message,context,void 0,void 0,this.scope)}info(message,context){this.parent.log("info",message,context,void 0,void 0,this.scope)}warn(message,context){this.parent.log("warn",message,context,void 0,void 0,this.scope)}error(message,error,context){this.parent.log("error",message,context,error,void 0,this.scope)}}var DEFAULT_CONFIG,logger;var init_Logger=__esm(()=>{init_redactSecrets();init_auditTaxonomy();init_scopes();init_transports();init_types();init_utils();DEFAULT_CONFIG={level:"info",service:"nucleus",environment:"development",redactKeys:[],colorize:!0,prettyPrint:!0,includeCallerInfo:!0,asyncBufferSize:100,flushIntervalMs:1000,auditEnabled:!1,auditSuppressReasons:DEFAULT_AUDIT_SUPPRESS_REASONS,auditMinSeverity:"info",enabledScopes:["*"]};logger=Logger.getInstance()});var require_auto_promise=__commonJS((exports,module)=>{var slice=Array.prototype.slice;module.exports=function(fn,makeResult){return function(){var promise,args=arguments,n=args.length;if(n!==0&&typeof args[n-1]!=="function")args=slice.call(arguments),promise=new Promise(function(resolve,reject){args.push(function(err,result){if(err!=null)reject(err);else resolve(makeResult!==void 0?makeResult.apply(this,slice.call(arguments,1)):result)})});return fn.apply(this,args),promise}}});var require_smb2_message=__commonJS((exports,module)=>{var protocolId=Buffer.from([254,83,77,66]),headerTranslates={Command:{NEGOTIATE:0,SESSION_SETUP:1,LOGOFF:2,TREE_CONNECT:3,TREE_DISCONNECT:4,CREATE:5,CLOSE:6,FLUSH:7,READ:8,WRITE:9,LOCK:10,IOCTL:11,CANCEL:12,ECHO:13,QUERY_DIRECTORY:14,CHANGE_NOTIFY:15,QUERY_INFO:16,SET_INFO:17,OPLOCK_BREAK:18}},headerLength=64,headerSync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["ProcessId",4,processId],["TreeId",4,0],["SessionId",8,sessionId],["Signature",16,0]]},headerASync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["AsyncId",8],["SessionId",8,sessionId],["Signature",16,0]]},SMB2Message=module.exports=function(options){if(this.headers={},options&&options.headers)this.setHeaders(options.headers);if(this.request={},options&&options.request)this.setRequest(options.request);this.response={}},proto=SMB2Message.prototype={};proto.setHeaders=function(obj){for(var key in obj)this.headers[key]=obj[key];this.structure=__require("../structures/"+this.headers.Command.toLowerCase())};proto.getHeaders=function(){return this.headers};proto.setRequest=function(request){this.request=request};proto.getResponse=function(){return this.response};proto.getBuffer=function(connection){var buffer=Buffer.allocUnsafe(65535),length=0;if(!this.isMessageIdSetted)this.isMessageIdSetted=!0,this.headers.MessageId=connection.messageId++;length+=writeHeaders(this,buffer),length+=writeRequest(this,buffer,headerLength);var output=Buffer.allocUnsafe(length);return buffer.copy(output,0,0,length),output};proto.parseBuffer=function(buffer){readHeaders(this,buffer),readResponse(this,buffer,headerLength)};function dataToBuffer(data,length){if(Buffer.isBuffer(data))return data;if(typeof data==="string")return Buffer.from(data);var result=Buffer.allocUnsafe(length);for(var i=0;i<length;i++)result.writeUInt8(255&data>>i*8,i);return result}function bufferToData(buffer){if(!Buffer.isBuffer(buffer))return buffer;var result=0;for(var i=0;i<buffer.length;i++)result+=buffer.readUInt8(i)<<i*8;return result}function writeData(buffer,data,offset,length){dataToBuffer(data,length).copy(buffer,offset,0)}function readData(buffer,offset,length){return buffer.slice(offset,offset+length)}function translate(key,value){if(headerTranslates[key]&&typeof headerTranslates[key][value]<"u")return headerTranslates[key][value];return value}function unTranslate(key,value){if(headerTranslates[key]){for(var t in headerTranslates[key])if(headerTranslates[key][t]===value)return t}return null}function readHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1];if(message.headers[key]=readData(buffer,offset,length),length<=8)message.headers[key]=unTranslate(key,bufferToData(message.headers[key]))||message.headers[key];offset+=length}message.structure=__require("../structures/"+message.headers.Command.toLowerCase())}function writeHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1],defaultValue=header[i][2]||0;writeData(buffer,translate(key,message.headers[key]||defaultValue),offset,length),offset+=length}return offset}function readResponse(message,buffer,offset){for(var i in message.structure.response){var key=message.structure.response[i][0],length=message.structure.response[i][1]||1;if(typeof length==="string")length=bufferToData(message.response[length]);message.response[key]=readData(buffer,offset,length),offset+=length}}function writeRequest(message,buffer,offset){var initOffset=offset,needsRewrite=!1,tmpBuffer=Buffer.allocUnsafe(buffer.length);offset=0;for(var i in message.structure.request){var key=message.structure.request[i][0],length=message.structure.request[i][1]||1,defaultValue=message.structure.request[i][2]||0;if(typeof length==="string"){if(message.request[key]=message.request[key]||"",message.request[length]!==message.request[key].length)message.request[length]=message.request[key].length,needsRewrite=!0;length=message.request[key].length}else message.request[key]=message.request[key]||defaultValue;writeData(tmpBuffer,message.request[key],offset,length),offset+=length}if(needsRewrite)writeRequest(message,tmpBuffer,0);return tmpBuffer.copy(buffer,initOffset,0,offset),offset}});var require_smb2_forge=__commonJS((exports,module)=>{var SMB2Message=require_smb2_message(),SMB2Forge=module.exports={};SMB2Forge.request=function(messageName,params,connection,cb){var msg=__require("../messages/"+messageName),smbMessage=msg.generate(connection,params);sendNetBiosMessage(connection,smbMessage);var error=Error();error.messageName=messageName,error.params=params,getResponse(connection,smbMessage.getHeaders().MessageId,msg.parse(connection,cb,error))};SMB2Forge.response=function(c){return c.responses={},c.responsesCB={},c.responseBuffer=Buffer.allocUnsafe(0),function(response){c.responseBuffer=Buffer.concat([c.responseBuffer,response]);var extract=!0;while(extract)if(extract=!1,c.responseBuffer.length>=4){var msgLength=(c.responseBuffer.readUInt8(1)<<16)+c.responseBuffer.readUInt16BE(2);if(c.responseBuffer.length>=msgLength+4){extract=!0;var r=c.responseBuffer.slice(4,msgLength+4),message=new SMB2Message;if(message.parseBuffer(r),c.debug)console.log("--response"),console.log(r.toString("hex"));var mId=message.getHeaders().MessageId.toString("hex");if(c.responsesCB[mId])c.responsesCB[mId](message),delete c.responsesCB[mId];else c.responses[mId]=message;c.responseBuffer=c.responseBuffer.slice(msgLength+4)}}}};function sendNetBiosMessage(connection,message){var smbRequest=message.getBuffer(connection);if(connection.debug)console.log("--request"),console.log(smbRequest.toString("hex"));var buffer=Buffer.allocUnsafe(smbRequest.length+4);return buffer.writeUInt8(0,0),buffer.writeUInt8((16711680&smbRequest.length)>>16,1),buffer.writeUInt16BE(65535&smbRequest.length,2),smbRequest.copy(buffer,4,0,smbRequest.length),connection.newResponse=!1,connection.socket.write(buffer),!0}function getResponse(c,mId,cb){var messageId=Buffer.allocUnsafe(4);if(messageId.writeUInt32LE(mId,0),messageId=messageId.toString("hex"),c.responses[messageId])cb(c.responses[messageId]),delete c.responses[messageId];else c.responsesCB[messageId]=cb}});var require_smb2_connection=__commonJS((exports,module)=>{var net=__require("net"),SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,SMB2Connection=module.exports={};SMB2Connection.close=function(connection){if(clearAutoCloseTimeout(connection),connection.connected)connection.connected=!1,connection.socket.end()};SMB2Connection.requireConnect=function(method){return function(){var connection=this,args=Array.prototype.slice.call(arguments);connect(connection,function(err){var cb=args.pop();if(typeof cb!=="function")args.push(cb),cb=function(err2){if(err2){if(!(err2 instanceof Error))err2=Error(String(err2));throw err2}};if(cb=scheduleAutoClose(connection,cb),args.push(cb),err)cb(err);else method.apply(connection,args)})}};SMB2Connection.init=function(connection){connection.connected=!1,connection.socket=new net.Socket({allowHalfOpen:!0}),connection.socket.on("data",SMB2Forge.response(connection)),connection.errorHandler=[],connection.socket.on("error",function(err){if(connection.errorHandler.length>0)connection.errorHandler[0].call(null,err);if(connection.debug)console.log("-- error"),console.log(arguments)})};function connect(connection,cb){if(connection.connected){cb&&cb(null);return}cb=scheduleAutoClose(connection,cb),connection.messageId=0,connection.SessionId=Math.floor(Math.random()*256)&255,connection.socket.connect(connection.port,connection.ip),SMB2Request("negotiate",{},connection,function(err){if(err)cb&&cb(err);else SMB2Request("session_setup_step1",{},connection,function(err2){if(err2)cb&&cb(err2);else SMB2Request("session_setup_step2",{},connection,function(err3){if(err3)cb&&cb(err3);else SMB2Request("tree_connect",{},connection,function(err4){if(err4)cb&&cb(err4);else connection.connected=!0,cb&&cb(null)})})})})}function clearAutoCloseTimeout(connection){if(connection.scheduledAutoClose)clearTimeout(connection.scheduledAutoClose),connection.scheduledAutoClose=null}function setAutoCloseTimeout(connection){if(clearAutoCloseTimeout(connection),connection.autoCloseTimeout!==0)connection.scheduledAutoClose=setTimeout(function(){SMB2Connection.close(connection)},connection.autoCloseTimeout)}function scheduleAutoClose(connection,cb){return addErrorListener(connection,cb),clearAutoCloseTimeout(connection),function(){removeErrorListener(connection),setAutoCloseTimeout(connection),cb.apply(null,arguments)}}function addErrorListener(connection,callback){connection.errorHandler.unshift(callback)}function removeErrorListener(connection){connection.errorHandler.shift()}});var require_disconnect=__commonJS((exports,module)=>{var SMB2Connection=require_smb2_connection();module.exports=function(){SMB2Connection.close(this)}});var require_exists=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,cb){var connection=this;SMB2Request("open",{path},connection,function(err,file){if(err!=null){if(err.code==="STATUS_OBJECT_NAME_NOT_FOUND"||err.code==="STATUS_OBJECT_PATH_NOT_FOUND")return cb&&cb(null,!1);return cb&&cb(err)}SMB2Request("close",file,connection,function(){cb&&cb(null,!0)})})}});var require_bigint=__commonJS((exports,module)=>{var BigInt2=module.exports=function(n,v){if(BigInt2.isBigInt(n))this.buffer=Buffer.allocUnsafe(n.buffer.length),n.buffer.copy(this.buffer,0),this.sign=n.sign;else if(this.buffer=Buffer.alloc(n),this.sign=1,v=v||0,v!==0){if(v<0)this.sign=-1,v=-v;v=v.toString(16);var size=Math.ceil(v.length/2),carry=size*2-v.length;for(var i=0;i<size;i++){var start=(size-i-1)*2-carry;this.buffer.writeUInt8(parseInt(start===-1?v.substr(0,1):v.substr(start,2),16),i)}}};BigInt2.isBigInt=function(v){return v&&v.buffer&&Buffer.isBuffer(v.buffer)};BigInt2.toBigInt=function(n,v){return new BigInt2(n,v)};BigInt2.fromBuffer=function(b,sign){sign=typeof sign>"u"?1:sign;var bi=new BigInt2(0);return bi.sign=sign,bi.buffer=b,bi};BigInt2.prototype.add=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.neg().sub(v);var carry=0,n=Math.max(v.buffer.length,this.buffer.length),result=new BigInt2(n);for(var i=0;i<n;i++){var r=(i<this.buffer.length?this.buffer.readUInt8(i):0)+(i<v.buffer.length?v.buffer.readUInt8(i):0)+carry;result.buffer.writeUInt8(r&255,i),carry=r>>8}return result.sign=this.sign,result};BigInt2.prototype.neg=function(){var result=new BigInt2(this);return result.sign*=-1,result};BigInt2.prototype.abs=function(){var result=new BigInt2(this);return result.sign=1,result};BigInt2.prototype.sub=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.add(v.neg());var carry=0,a=new BigInt2(this),b=new BigInt2(v),n=Math.max(a.buffer.length,b.buffer.length),result=new BigInt2(n),sign=this.sign;if(a.abs().lt(b.abs())){var t=a;a=b,b=t,sign*=-1}for(var i=0;i<n;i++){var va=i<a.buffer.length?a.buffer.readUInt8(i):0,vb=i<b.buffer.length?b.buffer.readUInt8(i):0,c=0,r=va-vb-carry;while(r<0)r+=255,c--;result.buffer.writeUInt8(r&255,i),carry=(r>>8)+c}return result.sign=sign,result};BigInt2.prototype.toBuffer=function(){return this.buffer};BigInt2.prototype.toNumber=function(){var b=Buffer.allocUnsafe(this.buffer.length);for(var i=0;i<this.buffer.length;i++)b.writeUInt8(this.buffer.readUInt8(this.buffer.length-i-1),i);return parseInt(b.toString("hex"),16)};BigInt2.prototype.compare=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);var n=Math.max(v.buffer.length,this.buffer.length);if(this.sign>v.sign)return 1;if(this.sign<v.sign)return-1;for(var i=n-1;i>=0;i--){var a=i<this.buffer.length?this.buffer.readUInt8(i):0,b=i<v.buffer.length?v.buffer.readUInt8(i):0;if(a!==b)return a>b?this.sign:-this.sign}return 0};BigInt2.prototype.lt=function(v){return this.compare(v)<0};BigInt2.prototype.le=function(v){return this.compare(v)<=0};BigInt2.prototype.gt=function(v){return this.compare(v)>0};BigInt2.prototype.ge=function(v){return this.compare(v)>=0}});var require_constants=__commonJS((exports,module)=>{module.exports={FILE_SUPERSEDE:0,FILE_OPEN:1,FILE_CREATE:2,FILE_OPEN_IF:3,FILE_OVERWRITE:4,FILE_OVERWRITE_IF:5,MAX_READ_LENGTH:65536,MAX_WRITE_LENGTH:65423,FILE_SHARE_NONE:0,FILE_SHARE_READ:1,FILE_SHARE_WRITE:2,FILE_SHARE_DELETE:4,DELETE:65536,FILE_APPEND_DATA:4,FILE_DELETE_CHILD:64,FILE_READ_ATTRIBUTES:128,FILE_READ_DATA:1,FILE_READ_EA:8,FILE_WRITE_ATTRIBUTES:256,FILE_WRITE_DATA:2,FILE_WRITE_EA:16,READ_CONTROL:131072,SYNCHRONIZE:1048576,WRITE_DAC:262144,DIRECTORY:16}});var require_rename=__commonJS((exports,module)=>{var BigInt2=require_bigint(),SMB2Request=require_smb2_forge().request,constants=require_constants();module.exports=function(oldPath,newPath,options,cb){if(typeof options==="function")cb=options,options={};var connection=this;SMB2Request("open_folder",{path:oldPath},connection,function(err,file){if(err)SMB2Request("create",{path:oldPath,createDisposition:constants.FILE_OPEN,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err2,file2){if(err2)cb&&cb(err2);else rename_(connection,file2,newPath,options,cb)});else rename_(connection,file,newPath,options,cb)})};function rename_(connection,file,newPath,options,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileRenameInformation",Buffer:renameBuffer(newPath,options)},connection,function(err){SMB2Request("close",file,connection,function(){if(err)cb&&cb(err);else cb&&cb(null)})})}function renameBuffer(newPath,options){var filename=Buffer.from(newPath,"ucs2");return Buffer.concat([new BigInt2(1,options.replace?1:0).toBuffer(),new BigInt2(7,0).toBuffer(),new BigInt2(8,0).toBuffer(),new BigInt2(4,filename.length).toBuffer(),filename])}});var require_readFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(filename,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};SMB2Request("open",{path:filename},connection,function(err,file){if(err)cb&&cb(err);else{var fileLength=0,offset=new BigInt2(8),stop=!1,nbRemainingPackets=0;for(var i=0;i<file.EndofFile.length;i++)fileLength+=file.EndofFile[i]*Math.pow(2,i*8);var result=Buffer.allocUnsafe(fileLength),callback=function(offset2){return function(err2,content){if(stop)return;if(err2)cb&&cb(err2),stop=!0;else content.copy(result,offset2.toNumber()),nbRemainingPackets--,checkDone()}},checkDone=function(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))SMB2Request("close",file,connection,function(){if(options.encoding)result=result.toString(options.encoding);cb&&cb(null,result)})},createPackets=function(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=offset.sub(fileLength).neg(),packetSize=rest.gt(MAX_READ_LENGTH)?MAX_READ_LENGTH:rest.toNumber();SMB2Request("read",{FileId:file.FileId,Length:packetSize,Offset:offset.toBuffer()},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}};checkDone()}})}});var require_createReadStream=__commonJS((exports,module)=>{var Readable=__require("stream").Readable,BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};else if(options==null)options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onOpen(err,file){if(err!=null)return cb(err);var offset=options.start||0,fileSize=BigInt2.fromBuffer(file.EndofFile).toNumber(),end=fileSize;if(options.end<end)end=options.end+1;var close=request.bind(void 0,"close",file,connection),stream=new Readable;if(stream.fileSize=fileSize,shouldClose)stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})};var running=!1;stream._read=function(size){if(running)return;if(offset>=end)return shouldClose?close(function(){stream.push(null)}):stream.push(null);running=!0,request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,size,end-offset),Offset:new BigInt2(8,offset).toBuffer()},connection,function(err2,content){if(running=!1,err2!=null)return process.nextTick(stream.emit.bind(stream,"error",err2));offset+=content.length,stream.push(content)})},cb(null,stream)}if(isFd)onOpen(null,fd);else request("open",{path},connection,onOpen)}});var require_parse_flags=__commonJS((exports,module)=>{var c=require_constants();module.exports=function(flags){var chars={__proto__:null};for(var i=0,n=flags.length;i<n;++i)chars[flags[i]]=!0;if("r"in chars)return c.FILE_OPEN;if("x"in chars)return c.FILE_CREATE;if("a"in chars)return c.FILE_OPEN_IF;if("w"in chars)return c.FILE_OVERWRITE_IF;throw Error("invalid flags")}});var require_createWriteStream=__commonJS((exports,module)=>{var Writable=__require("stream").Writable,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onCreate(err,file){if(err!=null)return cb(err);var offset=new BigInt2(8,options!=null&&options.start||0);function write(buffer,i,cb2){var j=i+constants.MAX_WRITE_LENGTH,chunk=buffer.slice(i,j);request("write",{Buffer:chunk,FileId:file.FileId,Offset:offset.toBuffer()},connection,function(err2){if(err2!=null)return cb2(err2);if(offset=offset.add(chunk.length),j<buffer.length)return write(buffer,j,cb2);cb2()})}var stream=new Writable;if(shouldClose){var close=request.bind(void 0,"close",file,connection);stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})},stream._final=close}stream._write=function(chunk,encoding,next){write(Buffer.isBuffer(chunk)?chunk:Buffer.from(chunk,encoding),0,next)},cb(null,stream)}if(isFd)onCreate(null,fd);else request("create",{createDisposition:parseFlags(options!=null&&options.flags||"wx"),path},connection,onCreate)}});var require_writeFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags();module.exports=function(filename,data,options,cb){if(typeof options==="function")cb=options,options={};options.encoding=options.encoding||"utf8";var connection=this,file,fileContent=Buffer.isBuffer(data)?data:Buffer.from(data,options.encoding),fileLength=new BigInt2(8,fileContent.length);function createFile(fileCreated){SMB2Request("create",{createDisposition:parseFlags(options!=null&&(options.flags||options.flag)||"wx"),path:filename},connection,function(err,f){if(err)cb&&cb(err);else file=f,fileCreated()})}function closeFile(fileClosed){SMB2Request("close",file,connection,function(err){if(err)cb&&cb(err);else file=null,fileClosed()})}function setFileSize(fileSizeSetted){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,function(err){if(err)cb&&cb(err);else fileSizeSetted()})}function writeFile(fileWritten){var offset=new BigInt2(8),stop=!1,nbRemainingPackets=0,maxPacketSize=new BigInt2(8,constants.MAX_WRITE_LENGTH);function callback(){return function(err){if(stop)return;if(err)cb&&cb(err),stop=!0;else nbRemainingPackets--,checkDone()}}function checkDone(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))fileWritten()}function createPackets(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=fileLength.sub(offset),packetSize=rest.gt(maxPacketSize)?maxPacketSize:rest;SMB2Request("write",{FileId:file.FileId,Offset:offset.toBuffer(),Buffer:fileContent.slice(offset.toNumber(),offset.add(packetSize).toNumber())},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}}checkDone()}createFile(function(){setFileSize(function(){writeFile(function(){closeFile(cb)})})})}});var require_unlink=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants();module.exports=function(path,cb){var connection=this;SMB2Request("create",{path,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)cb&&cb(err2);else cb&&cb(null,files)})})})}});var require_convert_time=__commonJS((exports,module)=>{var winTicks=1e7,uEpoch=11644473600;module.exports=function(time){var unixTime=time/winTicks-uEpoch;return new Date(unixTime*1000)}});var require_stats=__commonJS((exports,module)=>{var convert=require_convert_time(),BigInt2=require_bigint(),DIRECTORY=require_constants().DIRECTORY;module.exports=function(file){return{birthtime:convert(BigInt2.fromBuffer(file.CreationTime).toNumber()),atime:convert(BigInt2.fromBuffer(file.LastAccessTime).toNumber()),mtime:convert(BigInt2.fromBuffer(file.LastWriteTime).toNumber()),ctime:convert(BigInt2.fromBuffer(file.ChangeTime).toNumber()),size:BigInt2.fromBuffer(file.EndofFile).toNumber(),isDirectory:function(){var attr=file.FileAttributes;if(typeof attr!=="number")attr=BigInt2.fromBuffer(attr).toNumber();return(attr&DIRECTORY)==DIRECTORY}}}});var require_readdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,stats=require_stats();module.exports=function(path,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};var mapping=options.stats?function(v){var obj=stats(v);return obj.name=v.Filename,obj}:function(v){return v.Filename};function queryDirectory(filesBatch,file,connection2,cb2){SMB2Request("query_directory",file,connection2,function(err,files){if(err)if(err.code==="STATUS_NO_MORE_FILES")cb2(null,filesBatch);else cb2(err);else filesBatch.push(files.filter(function(v){return v.Filename!=="."&&v.Filename!==".."}).map(mapping)),queryDirectory(filesBatch,file,connection2,cb2)})}function openDirectory(path2,connection2,cb2){SMB2Request("open",{path:path2},connection2,function(err,file){if(err)cb2(err);else return cb2(null,file)})}function closeDirectory(file,connection2,cb2){SMB2Request("close",file,connection2,function(err,res){if(err){if(err.code!=="STATUS_FILE_CLOSED")cb2(err)}cb2(null,res)})}openDirectory(path,connection,function(err,file){var totalFiles=[],filesBatch=[];if(err)cb(err);else queryDirectory(filesBatch,file,connection,function(err2,file2){if(err2)cb(err2);else closeDirectory(file2,connection,function(err3,file3){if(err3)cb(err3);else totalFiles=[].concat(...filesBatch),cb(null,totalFiles)})})})}});var require_rmdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint();module.exports=function(path,cb){var connection=this;SMB2Request("open_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)return cb(err2);cb(null,files)})})})}});var require_mkdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,mode,cb){if(typeof mode==="function")cb=mode,mode="0777";var connection=this;SMB2Request("create_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("close",file,connection,function(){cb&&cb(null)})})}});var require_getSize=__commonJS((exports,module)=>{var BigInt2=require_bigint(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,BigInt2.fromBuffer(file.EndofFile).toNumber())})})}});var require_stat=__commonJS((exports,module)=>{var stats=require_stats(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,stats(file))})})}});var require_open=__commonJS((exports,module)=>{var parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,flags,cb){if(typeof flags==="function")cb=flags,flags=void 0;request("create",{createDisposition:parseFlags(flags||"r"),path},this,cb)}});var require_read=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){assert(start!==null,"null pos is not supported");var connection=this,end=Math.min(start+length,BigInt2.fromBuffer(file.EndofFile).toNumber()),pos=start;function onRead(err,chunk){if(err!=null)return cb(err,pos-start,buffer);chunk.copy(buffer,offset);var n=chunk.length;offset+=n,pos+=n,readChunk()}function readChunk(){if(pos>=end)return cb(null,pos-start,buffer);request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,end-pos),Offset:new BigInt2(8,pos).toBuffer()},connection,onRead)}process.nextTick(readChunk)}});var require_write=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_WRITE_LENGTH=require_constants().MAX_WRITE_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){if(assert(Buffer.isBuffer(buffer)),offset==null)offset=0;else assert.strictEqual(typeof offset,"number"),assert(offset>0),assert(offset<buffer.length);if(length==null)length=buffer.length-offset;else assert.strictEqual(typeof length,"number"),assert(length>0),length=Math.min(length,buffer.length-offset);assert.strictEqual(typeof start,"number");var connection=this,pos=start,chunkLength;function onWrite(err){if(err!=null)return cb(err,pos-start,buffer);length-=chunkLength,offset+=chunkLength,pos+=chunkLength,writeChunk()}function writeChunk(){if(length<=0)return cb(null,pos-start,buffer);chunkLength=Math.min(MAX_WRITE_LENGTH,length),request("write",{Buffer:buffer.slice(offset,offset+chunkLength),FileId:file.FileId,Offset:new BigInt2(8,pos).toBuffer()},connection,onWrite)}process.nextTick(writeChunk)}});var require_close=__commonJS((exports,module)=>{var request=require_smb2_forge().request;module.exports=function(file,cb){request("close",file,this,cb)}});var require_truncate=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),FILE_WRITE_DATA=require_constants().FILE_WRITE_DATA;function setFileSize(file,fileLength,connection,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,cb)}module.exports=function(path,length,cb){var connection=this;SMB2Request("open",{path,desiredAccess:FILE_WRITE_DATA},connection,function(err,file){if(err!=null)return cb(err);setFileSize(file,new BigInt2(8,length),connection,function(err2){SMB2Request("close",file,connection,function(){cb(err2)})})})}});var require_smb2=__commonJS((exports,module)=>{var shareRegExp=/\\\\([^\\]*)\\([^\\]*)\\?/,port=445,packetConcurrency=20,autoCloseTimeout=1e4,autoPromise=require_auto_promise(),SMB2Connection=require_smb2_connection(),SMB=module.exports=function(opt){opt=opt||{};var matches;if(!opt.share||!(matches=opt.share.match(shareRegExp)))throw Error("the share is not valid");if(this.ip=matches[1],this.port=opt.port||port,this.share=matches[2],this.fullPath=opt.share,this.packetConcurrency=opt.packetConcurrency||packetConcurrency,opt.autoCloseTimeout!==void 0)this.autoCloseTimeout=opt.autoCloseTimeout;else this.autoCloseTimeout=autoCloseTimeout;this.domain=opt.domain,this.username=opt.username,this.password=opt.password,this.ProcessId=Buffer.from([Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&254]),this.debug=opt.debug,SMB2Connection.init(this)},proto=SMB.prototype={};proto.disconnect=require_disconnect();proto.exists=autoPromise(SMB2Connection.requireConnect(require_exists()));proto.rename=autoPromise(SMB2Connection.requireConnect(require_rename()));proto.readFile=autoPromise(SMB2Connection.requireConnect(require_readFile()));proto.createReadStream=autoPromise(SMB2Connection.requireConnect(require_createReadStream()));proto.createWriteStream=autoPromise(SMB2Connection.requireConnect(require_createWriteStream()));proto.writeFile=autoPromise(SMB2Connection.requireConnect(require_writeFile()));proto.unlink=autoPromise(SMB2Connection.requireConnect(require_unlink()));proto.readdir=autoPromise(SMB2Connection.requireConnect(require_readdir()));proto.rmdir=autoPromise(SMB2Connection.requireConnect(require_rmdir()));proto.mkdir=autoPromise(SMB2Connection.requireConnect(require_mkdir()));proto.getSize=autoPromise(SMB2Connection.requireConnect(require_getSize()));proto.stat=autoPromise(SMB2Connection.requireConnect(require_stat()));proto.open=autoPromise(SMB2Connection.requireConnect(require_open()));proto.read=autoPromise(require_read(),function(bytesRead,buffer){return{bytesRead,buffer}});proto.write=autoPromise(require_write(),function(bytesWritten,buffer){return{bytesWritten,buffer}});proto.close=autoPromise(require_close());proto.truncate=autoPromise(SMB2Connection.requireConnect(require_truncate()))});import{createHash,randomBytes}from"crypto";var API_KEY_BYTE_LENGTH=32,HASH_ALGORITHM="sha256",generateApiKey=(prefix="nk_live")=>{let randomPart=randomBytes(API_KEY_BYTE_LENGTH).toString("hex"),rawKey=`${prefix}_${randomPart}`,keyHash=hashApiKey(rawKey),keyPreview=`${prefix}_...${randomPart.slice(-4)}`;return{rawKey,keyHash,keyPreview}},hashApiKey=(rawKey)=>{return createHash(HASH_ALGORITHM).update(rawKey).digest("hex")},validateApiKeyFormat=(rawKey)=>{return/^nk_(live|test)_[a-f0-9]{64}$/.test(rawKey)},extractApiKeyFromHeader=(headers)=>{let apiKeyHeader=headers.get("x-api-key");if(apiKeyHeader&&validateApiKeyFormat(apiKeyHeader))return apiKeyHeader;let authHeader=headers.get("authorization");if(authHeader){let bearerMatch=authHeader.match(/^Bearer\s+(nk_(?:live|test)_[a-f0-9]{64})$/);if(bearerMatch?.[1])return bearerMatch[1]}return null},validateApiKeyRecord=(record)=>{if(!record.isActive)return{valid:!1,reason:"API key is inactive"};if(record.revokedAt)return{valid:!1,reason:"API key has been revoked"};if(record.expiresAt&&new Date(record.expiresAt)<new Date)return{valid:!1,reason:"API key has expired"};return{valid:!0,record}},intersectPermissions=(userPermissions,keyPermissions)=>{let userSet=new Set(userPermissions);return keyPermissions.filter((p)=>userSet.has(p))};var init_ApiKey=()=>{};var normalize=(value)=>{return value?.trim().toLowerCase()||"unknown"},extractHeaderValue=(headers,key)=>{return headers[key.toLowerCase()]??headers[key]};import crypto2 from"crypto";var generateDeviceFingerprint=(input)=>{let payload=JSON.stringify({userAgent:normalize(input.userAgent),extra:input.extra??{}});return{hash:crypto2.createHash("sha256").update(payload).digest("base64url"),components:input}};var init_Generate=()=>{};var validateDeviceFingerprint=({savedFingerprint,requestIp,headers})=>{let userAgent=extractHeaderValue(headers,"user-agent"),forwardedFor=extractHeaderValue(headers,"x-forwarded-for")??requestIp??void 0,currentFingerprint=generateDeviceFingerprint({userAgent,ipAddress:forwardedFor}),componentMismatch=[{field:"userAgent",saved:savedFingerprint.components.userAgent,received:userAgent},{field:"ipAddress",saved:savedFingerprint.components.ipAddress,received:forwardedFor}].find(({saved,received})=>saved??(received??"")!=="");if(componentMismatch)return{isValid:!1,reason:`${componentMismatch.field} mismatch`,currentFingerprint};return{isValid:!0,currentFingerprint}};var init_Validate=__esm(()=>{init_Generate()});var init_Fingerprint=__esm(()=>{init_Generate();init_Validate()});import crypto3 from"crypto";var base64UrlEncode=(data)=>{return(Buffer.isBuffer(data)?data.toString("base64"):Buffer.from(data).toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},base64UrlDecode=(data)=>{let padding="=".repeat((4-data.length%4)%4),base64=data.replace(/-/g,"+").replace(/_/g,"/")+padding;return Buffer.from(base64,"base64").toString("utf-8")},createSignature=(data,secret,algorithm)=>{let hmacAlgorithm=algorithm.replace("HS","sha"),hmac=crypto3.createHmac(hmacAlgorithm,secret);return hmac.update(data),base64UrlEncode(hmac.digest())},verifySignature=(data,signature,secret,algorithm)=>{let expectedSignature=createSignature(data,secret,algorithm),sigBuf=Buffer.from(signature),expBuf=Buffer.from(expectedSignature);if(sigBuf.length!==expBuf.length)return!1;return crypto3.timingSafeEqual(sigBuf,expBuf)},encodeHeader=(header)=>{return base64UrlEncode(JSON.stringify(header))},encodePayload=(payload)=>{return base64UrlEncode(JSON.stringify(payload))},decodeHeader=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}},decodePayload=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}};var init_utils2=()=>{};var decodeJWT=(token)=>{let parts=token.split(".");if(parts.length!==3)return null;let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return null;let header=decodeHeader(encodedHeader),payload=decodePayload(encodedPayload);if(!header||!payload)return null;return{header,payload,signature}};var init_Decode=__esm(()=>{init_utils2()});import{randomUUID}from"crypto";var signJWT=(options,secret,algorithm="HS256")=>{let header={alg:algorithm,typ:"JWT"},now=Math.floor(Date.now()/1000),payload={sub:options.subject,iat:now,...options.expiresInSeconds===null?{}:{exp:now+options.expiresInSeconds},iss:options.issuer,aud:options.audience,jti:options.jwtId||randomUUID(),sessionId:options.sessionId,...options.customClaims},encodedHeader=encodeHeader(header),encodedPayload=encodePayload(payload),dataToSign=`${encodedHeader}.${encodedPayload}`,signature=createSignature(dataToSign,secret,algorithm);return`${dataToSign}.${signature}`};var init_Sign=__esm(()=>{init_utils2()});var audienceMatches=(aud,expected)=>{if(typeof aud==="string")return aud===expected;if(Array.isArray(aud))return aud.includes(expected);return!1},verifyJWT=(token,secret,expected)=>{let parts=token.split(".");if(parts.length!==3)return{valid:!1,error:"Invalid token format: expected 3 parts"};let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return{valid:!1,error:"Invalid token format: missing parts"};let header=decodeHeader(encodedHeader);if(!header)return{valid:!1,error:"Invalid header: failed to decode"};if(header.typ!=="JWT")return{valid:!1,error:"Invalid header: typ must be JWT"};if(!["HS256","HS384","HS512"].includes(header.alg))return{valid:!1,error:`Unsupported algorithm: ${header.alg}`};let dataToVerify=`${encodedHeader}.${encodedPayload}`;if(!verifySignature(dataToVerify,signature,secret,header.alg))return{valid:!1,error:"Invalid signature"};let payload=decodePayload(encodedPayload);if(!payload)return{valid:!1,error:"Invalid payload: failed to decode"};let now=Math.floor(Date.now()/1000);if(payload.exp&&payload.exp<now)return{valid:!1,error:"Token expired"};if(payload.iat&&payload.iat>now+60)return{valid:!1,error:"Token issued in the future"};if(expected?.issuer&&payload.iss!==expected.issuer)return{valid:!1,error:"Invalid issuer"};if(expected?.audience&&!audienceMatches(payload.aud,expected.audience))return{valid:!1,error:"Invalid audience"};return{valid:!0,payload}};var init_Verify=__esm(()=>{init_utils2()});var exports_JWT={};__export(exports_JWT,{verifyJWT:()=>verifyJWT,signJWT:()=>signJWT,decodeJWT:()=>decodeJWT});var init_JWT=__esm(()=>{init_Decode();init_Sign();init_Verify()});var init_Generate2=()=>{};var init_Password=__esm(()=>{init_Generate2()});var init_Logger2=__esm(()=>{init_auditTaxonomy();init_Logger();init_ServerLogBuffer();init_transports();init_utils();init_scopes()});var DEFAULT_DAPR_HOST="127.0.0.1",DEFAULT_DAPR_PORT="3500",DEFAULT_MAX_BODY_SIZE_MB=4,DEFAULT_STATE_STORE="statestore-redis",DEFAULT_PUBSUB_NAME="pubsub-rabbitmq",DEFAULT_SECRET_STORE="secretstore",DEFAULT_CONFIG_STORE="configstore-redis",ENV_DAPR_HOST="DAPR_HOST",ENV_DAPR_HTTP_PORT="DAPR_HTTP_PORT",ENV_DAPR_HTTP_ENDPOINT="DAPR_HTTP_ENDPOINT",ENV_DAPR_GRPC_ENDPOINT="DAPR_GRPC_ENDPOINT",ENV_DAPR_API_TOKEN="DAPR_API_TOKEN",DEFAULT_OPERATION_TIMEOUT_MS=30000,DEFAULT_CONNECTION_TIMEOUT_MS=1e4,DEFAULT_HEALTH_CHECK_TIMEOUT_MS=5000,CONNECTION_STATUS,HEALTH_STATUS,ERROR_CODES;var init_constants=__esm(()=>{CONNECTION_STATUS={CONNECTED:"connected",DISCONNECTED:"disconnected",CONNECTING:"connecting",ERROR:"error"},HEALTH_STATUS={HEALTHY:"healthy",UNHEALTHY:"unhealthy"},ERROR_CODES={CONNECTION_ERROR:"DAPR_CONNECTION_ERROR",TIMEOUT_ERROR:"DAPR_TIMEOUT_ERROR",STATE_ERROR:"DAPR_STATE_ERROR",PUBSUB_ERROR:"DAPR_PUBSUB_ERROR",BINDING_ERROR:"DAPR_BINDING_ERROR",SECRET_ERROR:"DAPR_SECRET_ERROR",CONFIG_ERROR:"DAPR_CONFIG_ERROR",INVOKE_ERROR:"DAPR_INVOKE_ERROR",CRYPTO_ERROR:"DAPR_CRYPTO_ERROR",LOCK_ERROR:"DAPR_LOCK_ERROR",WORKFLOW_ERROR:"DAPR_WORKFLOW_ERROR",VALIDATION_ERROR:"DAPR_VALIDATION_ERROR"}});var DaprManagerError,createConnectionError=(message,details)=>new DaprManagerError(ERROR_CODES.CONNECTION_ERROR,message,details),createTimeoutError=(message,details)=>new DaprManagerError(ERROR_CODES.TIMEOUT_ERROR,message,details),createStateError=(message,details)=>new DaprManagerError(ERROR_CODES.STATE_ERROR,message,details),createPubSubError=(message,details)=>new DaprManagerError(ERROR_CODES.PUBSUB_ERROR,message,details),createBindingError=(message,details)=>new DaprManagerError(ERROR_CODES.BINDING_ERROR,message,details),createSecretError=(message,details)=>new DaprManagerError(ERROR_CODES.SECRET_ERROR,message,details),createConfigError=(message,details)=>new DaprManagerError(ERROR_CODES.CONFIG_ERROR,message,details),createInvokeError=(message,details)=>new DaprManagerError(ERROR_CODES.INVOKE_ERROR,message,details),createCryptoError=(message,details)=>new DaprManagerError(ERROR_CODES.CRYPTO_ERROR,message,details),createLockError=(message,details)=>new DaprManagerError(ERROR_CODES.LOCK_ERROR,message,details),createWorkflowError=(message,details)=>new DaprManagerError(ERROR_CODES.WORKFLOW_ERROR,message,details),safeExecute=async(operation,errorCreator)=>{try{return await operation()}catch(error){let errorMessage=error instanceof Error?error.message:String(error);throw errorCreator(errorMessage,error)}};var init_error_handling=__esm(()=>{init_constants();DaprManagerError=class DaprManagerError extends Error{code;details;constructor(code,message,details){super(message);this.name="DaprManagerError",this.code=code,this.details=details}toJSON(){return{code:this.code,message:this.message,details:this.details}}}});var LOG_LEVEL_PRIORITY2,createDefaultLogger=(minLevel="info")=>{let minPriority=LOG_LEVEL_PRIORITY2[minLevel],scoped=logger.scoped("dapr.client"),logWithLevel=(level)=>(message,...meta)=>{if(LOG_LEVEL_PRIORITY2[level]<minPriority)return;let context=meta.length>0?{meta}:void 0;if(level==="error")scoped.error(message,void 0,context);else scoped[level](message,context)};return{debug:logWithLevel("debug"),info:logWithLevel("info"),warn:logWithLevel("warn"),error:logWithLevel("error")}},withTimeout=async(fn,timeoutMs,errorMessage="Operation timed out")=>{return Promise.race([fn(),new Promise((_,reject)=>{setTimeout(()=>{reject(createTimeoutError(errorMessage))},timeoutMs)})])},validateRequired=(params,requiredKeys,entityName)=>{let missingKeys=requiredKeys.filter((key)=>params[key]===void 0);if(missingKeys.length>0)throw Error(`Missing required ${entityName} parameters: ${missingKeys.join(", ")}`)};var init_utils3=__esm(()=>{init_Logger2();init_constants();init_error_handling();LOG_LEVEL_PRIORITY2={debug:0,info:1,warn:2,error:3}});class DaprBindingClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(name,operation,data,options={}){return validateRequired({name,operation},["name","operation"],"binding invoke"),safeExecute(async()=>{this.logger.debug("Invoking binding",{name,operation});let response=await(await this.client()).binding.send(name,operation,data,options.metadata);return this.logger.debug("Binding invoked successfully",{name,operation}),response},(message,details)=>createBindingError(`Failed to invoke binding ${name}: ${message}`,details))}}var init_binding_client=__esm(()=>{init_error_handling();init_utils3()});class DaprConfigClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(keys,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"config get"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting configuration",{keys,storeName});let response=await(await this.client()).configuration.get(storeName,keys);return this.logger.debug("Configuration retrieved",{keys,storeName,itemCount:Object.keys(response.items||{}).length}),response.items||{}},(message,details)=>createConfigError(`Failed to get configuration: ${message}`,details))}async subscribeWithKeys(keys,callback,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,callback,storeName},["keys","callback","storeName"],"config subscribeWithKeys"),keys.length===0)throw createConfigError("At least one key must be provided for subscription");return safeExecute(async()=>{this.logger.debug("Subscribing to configuration updates",{keys,storeName});let stream=await(await this.client()).configuration.subscribeWithKeys(storeName,keys,async(data)=>{try{this.logger.debug("Received configuration update",{storeName,updatedKeys:Object.keys(data.items||{})}),await callback(data)}catch(error){this.logger.error("Error in configuration subscription callback",error)}});return this.logger.debug("Configuration subscription established",{keys,storeName}),{stop:()=>{this.logger.debug("Stopping configuration subscription",{keys,storeName}),stream.stop()}}},(message,details)=>createConfigError(`Failed to subscribe to configuration updates: ${message}`,details))}async getValue(key,storeName=DEFAULT_CONFIG_STORE){return(await this.get([key],storeName))[key]?.value}async getValues(keys,storeName=DEFAULT_CONFIG_STORE){let items=await this.get(keys,storeName),values={};for(let key in items)if(items[key]?.value!==void 0)values[key]=items[key].value;return values}}var init_config_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprCryptoClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async encrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto encrypt"),safeExecute(async()=>{this.logger.debug("Encrypting data",{componentName:options.componentName,keyName:options.keyName,keyWrapAlgorithm:options.keyWrapAlgorithm});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let encryptedData=await client.crypto.encrypt(inputData,cryptoOptions);return this.logger.debug("Data encrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:encryptedData.length}),encryptedData},(message,details)=>createCryptoError(`Failed to encrypt data: ${message}`,details))}async decrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto decrypt"),safeExecute(async()=>{this.logger.debug("Decrypting data",{componentName:options.componentName});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let decryptedData=await client.crypto.decrypt(inputData,cryptoOptions);return this.logger.debug("Data decrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:decryptedData.length}),decryptedData},(message,details)=>createCryptoError(`Failed to decrypt data: ${message}`,details))}async encryptString(plaintext,options){return(await this.encrypt(plaintext,options)).toString("base64")}async decryptString(ciphertext,options){let encryptedBuffer=Buffer.from(ciphertext,"base64");return(await this.decrypt(encryptedBuffer,options)).toString("utf-8")}}var init_crypto_client=__esm(()=>{init_error_handling();init_utils3()});function dapr(){if(!cachedDapr)cachedDapr=__require("@dapr/dapr");return cachedDapr}class DaprInvokeClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(appId,methodName,httpMethod,data,options={}){httpMethod??=dapr().HttpMethod.POST,validateRequired({appId,methodName,httpMethod},["appId","methodName","httpMethod"],"invoke service");let timeoutMs=options.timeout||DEFAULT_OPERATION_TIMEOUT_MS;return safeExecute(async()=>{this.logger.debug("Invoking service",{appId,methodName,httpMethod,hasData:data!==void 0});let fullMethodName=methodName;if(options.queryParams&&Object.keys(options.queryParams).length>0){let queryString=Object.entries(options.queryParams).map(([key,value])=>`${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");fullMethodName=`${methodName}?${queryString}`}let client=await this.client(),response=await withTimeout(()=>client.invoker.invoke(appId,fullMethodName,httpMethod,data,options.headers),timeoutMs,`Service invocation timed out after ${timeoutMs}ms`);if(this.logger.debug("Service invoked successfully",{appId,methodName,httpMethod,status:response?.status}),!response)return;if("data"in response)return response.data;return response},(message,details)=>createInvokeError(`Failed to invoke service ${appId}.${methodName}: ${message}`,details))}async get(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.GET,void 0,options)}async post(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.POST,data,options)}async put(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.PUT,data,options)}async delete(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.DELETE,void 0,options)}}var cachedDapr=null;var init_invoke_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprLockClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async lock(storeName,resourceId,lockOwner,options){return validateRequired({storeName,resourceId,lockOwner,expiryInSeconds:options.expiryInSeconds},["storeName","resourceId","lockOwner","expiryInSeconds"],"lock"),safeExecute(async()=>{this.logger.debug("Acquiring lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.lock(storeName,resourceId,lockOwner,options.expiryInSeconds);return this.logger.debug("Lock acquisition result",{storeName,resourceId,lockOwner,success:response.success}),{success:response.success}},(message,details)=>createLockError(`Failed to acquire lock for resource ${resourceId}: ${message}`,details))}async unlock(storeName,resourceId,lockOwner){return validateRequired({storeName,resourceId,lockOwner},["storeName","resourceId","lockOwner"],"unlock"),safeExecute(async()=>{this.logger.debug("Releasing lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.unlock(storeName,resourceId,lockOwner);return this.logger.debug("Lock release result",{storeName,resourceId,lockOwner,status:this.getLockStatusName(response.status)}),{status:response.status}},(message,details)=>createLockError(`Failed to release lock for resource ${resourceId}: ${message}`,details))}getLockStatusName(status){switch(status){case 0:return"Success";case 1:return"LockDoesNotExist";case 2:return"LockBelongsToOthers";default:return"InternalError"}}}var init_lock_client=__esm(()=>{init_error_handling();init_utils3()});class DaprPubSubClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async publish(topic,data,options={},pubsubName=DEFAULT_PUBSUB_NAME){return validateRequired({topic,data,pubsubName},["topic","data","pubsubName"],"pubsub publish"),safeExecute(async()=>{this.logger.debug("Publishing message to topic",{topic,pubsubName}),await(await this.client()).pubsub.publish(pubsubName,topic,data,{metadata:options.metadata,contentType:options.contentType}),this.logger.debug("Message published successfully",{topic,pubsubName})},(message,details)=>createPubSubError(`Failed to publish message to topic ${topic}: ${message}`,details))}async publishBulk(topic,messages,pubsubName=DEFAULT_PUBSUB_NAME){if(validateRequired({topic,messages,pubsubName},["topic","messages","pubsubName"],"pubsub publishBulk"),messages.length===0)return{failedEntries:[]};return safeExecute(async()=>{this.logger.debug("Publishing bulk messages to topic",{topic,pubsubName,messageCount:messages.length});let client=await this.client(),daprMessages=messages.map((msg)=>{if(typeof msg==="object"&&"event"in msg)return{entryID:msg.entryId,event:msg.event,contentType:msg.contentType,metadata:msg.metadata};return{event:msg}}),response=await client.pubsub.publishBulk(pubsubName,topic,daprMessages),failedCount=response.failedMessages?.length||0;if(failedCount>0)this.logger.warn("Some messages failed to publish",{topic,pubsubName,failedCount,totalCount:messages.length});else this.logger.debug("All bulk messages published successfully",{topic,pubsubName,messageCount:messages.length});return{failedEntries:(response.failedMessages||[]).map((failed)=>({entryId:failed.message.entryID||"",error:failed.error?.message||"Unknown error"}))}},(message,details)=>createPubSubError(`Failed to publish bulk messages to topic ${topic}: ${message}`,details))}createBulkPublishMessage(event,entryId,contentType,metadata){return{entryId,event,contentType,metadata}}}var init_pubsub_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprSecretClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(key,options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({key,storeName},["key","storeName"],"secret get"),safeExecute(async()=>{this.logger.debug("Getting secret",{key,storeName});let client=await this.client(),metadataStr=options.metadata?JSON.stringify(options.metadata):void 0,result=await client.secret.get(storeName,key,metadataStr);return this.logger.debug("Secret retrieved",{key,storeName}),result},(message,details)=>createSecretError(`Failed to get secret ${key}: ${message}`,details))}async getBulk(_options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({storeName},["storeName"],"secret getBulk"),safeExecute(async()=>{this.logger.debug("Getting all secrets",{storeName});let result=await(await this.client()).secret.getBulk(storeName);return this.logger.debug("All secrets retrieved",{storeName,secretCount:Object.keys(result).length}),result},(message,details)=>createSecretError(`Failed to get all secrets: ${message}`,details))}}var init_secret_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprStateClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async save(stateItems,options={},storeName=DEFAULT_STATE_STORE){if(validateRequired({stateItems,storeName},["stateItems","storeName"],"state save"),stateItems.length===0)return;return safeExecute(async()=>{this.logger.debug("Saving state items",{count:stateItems.length,storeName}),await(await this.client()).state.save(storeName,stateItems,options),this.logger.debug("State items saved successfully",{count:stateItems.length,storeName})},(message,details)=>createStateError(`Failed to save state items: ${message}`,details))}async get(key,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state get"),safeExecute(async()=>{this.logger.debug("Getting state item",{key,storeName});let result=await(await this.client()).state.get(storeName,key);if(this.logger.debug("State item retrieved",{key,storeName,found:result!==void 0&&result!==null&&result!==""}),result===void 0||result===null)return;if(typeof result==="string")try{return JSON.parse(result)}catch{return result}if(typeof result==="object")return result;return result},(message,details)=>createStateError(`Failed to get state item ${key}: ${message}`,details))}async getBulk(keys,storeName=DEFAULT_STATE_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"state getBulk"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting bulk state items",{count:keys.length,storeName});let results=await(await this.client()).state.getBulk(storeName,keys),resultMap={};return results.forEach((item)=>{if(item.data!==void 0)resultMap[item.key]=item.data}),this.logger.debug("Bulk state items retrieved",{count:keys.length,found:Object.keys(resultMap).length,storeName}),resultMap},(message,details)=>createStateError(`Failed to get bulk state items: ${message}`,details))}async delete(key,etag,metadata,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state delete"),safeExecute(async()=>{this.logger.debug("Deleting state item",{key,storeName});let client=await this.client(),options={};if(etag)options.etag=etag;if(metadata)options.metadata=metadata;await client.state.delete(storeName,key,options),this.logger.debug("State item deleted",{key,storeName})},(message,details)=>createStateError(`Failed to delete state item ${key}: ${message}`,details))}async transaction(operations,storeName=DEFAULT_STATE_STORE){if(validateRequired({operations,storeName},["operations","storeName"],"state transaction"),operations.length===0)return;return safeExecute(async()=>{this.logger.debug("Executing state transaction",{operationCount:operations.length,storeName});let client=await this.client(),daprOperations=operations.map((op)=>({operation:op.operation,request:{key:op.request.key,value:op.request.value,etag:op.request.etag?{value:op.request.etag}:void 0,metadata:op.request.metadata}}));await client.state.transaction(storeName,daprOperations),this.logger.debug("State transaction executed successfully",{operationCount:operations.length,storeName})},(message,details)=>createStateError(`Failed to execute state transaction: ${message}`,details))}async query(query,storeName=DEFAULT_STATE_STORE){return validateRequired({query,storeName},["query","storeName"],"state query"),safeExecute(async()=>{this.logger.debug("Querying state store",{storeName});let result=await(await this.client()).state.query(storeName,query);return this.logger.debug("State query executed",{storeName,resultCount:result.results?.length||0}),(result.results||[]).map((item)=>item.data)},(message,details)=>createStateError(`Failed to query state store: ${message}`,details))}async saveItem(key,value,options={},storeName=DEFAULT_STATE_STORE){let stateItem={key,value};return this.save([stateItem],options,storeName)}async upsert(key,value,options={},storeName=DEFAULT_STATE_STORE){return this.saveItem(key,value,options,storeName)}}var init_state_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprWorkflowClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async start(workflowName,input,options={}){return validateRequired({workflowName},["workflowName"],"workflow start"),safeExecute(async()=>{this.logger.debug("Starting workflow",{workflowName,instanceId:options.instanceId||"auto-generated",workflowComponent:options.workflowComponent});let instanceId=await(await this.client()).workflow.start(workflowName,input,options.instanceId);return this.logger.debug("Workflow started",{workflowName,instanceId}),instanceId},(message,details)=>createWorkflowError(`Failed to start workflow ${workflowName}: ${message}`,details))}async get(instanceId){return validateRequired({instanceId},["instanceId"],"workflow get"),safeExecute(async()=>{this.logger.debug("Getting workflow instance",{instanceId});let instance=await(await this.client()).workflow.get(instanceId);return this.logger.debug("Workflow instance retrieved",{instanceId,workflowName:instance.workflowName,runtimeStatus:instance.runtimeStatus}),{instanceId:instance.instanceID,workflowName:instance.workflowName,createdAt:new Date(instance.createdAt),lastUpdatedAt:new Date(instance.lastUpdatedAt),runtimeStatus:instance.runtimeStatus,properties:instance.properties||{}}},(message,details)=>createWorkflowError(`Failed to get workflow instance ${instanceId}: ${message}`,details))}async terminate(instanceId){return validateRequired({instanceId},["instanceId"],"workflow terminate"),safeExecute(async()=>{this.logger.debug("Terminating workflow instance",{instanceId}),await(await this.client()).workflow.terminate(instanceId),this.logger.debug("Workflow instance terminated",{instanceId})},(message,details)=>createWorkflowError(`Failed to terminate workflow instance ${instanceId}: ${message}`,details))}async pause(instanceId){return validateRequired({instanceId},["instanceId"],"workflow pause"),safeExecute(async()=>{this.logger.debug("Pausing workflow instance",{instanceId}),await(await this.client()).workflow.pause(instanceId),this.logger.debug("Workflow instance paused",{instanceId})},(message,details)=>createWorkflowError(`Failed to pause workflow instance ${instanceId}: ${message}`,details))}async resume(instanceId){return validateRequired({instanceId},["instanceId"],"workflow resume"),safeExecute(async()=>{this.logger.debug("Resuming workflow instance",{instanceId}),await(await this.client()).workflow.resume(instanceId),this.logger.debug("Workflow instance resumed",{instanceId})},(message,details)=>createWorkflowError(`Failed to resume workflow instance ${instanceId}: ${message}`,details))}async purge(instanceId){return validateRequired({instanceId},["instanceId"],"workflow purge"),safeExecute(async()=>{this.logger.debug("Purging workflow instance",{instanceId}),await(await this.client()).workflow.purge(instanceId),this.logger.debug("Workflow instance purged",{instanceId})},(message,details)=>createWorkflowError(`Failed to purge workflow instance ${instanceId}: ${message}`,details))}async raiseEvent(instanceId,eventName,eventData){return validateRequired({instanceId,eventName},["instanceId","eventName"],"workflow raiseEvent"),safeExecute(async()=>{this.logger.debug("Raising event for workflow instance",{instanceId,eventName}),await(await this.client()).workflow.raise(instanceId,eventName,eventData),this.logger.debug("Event raised for workflow instance",{instanceId,eventName})},(message,details)=>createWorkflowError(`Failed to raise event ${eventName} for workflow instance ${instanceId}: ${message}`,details))}}var init_workflow_client=__esm(()=>{init_error_handling();init_utils3()});function dapr2(){if(!cachedDapr2)cachedDapr2=__require("@dapr/dapr");return cachedDapr2}class DaprConnectionManager{client=null;daprHost;daprPort;communicationProtocolOption;maxBodySizeMb;daprApiToken;logger;connectionStatus=CONNECTION_STATUS.DISCONNECTED;connectionPromise=null;constructor(options={}){this.daprHost=options.daprHost||process.env[ENV_DAPR_HOST]||DEFAULT_DAPR_HOST,this.daprPort=options.daprPort||process.env[ENV_DAPR_HTTP_PORT]||DEFAULT_DAPR_PORT,this.communicationProtocolOption=options.communicationProtocol,this.maxBodySizeMb=options.maxBodySizeMb||DEFAULT_MAX_BODY_SIZE_MB,this.daprApiToken=options.daprApiToken||process.env[ENV_DAPR_API_TOKEN],this.logger=options.logger||createDefaultLogger(),this.logger.info("DaprConnectionManager initialized",{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocolOption??"default (HTTP)"})}get communicationProtocol(){return this.communicationProtocolOption??dapr2().CommunicationProtocolEnum.HTTP}async getClient(){if(!this.client||this.connectionStatus!==CONNECTION_STATUS.CONNECTED)await this.connect();if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");return this.client}async connect(){if(this.connectionPromise)return this.connectionPromise;if(this.client&&this.connectionStatus===CONNECTION_STATUS.CONNECTED)return Promise.resolve();this.connectionStatus=CONNECTION_STATUS.CONNECTING,this.connectionPromise=this.establishConnection();try{await this.connectionPromise,this.connectionStatus=CONNECTION_STATUS.CONNECTED}catch(error){throw this.connectionStatus=CONNECTION_STATUS.ERROR,error}finally{this.connectionPromise=null}}async establishConnection(){try{this.logger.info("Connecting to Dapr sidecar",{daprHost:this.daprHost,daprPort:this.daprPort,protocol:this.communicationProtocol});let protocols=dapr2().CommunicationProtocolEnum,useEndpointFromEnv=process.env[ENV_DAPR_HTTP_ENDPOINT]&&this.communicationProtocol===protocols.HTTP||process.env[ENV_DAPR_GRPC_ENDPOINT]&&this.communicationProtocol===protocols.GRPC,clientOptions={communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,logger:{level:dapr2().LogLevel.Warn}};if(!useEndpointFromEnv)clientOptions.daprHost=this.daprHost,clientOptions.daprPort=this.daprPort;if(this.daprApiToken)clientOptions.daprApiToken=this.daprApiToken;await withTimeout(async()=>{this.client=new(dapr2()).DaprClient(clientOptions)},DEFAULT_CONNECTION_TIMEOUT_MS,"Connection to Dapr sidecar timed out"),await this.healthCheck(),this.logger.info("Successfully connected to Dapr sidecar")}catch(error){throw this.logger.error("Failed to connect to Dapr sidecar",error),this.client=null,createConnectionError(`Failed to connect to Dapr sidecar at ${this.daprHost}:${this.daprPort}`,error)}}async disconnect(){if(!this.client)return;try{this.logger.info("Disconnecting from Dapr sidecar"),this.client=null,this.connectionStatus=CONNECTION_STATUS.DISCONNECTED,this.logger.info("Disconnected from Dapr sidecar")}catch(error){throw this.logger.error("Error during disconnect",error),createConnectionError("Failed to disconnect from Dapr sidecar",error)}}isConnected(){return this.client!==null&&this.connectionStatus===CONNECTION_STATUS.CONNECTED}getConnectionStatus(){return this.connectionStatus}async healthCheck(){if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");try{return await withTimeout(async()=>{if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");let response=await this.client.invoker.invoke("healthz","healthz",dapr2().HttpMethod.GET);return{status:response.status===204?HEALTH_STATUS.HEALTHY:HEALTH_STATUS.UNHEALTHY,version:response.headers?.["dapr-version"]||"unknown"}},DEFAULT_HEALTH_CHECK_TIMEOUT_MS,"Health check timed out")}catch(error){return this.logger.error("Health check failed",error),{status:HEALTH_STATUS.UNHEALTHY,version:"unknown"}}}getClientConfig(){return{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,hasApiToken:!!this.daprApiToken,connectionStatus:this.connectionStatus}}}var cachedDapr2=null;var init_connection_manager=__esm(()=>{init_constants();init_error_handling();init_utils3()});var init_types2=()=>{};class DaprManager{connectionManager;logger;_state;_pubsub;_binding;_secret;_config;_invoke;_lock;_crypto;_workflow;constructor(options={}){this.logger=options.logger||createDefaultLogger(),this.connectionManager=new DaprConnectionManager(options);let clientProvider=async()=>{return this.connectionManager.getClient()};this._state=new DaprStateClient(clientProvider,this.logger),this._pubsub=new DaprPubSubClient(clientProvider,this.logger),this._binding=new DaprBindingClient(clientProvider,this.logger),this._secret=new DaprSecretClient(clientProvider,this.logger),this._config=new DaprConfigClient(clientProvider,this.logger),this._invoke=new DaprInvokeClient(clientProvider,this.logger),this._lock=new DaprLockClient(clientProvider,this.logger),this._crypto=new DaprCryptoClient(clientProvider,this.logger),this._workflow=new DaprWorkflowClient(clientProvider,this.logger)}async connect(){await this.connectionManager.connect()}async disconnect(){await this.connectionManager.disconnect()}isConnected(){return this.connectionManager.isConnected()}getConnectionStatus(){return this.connectionManager.getConnectionStatus()}async healthCheck(){return this.connectionManager.healthCheck()}getClientConfig(){return this.connectionManager.getClientConfig()}get state(){return this._state}get pubsub(){return this._pubsub}get binding(){return this._binding}get secret(){return this._secret}get config(){return this._config}get invoke(){return this._invoke}get lock(){return this._lock}get crypto(){return this._crypto}get workflow(){return this._workflow}}function getDaprManager(){if(!daprManagerInstance)daprManagerInstance=new DaprManager;return daprManagerInstance}var daprManagerInstance=null,daprManager;var init_Dapr=__esm(()=>{init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_connection_manager();init_utils3();init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_constants();init_error_handling();init_types2();daprManager=new Proxy({},{get(_target,property,receiver){let value=Reflect.get(getDaprManager(),property,receiver);return typeof value==="function"?value.bind(getDaprManager()):value},has(_target,property){return property in getDaprManager()}})});import Redis from"ioredis";class DirectRedisStore{client;constructor(client){this.client=client}async create(key,value,ttlSeconds){try{return{success:!0,data:ttlSeconds?await this.client.set(key,JSON.stringify(value),"EX",ttlSeconds):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async read(key){try{let raw=await this.client.get(key);return{success:!0,data:raw?JSON.parse(raw):null}}catch(error){return{success:!1,error:error.message}}}async update(key,value,preserveTtl=!0){try{return{success:!0,data:preserveTtl?await this.client.set(key,JSON.stringify(value),"KEEPTTL"):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return{success:!0,data:await this.client.del(key)}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.client.exists(key)===1}}catch(error){return{success:!1,error:error.message}}}getClient(){return this.client}}class DaprRedisStore{storeName;keyPrefix;dapr;constructor(storeName,keyPrefix=""){this.storeName=storeName;this.keyPrefix=keyPrefix;this.dapr=new DaprManager}k(key){return this.keyPrefix+key}async get(key){let data=await this.dapr.state.get(this.k(key),this.storeName);return data===void 0||data===null||data===""?null:data}async create(key,value,ttlSeconds){try{let metadata=ttlSeconds?{ttlInSeconds:String(ttlSeconds)}:void 0;return await this.dapr.state.save([{key:this.k(key),value,metadata}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async read(key){try{return{success:!0,data:await this.get(key)}}catch(error){return{success:!1,error:error.message}}}async update(key,value,_preserveTtl=!0){try{return await this.dapr.state.save([{key:this.k(key),value}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return await this.dapr.state.delete(this.k(key),void 0,void 0,this.storeName),{success:!0,data:1}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.get(key)!==null}}catch(error){return{success:!1,error:error.message}}}}class RedisManager{static instance=null;store;directClient=null;useDapr;constructor(config){if(RedisManager.instance){this.store=RedisManager.instance.store,this.directClient=RedisManager.instance.directClient,this.useDapr=RedisManager.instance.useDapr;return}if(!config)throw Error("Redis config must be provided for first initialization.");assertRedisConfig(config),this.useDapr=config.withDapr??!1;let keyPrefix=config.keyPrefix||"";if(config.withDapr)this.store=new DaprRedisStore(config.stateStoreName??"statestore",keyPrefix);else{let client=config.url?new Redis(config.url,keyPrefix?{keyPrefix}:{}):new Redis({host:config.host,port:config.port,...config.password?{password:config.password}:{},...config.username?{username:config.username}:{},...config.tls?{tls:{}}:{},...keyPrefix?{keyPrefix}:{}});this.directClient=client,this.store=new DirectRedisStore(client)}RedisManager.instance=this}static async reset(){let current=RedisManager.instance;if(RedisManager.instance=null,!current?.directClient)return;try{await current.directClient.quit()}catch{}}async create(key,value,ttlSeconds){return this.store.create(key,value,ttlSeconds)}async read(key){return this.store.read(key)}async update(key,value,preserveTtl=!0){return this.store.update(key,value,preserveTtl)}async remove(key){return this.store.remove(key)}async exists(key){return this.store.exists(key)}async readCounters(keys){return(await Promise.all(keys.map((k)=>this.read(k)))).map((r)=>{let v=r.success?r.data:null,n=typeof v==="number"?v:Number.parseFloat(String(v??""));return Number.isFinite(n)?n:0})}async incrementCounter(key,delta,ttlSeconds){if(!this.useDapr&&this.directClient){let v=await this.directClient.incrbyfloat(key,delta);if(ttlSeconds&&ttlSeconds>0)try{await this.directClient.expire(key,ttlSeconds)}catch{}return Number(v)}let cur=await this.read(key),raw=cur.success?cur.data:null,base=typeof raw==="number"?raw:Number.parseFloat(String(raw??"")),next=(Number.isFinite(base)?base:0)+delta;return await this.create(key,next,ttlSeconds),next}getDirectClient(){return this.directClient}async reauthenticate(username,password){if(this.directClient)await this.directClient.auth(username,password)}async keys(pattern){if(this.useDapr||!this.directClient)return logger.scoped("database.redis").warn("keys() not supported in Dapr mode",{pattern}),[];try{return await this.directClient.keys(pattern)}catch(error){return logger.scoped("database.redis").error("keys() failed",error,{pattern}),[]}}async acquireLock(lockKey,ttlSeconds=10){if(this.useDapr||!this.directClient){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(existsResult.data)return{success:!0,data:!1};if((await this.create(lockKey,"1",ttlSeconds)).success)return{success:!0,data:!0};return{success:!1,error:"Failed to acquire lock"}}try{return{success:!0,data:await this.directClient.set(lockKey,"1","EX",ttlSeconds,"NX")==="OK"}}catch(error){return{success:!1,error:error.message}}}async releaseLock(lockKey){return this.remove(lockKey)}async waitForLock(lockKey,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(!existsResult.data)return{success:!0,data:!0};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:!1}}async getOrWait(key,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let readResult=await this.read(key);if(!readResult.success)return{success:!1,error:readResult.error};if(readResult.data!==null)return{success:!0,data:readResult.data};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:null}}}var assertRedisConfig=(config)=>{if(!config)throw Error("Redis config must be provided.");if(config.withDapr){if(!config.stateStoreName)throw Error("Dapr mode requires stateStoreName.");return}let hasUrl=Boolean(config.url),hasHostPort=Boolean(config.host)&&typeof config.port==="number";if(!hasUrl&&!hasHostPort)throw Error("Redis config requires either url or host and port.")};var init_Redis=__esm(()=>{init_Logger2();init_Dapr()});var init_Delete=__esm(()=>{init_Redis()});var init_Generate3=__esm(()=>{init_Redis();init_JWT()});var init_Read=__esm(()=>{init_Redis();init_JWT();init_Delete()});var init_Validate2=__esm(()=>{init_Read()});var init_RefreshToken=__esm(()=>{init_Delete();init_Generate3();init_Read();init_Validate2()});var DEFAULT_EXPIRY_SECONDS=86400,buildSessionKey=(sessionId)=>`session:${sessionId}`,buildRefreshChainKey=(sessionId)=>`refresh-chain:${sessionId}`,serializeSession=(record)=>JSON.stringify(record),deserializeSession=(data)=>{if(!data)return null;if(typeof data==="object")return data;try{return JSON.parse(data)}catch{return null}};var deleteSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),removeResult=await manager.remove(key);return await manager.remove(buildRefreshChainKey(options.sessionId)).catch(()=>{return}),removeResult.success&&removeResult.data>0},forgetSessionsInRedis=async(sessionIds)=>{for(let id of sessionIds){if(!id)continue;try{await deleteSession({sessionId:String(id)})}catch{}}};var init_Delete2=__esm(()=>{init_Redis()});import crypto4 from"crypto";var generateSession=async(options)=>{let manager=new RedisManager,sessionId=options.sessionId??crypto4.randomUUID(),now=Date.now(),nowIso=new Date(now).toISOString(),never=options.expiresInSeconds===null,ttlSeconds=never?void 0:options.expiresInSeconds??DEFAULT_EXPIRY_SECONDS,record={id:sessionId,userId:options.userId,createdAt:nowIso,expiresAt:never?null:new Date(now+ttlSeconds*1000).toISOString(),lastActiveAt:nowIso,clientMeta:options.clientMeta,fingerprintHash:options.fingerprintHash,deviceInfo:options.deviceInfo,refreshTokenHash:options.refreshTokenHash,loginMethod:options.loginMethod,rememberMe:options.rememberMe},writeResult=await manager.create(buildSessionKey(sessionId),serializeSession(record),ttlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:record}};var init_Generate4=__esm(()=>{init_Redis()});var init_Issue=__esm(()=>{init_JWT();init_Generate3();init_Delete2();init_Generate4()});var init_Session=__esm(()=>{init_Issue()});var lookupSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),readResult=await manager.read(key);if(!readResult.success)return{state:"unavailable",error:readResult.error??"session store read failed"};if(!readResult.data)return{state:"missing"};let record=deserializeSession(readResult.data);if(!record)return{state:"missing"};if(record.expiresAt&&new Date(record.expiresAt).getTime()<=Date.now())return await deleteSession({sessionId:options.sessionId}),{state:"missing"};return{state:"found",record}},readSession=async(options)=>{let lookup=await lookupSession(options);return lookup.state==="found"?lookup.record:null};var init_Read2=__esm(()=>{init_Redis();init_Delete2()});var updateSession=async(options)=>{let existing=await readSession({sessionId:options.sessionId});if(!existing)return{success:!1,error:"Session not found"};let updated={...existing,...options.updates,lastActiveAt:options.updates.lastActiveAt??new Date().toISOString()},manager=new RedisManager,remainingTtlSeconds=updated.expiresAt?Math.max(60,Math.ceil((new Date(updated.expiresAt).getTime()-Date.now())/1000)):void 0,writeResult=await manager.create(buildSessionKey(options.sessionId),serializeSession(updated),remainingTtlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:updated}},updateLastActiveAt=async(sessionId)=>{return updateSession({sessionId,updates:{lastActiveAt:new Date().toISOString()}})};var init_Update=__esm(()=>{init_Redis();init_Read2()});var validateSession=async(options)=>{let jwtResult=verifyJWT(options.jwtToken,options.jwtSecret);if(!jwtResult.valid)return{isValid:!1,reason:jwtResult.error};let session=await readSession({sessionId:options.sessionId});if(!session)return{isValid:!1,reason:"Session not found"};let fingerprintValid;if(options.savedFingerprint&&options.headers&&options.requestIp){let sanitizedHeaders={};for(let[key,value]of Object.entries(options.headers))if(value!==void 0)sanitizedHeaders[key]=value;let fingerprintResult=validateDeviceFingerprint({savedFingerprint:options.savedFingerprint,headers:sanitizedHeaders,requestIp:options.requestIp});if(fingerprintValid=fingerprintResult.isValid,!fingerprintResult.isValid)return{isValid:!1,reason:fingerprintResult.reason??"Fingerprint mismatch"}}return{isValid:!0,context:{userId:session.userId,sessionId:session.id,fingerprintValid}}};var init_Validate3=__esm(()=>{init_Validate();init_JWT();init_Read2()});var exports_SessionStore={};__export(exports_SessionStore,{validateSession:()=>validateSession,updateSession:()=>updateSession,updateLastActiveAt:()=>updateLastActiveAt,readSession:()=>readSession,lookupSession:()=>lookupSession,generateSession:()=>generateSession,forgetSessionsInRedis:()=>forgetSessionsInRedis,deleteSession:()=>deleteSession});var init_SessionStore=__esm(()=>{init_Delete2();init_Generate4();init_Read2();init_Update();init_Validate3()});var init_Auth=__esm(()=>{init_Fingerprint();init_JWT();init_Password();init_RefreshToken();init_Session();init_SessionStore()});import{eq}from"drizzle-orm";function buildClaimAction(method,entity,field,relation,relationField,isBulk){let parts=[method.toLowerCase()];if(isBulk)parts.push("bulk");if(parts.push(entity),relation){if(parts.push("with"),parts.push(relation),relationField)parts.push(relationField)}else if(field)parts.push(field);return parts.join(".")}function buildClaimPath(entity,isBulk,hasId){if(isBulk)return`/${entity}/bulk`;if(hasId)return`/${entity}/:id`;return`/${entity}`}function generateEntityClaims(entity,config,schemaRelations){let claims=[],tableName=entity.table_name,excludedMethods=entity.excluded_methods||[];for(let method of HTTP_METHODS){if(excludedMethods.includes(method))continue;let needsId=method==="PUT"||method==="PATCH"||method==="DELETE";if(claims.push({action:buildClaimAction(method,tableName),description:`${method} access to ${tableName}`,path:buildClaimPath(tableName,!1,needsId&&method!=="DELETE"),method}),method==="GET"&&entity.columns){for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName),method})}let relationKey=`${tableName.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}Relations`;if(schemaRelations[relationKey]){let relationConfig=schemaRelations[relationKey];if(relationConfig?.config?.referencedTable?._?.name){let relationName=relationConfig.config.referencedTable._.name;claims.push({action:buildClaimAction(method,tableName,void 0,relationName),description:`${method} access to ${tableName} with ${relationName}`,path:buildClaimPath(tableName),method})}}}if(method==="POST"||method==="PUT"||method==="PATCH"){if(entity.columns)for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName,!1,method!=="POST"),method})}}}if(entity.bulk_endpoints_enabled===!0)for(let method of BULK_METHODS){if(excludedMethods.includes(method))continue;claims.push({action:buildClaimAction(method,tableName,void 0,void 0,void 0,!0),description:`Bulk ${method} access to ${tableName}`,path:buildClaimPath(tableName,!0),method})}return claims}async function seedClaims(db,schemaTables,schemaRelations,entities,config,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return logger2.warn("[Authorization] Claims table not found in schema"),{total:0,created:0,existing:0,claims:[]};let allClaims=[];for(let entity of entities){if(config.skipTables.includes(entity.table_name))continue;let entityClaims=generateEntityClaims(entity,config,schemaRelations);allClaims.push(...entityClaims)}let uniqueClaims=allClaims.filter((claim,index,self2)=>index===self2.findIndex((c)=>c.action===claim.action)),created=0,existing=0,claimActions=[];for(let claim of uniqueClaims)try{if((await db.select().from(claimsTable).where(eq(claimsTable.action,claim.action)).limit(1)).length===0)await db.insert(claimsTable).values(claim),created++,claimActions.push(claim.action),logger2.debug(`[Authorization] Created claim: ${claim.action}`);else existing++}catch(error){logger2.error(`[Authorization] Failed to create claim: ${claim.action}`,error)}return logger2.info(`[Authorization] Claims seeded: ${created} created, ${existing} existing, ${uniqueClaims.length} total`),{total:uniqueClaims.length,created,existing,claims:claimActions}}var HTTP_METHODS,BULK_METHODS;var init_ClaimSeeder=__esm(()=>{HTTP_METHODS=["GET","POST","PUT","PATCH","DELETE"],BULK_METHODS=["POST","PUT","DELETE"]});function parseStoredJson(stored){if(stored===null||stored===void 0)return null;if(typeof stored==="object")return stored;if(typeof stored==="string"){if(stored.length===0)return null;try{return JSON.parse(stored)}catch{return null}}if(typeof stored==="number"||typeof stored==="boolean")return stored;return null}import{and,eq as eq2,isNull,or}from"drizzle-orm";function activeRowsPredicate(table){let column=table?.isActive;if(!column)return;return or(isNull(column),eq2(column,!0))}function activeGrantPredicate(tables){return and(activeRowsPredicate(tables.userRoles),activeRowsPredicate(tables.roleClaims),activeRowsPredicate(tables.claims))}var init_activeRows=()=>{};var exports_ClaimsCache={};__export(exports_ClaimsCache,{ClaimsCache:()=>ClaimsCache});import{and as and2,eq as eq3}from"drizzle-orm";class ClaimsCache{prefix;redis;db;schemaTables;logger;constructor(config){this.prefix=config.prefix||DEFAULT_PREFIX,this.redis=config.redis,this.db=config.db,this.schemaTables=config.schemaTables,this.logger=config.logger}key(suffix){return`${this.prefix}:${suffix}`}async buildCache(){let rolesTable=this.schemaTables.roles,roleClaimsTable=this.schemaTables.roleClaims,claimsTable=this.schemaTables.claims;if(!rolesTable||!roleClaimsTable||!claimsTable)return this.logger.warn("[ClaimsCache] Required tables not found, skipping cache build"),{version:0,roleCount:0,totalMappings:0};let allRoles=await this.db.select().from(rolesTable),roleNames=[],totalMappings=0;for(let role of allRoles){let r=role,roleId=r.id,roleName=r.name;roleNames.push(roleName);let roleClaimRows=await this.db.select().from(roleClaimsTable).innerJoin(claimsTable,eq3(roleClaimsTable.claimId,claimsTable.id)).where(and2(eq3(roleClaimsTable.roleId,roleId),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable}))),claimActions=[];for(let row of roleClaimRows){let action=row.claims?.action;if(action)claimActions.push(action)}await this.redis.set(this.key(`role:${roleName}`),JSON.stringify(claimActions)),totalMappings+=claimActions.length}await this.redis.set(this.key("roles"),JSON.stringify(roleNames));let newVersion=storedVersionNumber(await this.redis.get(this.key("version")))+1;return await this.redis.set(this.key("version"),String(newVersion)),this.logger.info("[ClaimsCache] Cache built",{version:newVersion,roleCount:roleNames.length,totalMappings}),{version:newVersion,roleCount:roleNames.length,totalMappings}}async getVersion(){return storedVersionNumber(await this.redis.get(this.key("version")))}async resolveClaimsForRoles(roleNames){let allClaims=new Set;for(let roleName of roleNames){let claims=parseStoredJson(await this.redis.get(this.key(`role:${roleName}`)));if(Array.isArray(claims))for(let c of claims)allClaims.add(c);else if(claims!==null)this.logger.warn("[ClaimsCache] Cached role entry unreadable, ignoring",{roleName})}return Array.from(allClaims)}async invalidate(){return(await this.buildCache()).version}getPrefix(){return this.prefix}}var DEFAULT_PREFIX="nucleus:claims",storedVersionNumber=(stored)=>{let value=parseStoredJson(stored),parsed=typeof value==="number"?value:Number.parseInt(String(value??""),10);return Number.isFinite(parsed)?parsed:0};var init_ClaimsCache=__esm(()=>{init_activeRows()});var DEFAULT_AUTHORIZATION_CONFIG,AUTHORIZATION_TABLE_KEYS,GODMIN_ROLE_NAME="godmin";var init_types3=__esm(()=>{DEFAULT_AUTHORIZATION_CONFIG={enabled:!1,autoSeedClaims:!0,skipTables:["audit_logs"],skipColumns:["id","created_at","updated_at","is_active","password","version"],excludedPaths:[],publicPaths:["/auth/login","/auth/register"]},AUTHORIZATION_TABLE_KEYS={users:"users",roles:"roles",claims:"claims",userRoles:"userRoles",roleClaims:"roleClaims"}});var{password}=globalThis.Bun;import{and as and3,eq as eq4}from"drizzle-orm";async function setupGodmin(db,schemaTables,config,logger2){if(!config.godminEmail||!config.godminPassword)return logger2.warn("[Authorization] Godmin email or password not configured, skipping godmin setup"),{success:!1};let{roles:rolesTable,users:usersTable,userRoles:userRolesTable}=schemaTables;if(!rolesTable||!usersTable||!userRolesTable)return logger2.error("[Authorization] Required tables not found for godmin setup"),{success:!1};try{let roleId,existingRole=await db.select().from(rolesTable).where(eq4(rolesTable.name,GODMIN_ROLE_NAME)).limit(1);if(existingRole.length===0){let[newRole]=await db.insert(rolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();roleId=newRole.id,logger2.info(`[Authorization] Created godmin role: ${roleId}`)}else roleId=existingRole[0].id,logger2.debug(`[Authorization] Godmin role already exists: ${roleId}`);let userId,existingUser=await db.select().from(usersTable).where(eq4(usersTable.email,config.godminEmail)).limit(1);if(existingUser.length===0){let hashedPassword=await password.hash(config.godminPassword,{algorithm:"bcrypt",cost:10}),[newUser]=await db.insert(usersTable).values({email:config.godminEmail,password:hashedPassword,verifiedAt:new Date,isActive:!0,isGod:!0}).returning();userId=newUser.id,logger2.info(`[Authorization] Created godmin user: ${userId}`)}else{if(userId=existingUser[0].id,!existingUser[0].isGod)await db.update(usersTable).set({isGod:!0}).where(eq4(usersTable.id,userId)),logger2.info(`[Authorization] Marked existing godmin user as isGod=true: ${userId}`);logger2.debug(`[Authorization] Godmin user already exists: ${userId}`)}if(!((await db.select().from(userRolesTable).where(and3(eq4(userRolesTable.userId,userId),eq4(userRolesTable.roleId,roleId))).limit(1)).length>0))await db.insert(userRolesTable).values({userId,roleId}),logger2.info(`[Authorization] Assigned godmin role to user: ${userId}`);return{success:!0,userId,roleId}}catch(error){return logger2.error("[Authorization] Failed to setup godmin",error),{success:!1}}}function isGodminRole(roleName){return roleName===GODMIN_ROLE_NAME}var init_GodminSetup=__esm(()=>{init_types3()});import{and as and4,eq as eq5,inArray,sql}from"drizzle-orm";function isSelfReference(value){return value.startsWith(SELF_PREFIX)}function parseSelfReference(value){return{field:value.slice(SELF_PREFIX.length)}}function parseScopeWithSelf(scope){if(!scope)return{};let params=new URLSearchParams(scope),result={};for(let[key,value]of params.entries())if(isSelfReference(value))result[key]=parseSelfReference(value);else result[key]=value;return result}function resolveScopeWithSelf(parsedScope,userData,logger2){let resolved={},unresolved=[];for(let[key,value]of Object.entries(parsedScope))if(typeof value==="object"&&"field"in value){if(!userData){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - userData not provided`),unresolved.push(key);continue}let lookup=lookupUserDataField(userData,value.field);if(!lookup.found){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - field not found in userData`),unresolved.push(key);continue}resolved[key]=lookup.value,logger2.debug(`[Authorization] Resolved self:${value.field} -> ${String(lookup.value)}`)}else resolved[key]=value;return{resolved,unresolved}}function resolveClaimScopes(rows,userData,logger2){let claimScopes={},dropped=new Set,unrestricted=new Set;for(let{action,scope}of rows){if(!scope){unrestricted.add(action);continue}if(!scope.includes("="))continue;let parsed=parseScopeWithSelf(scope),{resolved,unresolved}=resolveScopeWithSelf(parsed,userData,logger2);if(unresolved.length>0){dropped.add(action);continue}claimScopes[action]={...claimScopes[action]??{},...resolved}}for(let a of unrestricted)delete claimScopes[a],dropped.delete(a);for(let a of dropped)delete claimScopes[a];return{claimScopes,dropped:Array.from(dropped)}}function mergeGrantingScopes(grantingActions,claimScopes){if(!claimScopes)return;let merged={},any=!1;for(let action of grantingActions){let s=claimScopes[action];if(!s||Object.keys(s).length===0)return;Object.assign(merged,s),any=!0}return any?merged:void 0}function buildClaimPattern(method,entity,field,relation){let parts=[method.toLowerCase(),entity];if(relation)parts.push("with",relation);else if(field)parts.push(field);return parts.join(".")}function claimMatches(userClaim,requiredPattern,requireSpecificity=!1){if(userClaim===requiredPattern)return!0;let userParts=userClaim.split("."),requiredParts=requiredPattern.split(".");if(userParts.length>requiredParts.length)return!1;if(requireSpecificity&&userParts.length<2&&requiredParts.length>=2)return!1;for(let i=0;i<userParts.length;i++)if(userParts[i]!==requiredParts[i])return!1;return!0}async function checkAuthorization(params){let{userId,method,entity,requestedFields,requestedRelations,db,schemaTables,logger:logger2,getUserData}=params,reqSpec=params.requireClaimSpecificity??!1,ceiling=params.claimCeiling?new Set(params.claimCeiling):void 0,userData=params.userData,ensureUserData=async()=>{if(userData!==void 0)return;if(getUserData)try{userData=await getUserData()}catch(err){logger2.warn("[Authorization] getUserData callback failed",{userId,error:err instanceof Error?err.message:String(err)})}},rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles],userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],roleClaimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roleClaims],claimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.claims];if(!rolesTable||!userRolesTable||!roleClaimsTable||!claimsTable)return logger2.error("[Authorization] Required tables not found"),{authorized:!1,reason:"Authorization tables not configured"};try{let userRolesCols=userRolesTable,rolesCols=rolesTable,userRoles=await db.select({roleId:userRolesCols.roleId,roleName:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq5(userRolesCols.roleId,rolesCols.id)).where(and4(eq5(userRolesCols.userId,userId),activeGrantPredicate({userRoles:userRolesTable})));if(userRoles.length===0)return{authorized:!1,reason:"User has no roles assigned"};if(userRoles.some((ur)=>isGodminRole(ur.roleName))&&!ceiling)return logger2.debug(`[Authorization] User ${userId} has godmin role, bypassing checks`),{authorized:!0};let roleIds=userRoles.map((ur)=>ur.roleId),roleClaimsCols=roleClaimsTable,claimsCols=claimsTable,ownerGrants=await db.select({claimAction:claimsCols.action,scope:roleClaimsCols.scope}).from(roleClaimsTable).innerJoin(claimsTable,eq5(roleClaimsCols.claimId,claimsCols.id)).where(and4(inArray(roleClaimsCols.roleId,roleIds),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable})));if(ownerGrants.length===0)return{authorized:!1,reason:"User roles have no claims assigned"};let roleClaims=ceiling?ownerGrants.filter((rc)=>ceiling.has(rc.claimAction)):ownerGrants;if(roleClaims.length===0)return{authorized:!1,reason:"API key carries none of its owner's claims"};let entityClaimPattern=buildClaimPattern(method,entity),hasEntityAccess=roleClaims.some((rc)=>claimMatches(rc.claimAction,entityClaimPattern,reqSpec)),allowedFields=[],allowedRelations=[],scopeFilters={},unresolvedSelf=[],fieldPatterns=(requestedFields??[]).map((field)=>({field,pattern:buildClaimPattern(method,entity,field)})),relationPatterns=(requestedRelations??[]).map((relation)=>({relation,pattern:buildClaimPattern(method,entity,void 0,relation)})),claimCouldGrant=(action)=>claimMatches(action,entityClaimPattern,reqSpec)||fieldPatterns.some((f)=>claimMatches(action,f.pattern,reqSpec))||relationPatterns.some((r)=>claimMatches(action,r.pattern,reqSpec));if(roleClaims.some((rc)=>{let scope=rc.scope;return!!scope&&scope.includes("self:")&&claimCouldGrant(rc.claimAction)}))await ensureUserData();let applyClaimScope=(rc)=>{let parsedScope=parseScopeWithSelf(rc.scope),{resolved,unresolved}=resolveScopeWithSelf(parsedScope,userData,logger2);Object.assign(scopeFilters,resolved),unresolvedSelf.push(...unresolved)},denyOnUnresolvedSelf=()=>{if(unresolvedSelf.length===0)return null;return logger2.warn("[Authorization] Denying request: unresolvable self: scope (failing closed)",{userId,method,entity,unresolved:unresolvedSelf}),{authorized:!1,reason:"Ownership scope could not be resolved"}};if(hasEntityAccess){let unrestricted=!1;for(let rc of roleClaims){if(!claimMatches(rc.claimAction,entityClaimPattern,reqSpec))continue;if(!rc.scope){unrestricted=!0;continue}applyClaimScope(rc)}if(unrestricted)return{authorized:!0};let denied=denyOnUnresolvedSelf();if(denied)return denied;return{authorized:!0,scopeFilters:Object.keys(scopeFilters).length>0?scopeFilters:void 0}}let unrestrictedField=!1;for(let{field,pattern}of fieldPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedFields.push(field),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}for(let{relation,pattern}of relationPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedRelations.push(relation),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}if(!unrestrictedField){let denied=denyOnUnresolvedSelf();if(denied)return denied}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,scopeFilters:!unrestrictedField&&Object.keys(scopeFilters).length>0?scopeFilters:void 0}}catch(error){return logger2.error("[Authorization] Check failed",error),{authorized:!1,reason:"Authorization check failed"}}}function checkAuthorizationFromJWT(params){let{userClaims,userRoles,method,entity,requestedFields,requestedRelations,logger:logger2}=params,reqSpec=params.requireClaimSpecificity??!1,claimScopes=params.claimScopes;if(userClaims.length===0&&userRoles.length===0)return{authorized:!1,reason:"No roles or claims in token"};if(userRoles.some((r)=>isGodminRole(r)))return logger2.debug("[Authorization:JWT] User has godmin role, bypassing checks"),{authorized:!0};let entityClaimPattern=buildClaimPattern(method,entity),entityGranting=userClaims.filter((c)=>claimMatches(c,entityClaimPattern,reqSpec));if(entityGranting.length>0){let scopeFilters2=mergeGrantingScopes(entityGranting,claimScopes);return{authorized:!0,...scopeFilters2?{scopeFilters:scopeFilters2}:{}}}let allowedFields=[],allowedRelations=[],grantingActions=[];if(requestedFields)for(let field of requestedFields){let fieldPattern=buildClaimPattern(method,entity,field),granting=userClaims.filter((c)=>claimMatches(c,fieldPattern,reqSpec));if(granting.length>0)allowedFields.push(field),grantingActions.push(...granting)}if(requestedRelations)for(let relation of requestedRelations){let relationPattern=buildClaimPattern(method,entity,void 0,relation),granting=userClaims.filter((c)=>claimMatches(c,relationPattern,reqSpec));if(granting.length>0)allowedRelations.push(relation),grantingActions.push(...granting)}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};let scopeFilters=mergeGrantingScopes(grantingActions,claimScopes);return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,...scopeFilters?{scopeFilters}:{}}}async function checkAuthorizationViaIDP(params){let{idpUrl,accessToken,method,entity,requestedFields,requestedRelations,logger:logger2}=params;try{let response=await fetch(`${idpUrl}/auth/check`,{method:"POST",headers:{"Content-Type":"application/json",Cookie:`access_token=${accessToken}`},body:JSON.stringify({entity,method,fields:requestedFields,relations:requestedRelations})});if(!response.ok)return logger2.warn(`[Authorization:IDP] IDP /auth/check returned ${response.status}`),{authorized:!1,reason:`IDP authorization check failed (${response.status})`};let payload=await response.json();return unwrapIdpCheckResponse(payload)}catch(error){let msg=error instanceof Error?error.message:String(error);return logger2.error(`[Authorization:IDP] Failed to reach IDP: ${msg}`),{authorized:!1,reason:"IDP authorization service unavailable"}}}function filterResponseFields(data,allowedFields){if(!allowedFields||allowedFields.length===0)return data;let fieldsToInclude=[...new Set([...["id"],...allowedFields])],toCamel=(value)=>value.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase()),allowedKeys=new Set;for(let field of fieldsToInclude)allowedKeys.add(field),allowedKeys.add(toCamel(field));let filterSingle=(item)=>{let filtered={};for(let key of Object.keys(item))if(allowedKeys.has(key))filtered[key]=item[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function filterResponseRelations(data,allowedRelations){if(!allowedRelations)return data;let filterSingle=(item)=>{let filtered={...item};for(let key of Object.keys(filtered))if(typeof filtered[key]==="object"&&filtered[key]!==null&&!allowedRelations.includes(key))delete filtered[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function buildScopeConditions(scopeFilters,resolveColumn){let conditions=[],unresolvedFields=[];if(!scopeFilters)return{conditions,unresolvedFields};for(let[field,value]of Object.entries(scopeFilters)){let col=resolveColumn(field);if(col)conditions.push(eq5(col,value));else unresolvedFields.push(field),conditions.push(sql`1 = 0`)}return{conditions,unresolvedFields}}var SELF_PREFIX="self:",toCamelCase2=(value)=>value.replace(/_([a-z])/g,(_,c)=>c.toUpperCase()),toSnakeCase=(value)=>value.replace(/([A-Z])/g,(_,c)=>`_${c.toLowerCase()}`),lookupUserDataField=(userData,fieldName)=>{if(fieldName in userData)return{found:!0,value:userData[fieldName]};let camel=toCamelCase2(fieldName);if(camel!==fieldName&&camel in userData)return{found:!0,value:userData[camel]};let snake=toSnakeCase(fieldName);if(snake!==fieldName&&snake in userData)return{found:!0,value:userData[snake]};return{found:!1}},unwrapIdpCheckResponse=(payload)=>{if(!payload||typeof payload!=="object")return{authorized:!1,reason:"IDP returned malformed response"};let envelope=payload;if(envelope.data&&typeof envelope.data==="object"){let data=envelope.data;if(typeof data.authorized==="boolean")return data}let flat=payload;if(typeof flat.authorized==="boolean")return flat;return{authorized:!1,reason:"IDP returned unrecognised response shape"}};var init_Middleware=__esm(()=>{init_activeRows();init_GodminSetup();init_types3()});var exports_SeedRunner={};__export(exports_SeedRunner,{runSeed:()=>runSeed,expandClaimPatterns:()=>expandClaimPatterns});import{and as and5,eq as eq6}from"drizzle-orm";function expandClaimPatterns(patterns,allActions){let out=new Set;for(let pattern of patterns)if(pattern.endsWith(".*")){let prefix=pattern.slice(0,-2);for(let action of allActions)if(action===prefix||action.startsWith(`${prefix}.`))out.add(action)}else out.add(pattern);return[...out]}async function runSeed(db,schemaTables,seedConfig,logger2){let{roles:rolesTable,claims:claimsTable,roleClaims:roleClaimsTable}=schemaTables,result={rolesCreated:0,rolesExisting:0,claimsCreated:0,claimsExisting:0,assignmentsCreated:0,assignmentsExisting:0,assignmentsUpdated:0};if(seedConfig.roles?.length&&rolesTable)for(let roleDef of seedConfig.roles)try{if((await db.select().from(rolesTable).where(eq6(rolesTable.name,roleDef.name)).limit(1)).length===0)await db.insert(rolesTable).values({name:roleDef.name,description:roleDef.description||""}),result.rolesCreated++,logger2.info(`[Seed] Created role: ${roleDef.name}`);else result.rolesExisting++}catch(error){logger2.error(`[Seed] Failed to seed role: ${roleDef.name}`,error)}if(seedConfig.claims?.length&&claimsTable)for(let claimDef of seedConfig.claims)try{let existing=await db.select().from(claimsTable).where(eq6(claimsTable.action,claimDef.action)).limit(1);if(existing.length===0)await db.insert(claimsTable).values({action:claimDef.action,path:claimDef.path,method:claimDef.method,description:claimDef.description||`${claimDef.method} ${claimDef.path}`,...claimDef.policy!==void 0?{policy:claimDef.policy}:{}}),result.claimsCreated++,logger2.info(`[Seed] Created claim: ${claimDef.action}`);else if(claimDef.policy!==void 0){let existingRow=existing[0],currentPolicy=JSON.stringify(existingRow.policy??null),desiredPolicy=JSON.stringify(claimDef.policy??null);if(currentPolicy!==desiredPolicy)await db.update(claimsTable).set({policy:claimDef.policy}).where(eq6(claimsTable.action,claimDef.action)),result.claimsExisting++,logger2.warn(`[Seed] Reconciled policy for claim: ${claimDef.action}`);else result.claimsExisting++}else result.claimsExisting++}catch(error){logger2.error(`[Seed] Failed to seed claim: ${claimDef.action}`,error)}if(seedConfig.roleClaimAssignments?.length&&rolesTable&&claimsTable&&roleClaimsTable){let allClaimActions=(await db.select().from(claimsTable)).map((c)=>String(c.action??""));for(let assignment of seedConfig.roleClaimAssignments){let role=(await db.select().from(rolesTable).where(eq6(rolesTable.name,assignment.role)).limit(1))[0];if(!role){logger2.warn(`[Seed] Role not found for assignment: ${assignment.role}`);continue}let roleId=role.id,resolvedActions=expandClaimPatterns(assignment.claims,allClaimActions);for(let pattern of assignment.claims)if(pattern.endsWith(".*")&&!resolvedActions.some((a)=>a.startsWith(pattern.slice(0,-1))))logger2.warn(`[Seed] No claim matched prefix pattern: ${pattern}`);for(let claimAction of resolvedActions)try{let claim=(await db.select().from(claimsTable).where(eq6(claimsTable.action,claimAction)).limit(1))[0];if(!claim){logger2.warn(`[Seed] Claim not found for assignment: ${claimAction}`);continue}let claimId=claim.id,existingAssignment=await db.select().from(roleClaimsTable).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))).limit(1);if(existingAssignment.length===0)await db.insert(roleClaimsTable).values({roleId,claimId,scope:assignment.scope||null}),result.assignmentsCreated++;else{let existingRow=existingAssignment[0],desiredScope=assignment.scope||null,currentScope=existingRow.scope??null;if(currentScope!==desiredScope)await db.update(roleClaimsTable).set({scope:desiredScope}).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))),result.assignmentsUpdated++,logger2.warn(`[Seed] Reconciled scope for ${assignment.role} -> ${claimAction}: ${JSON.stringify(currentScope)} => ${JSON.stringify(desiredScope)}`);else result.assignmentsExisting++}}catch(error){logger2.error(`[Seed] Failed to assign claim ${claimAction} to role ${assignment.role}`,error)}if(result.assignmentsCreated>0)logger2.info(`[Seed] Role "${assignment.role}": assigned ${result.assignmentsCreated} claims`)}}return result}var init_SeedRunner=()=>{};var init_Authorization=__esm(()=>{init_ClaimSeeder();init_ClaimsCache();init_GodminSetup();init_Middleware();init_SeedRunner();init_types3()});function parseField(raw,spec){let out=new Set;for(let part of raw.split(",")){if(part==="")return null;let[rangePart,stepPart,...extra]=part.split("/");if(extra.length>0||rangePart===void 0)return null;let step=1;if(stepPart!==void 0){if(!/^\d+$/.test(stepPart))return null;if(step=Number.parseInt(stepPart,10),step<1)return null}let from,to;if(rangePart==="*")from=spec.min,to=spec.max;else if(rangePart.includes("-")){let[a,b,...rest]=rangePart.split("-");if(rest.length>0||!isIntInRange(a,spec)||!isIntInRange(b,spec))return null;if(from=namedToNumber(a,spec),to=namedToNumber(b,spec),from>to)return null}else{if(!isIntInRange(rangePart,spec))return null;from=namedToNumber(rangePart,spec),to=stepPart===void 0?from:spec.max}for(let v=from;v<=to;v+=step)out.add(v)}return out.size>0?out:null}function isIntInRange(value,spec){if(value===void 0)return!1;let n=namedToNumber(value,spec);return n!==null&&n>=spec.min&&n<=spec.max}function namedToNumber(value,spec){if(/^\d+$/.test(value))return Number.parseInt(value,10);let lower=value.toLowerCase();if(spec===MONTH){let i=MONTH_NAMES.indexOf(lower);return i===-1?null:i+1}if(spec===WEEKDAY){let i=DAY_NAMES.indexOf(lower);return i===-1?null:i}return null}function parseCron(expression){let trimmed=expression.trim(),parts=(MACROS[trimmed.toLowerCase()]??trimmed).split(/\s+/);if(parts.length!==5)return null;let[minRaw,hourRaw,dayRaw,monthRaw,weekdayRaw]=parts,minute=parseField(minRaw,MINUTE),hour=parseField(hourRaw,HOUR),day=parseField(dayRaw,DAY),month=parseField(monthRaw,MONTH),weekdayRawSet=parseField(weekdayRaw,WEEKDAY);if(!minute||!hour||!day||!month||!weekdayRawSet)return null;let weekday=new Set([...weekdayRawSet].map((d)=>d===7?0:d));return{minute,hour,day,month,weekday,dayUnrestricted:dayRaw==="*",weekdayUnrestricted:weekdayRaw==="*"}}function formatterFor(timeZone){let cached=formatterCache.get(timeZone);if(cached)return cached;try{let fmt=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short"});return formatterCache.set(timeZone,fmt),fmt}catch{return null}}function partsIn(ts,fmt){let parts=fmt.formatToParts(new Date(ts)),get=(type)=>parts.find((p)=>p.type===type)?.value??"0",hour=Number.parseInt(get("hour"),10)%24;return{year:Number.parseInt(get("year"),10),month:Number.parseInt(get("month"),10),day:Number.parseInt(get("day"),10),hour,minute:Number.parseInt(get("minute"),10),weekday:WEEKDAY_INDEX[get("weekday")]??0}}function offsetMsAt(ts,fmt){let p=partsIn(ts,fmt);return Date.UTC(p.year,p.month-1,p.day,p.hour,p.minute,new Date(ts).getUTCSeconds())-Math.floor(ts/1000)*1000}function zonedWallTimeToInstant(year,month,day,hour,minute,fmt){let naive=Date.UTC(year,month-1,day,hour,minute,0,0),ts=naive-offsetMsAt(naive,fmt),corrected=naive-offsetMsAt(ts,fmt);if(corrected!==ts)ts=corrected;let target=stamp(year,month,day,hour,minute),localStamp=(at)=>{let p=partsIn(at,fmt);return stamp(p.year,p.month,p.day,p.hour,p.minute)};if(localStamp(ts)===target)return ts;let probe=Math.min(ts,naive-offsetMsAt(naive,fmt));for(let i=0;i<=240;i++){if(localStamp(probe)>=target)return probe;probe+=60000}return ts}function stamp(year,month,day,hour,minute){return((year*100+month)*100+day)*1e4+hour*100+minute}function dayMatches(fields,wall){if(!fields.month.has(wall.month))return!1;let domOk=fields.day.has(wall.day),dowOk=fields.weekday.has(wall.weekday);if(fields.dayUnrestricted&&fields.weekdayUnrestricted)return!0;if(fields.dayUnrestricted)return dowOk;if(fields.weekdayUnrestricted)return domOk;return domOk||dowOk}function nextCronRun(expression,from=new Date,timeZone="UTC"){let fields=parseCron(expression);if(!fields)return null;let fmt=formatterFor(timeZone)??formatterFor("UTC");if(!fmt)return null;let hours=[...fields.hour].sort((a,b)=>a-b),minutes=[...fields.minute].sort((a,b)=>a-b),fromTs=from.getTime();if(!Number.isFinite(fromTs))return null;let cursor=partsIn(fromTs,fmt);for(let dayIndex=0;dayIndex<2929;dayIndex++){if(dayMatches(fields,cursor))for(let hour of hours)for(let minute of minutes){let ts=zonedWallTimeToInstant(cursor.year,cursor.month,cursor.day,hour,minute,fmt);if(ts>fromTs)return new Date(ts)}let nextDayUtc=Date.UTC(cursor.year,cursor.month-1,cursor.day+1,12,0,0),probe=new Date(nextDayUtc);cursor={year:probe.getUTCFullYear(),month:probe.getUTCMonth()+1,day:probe.getUTCDate(),hour:0,minute:0,weekday:probe.getUTCDay()}}return null}var MINUTE,HOUR,DAY,MONTH,WEEKDAY,MONTH_NAMES,DAY_NAMES,MACROS,formatterCache,WEEKDAY_INDEX;var init_cron=__esm(()=>{MINUTE={min:0,max:59},HOUR={min:0,max:23},DAY={min:1,max:31},MONTH={min:1,max:12},WEEKDAY={min:0,max:7};MONTH_NAMES=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"],DAY_NAMES=["sun","mon","tue","wed","thu","fri","sat"];MACROS={"@yearly":"0 0 1 1 *","@annually":"0 0 1 1 *","@monthly":"0 0 1 * *","@weekly":"0 0 * * 0","@daily":"0 0 * * *","@midnight":"0 0 * * *","@hourly":"0 * * * *"};formatterCache=new Map;WEEKDAY_INDEX={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6}});import{createCipheriv,createDecipheriv,randomBytes as randomBytes2,scryptSync}from"crypto";var MAGIC,IV_LEN=12,TAG_LEN=16,deriveKey=(secret)=>scryptSync(secret,"nucleus-backup-v1",32),encryptBackup=(plaintext,secret)=>{if(!secret)throw Error("backup encryption key is empty");let key=deriveKey(secret),iv=randomBytes2(IV_LEN),cipher=createCipheriv("aes-256-gcm",key,iv),ciphertext=Buffer.concat([cipher.update(plaintext,"utf-8"),cipher.final()]),tag=cipher.getAuthTag();return Buffer.concat([MAGIC,iv,tag,ciphertext])},isEncryptedBackup=(buf)=>buf.length>=MAGIC.length+IV_LEN+TAG_LEN&&buf.subarray(0,MAGIC.length).equals(MAGIC),decryptBackup=(blob,secret)=>{if(!secret)throw Error("backup encryption key is empty");if(!isEncryptedBackup(blob))throw Error("not an encrypted backup");let key=deriveKey(secret),iv=blob.subarray(MAGIC.length,MAGIC.length+IV_LEN),tag=blob.subarray(MAGIC.length+IV_LEN,MAGIC.length+IV_LEN+TAG_LEN),ciphertext=blob.subarray(MAGIC.length+IV_LEN+TAG_LEN),decipher=createDecipheriv("aes-256-gcm",key,iv);return decipher.setAuthTag(tag),Buffer.concat([decipher.update(ciphertext),decipher.final()]).toString("utf-8")};var init_encryption=__esm(()=>{MAGIC=Buffer.from("NXB1")});import{mkdir as mkdir3,readFile,stat as stat2,unlink as unlink3,writeFile}from"fs/promises";import{join as join4}from"path";import{eq as eq7,getTableColumns,sql as sql2}from"drizzle-orm";function nextHopMs(delayMs){if(!Number.isFinite(delayMs)||delayMs<=0)return 0;return Math.min(delayMs,MAX_TIMEOUT_MS)}function reviveRowTypes(table,rows){let columns;try{columns=getTableColumns(table)}catch{return rows}let dateColumns=Object.entries(columns).filter(([,col2])=>col2?.dataType==="date").map(([name])=>name);if(dateColumns.length===0)return rows;return rows.map((row)=>{let copy=null;for(let name of dateColumns){let value=row[name];if(typeof value!=="string")continue;let parsed=new Date(value);if(Number.isNaN(parsed.getTime()))continue;if(!copy)copy={...row};copy[name]=parsed}return copy??row})}function normalizeTableName(name){return name.replace(/[^a-z0-9]/gi,"").toLowerCase()}function selectBackupTables(tables,excludeTables){let excluded=new Set(excludeTables.map(normalizeTableName));return Object.keys(tables).filter((name)=>{if(excluded.has(normalizeTableName(name)))return!1;let val=tables[name];if(!val||typeof val!=="object")return!1;return Object.getOwnPropertySymbols(val).length>0})}class BackupService{db;logger;config;schemaTables;schemaName;backupLogsTable;cronTimer=null;schedulerActive=!1;lock;constructor(serviceConfig){this.db=serviceConfig.db,this.logger=serviceConfig.logger,this.config=serviceConfig.config,this.schemaTables=serviceConfig.schemaTables,this.schemaName=serviceConfig.schemaName,this.backupLogsTable=serviceConfig.backupLogsTable,this.lock=serviceConfig.lock}async createBackup(trigger="manual",performedBy,targetSchemaName,targetSchemaTables){let resolvedSchema=targetSchemaName||this.schemaName,resolvedTables=targetSchemaTables||this.schemaTables,now=new Date,backupId=crypto.randomUUID(),timestamp=now.toISOString().replace(/[:.]/g,"-"),backupName=`${resolvedSchema}_${timestamp}`,fileName=`${backupName}.json`,filePath=join4(this.config.storagePath,fileName),logRecord={id:backupId,backupName,fileName,schemaName:resolvedSchema,format:this.config.format,status:"running",trigger,sizeBytes:null,tableCount:null,rowCount:null,includedTables:[],excludedTables:this.config.excludeTables,errorMessage:null,startedAt:now.toISOString(),completedAt:null,performedBy:performedBy||null,cronExpression:trigger==="scheduled"?this.config.schedule.cron:null,retentionDays:this.config.schedule.retentionDays};await this.insertLogRecord(logRecord);try{await mkdir3(this.config.storagePath,{recursive:!0});let tableNames=this.getBackupTableNames(resolvedTables),backupData=[],totalRows=0;for(let tableName of tableNames){let table=resolvedTables[tableName];if(!table)continue;try{let rows=await this.db.select().from(table),columns=Object.keys(table).filter((k)=>!k.startsWith("_")&&typeof table[k]!=="function");backupData.push({tableName,columns,rows}),totalRows+=rows.length}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to export table ${tableName}: ${msg}`)}}let backupFile={manifest:{version:"1.0",createdAt:now.toISOString(),schemaName:resolvedSchema,format:this.config.format,tables:backupData.map((t)=>({tableName:t.tableName,rowCount:t.rows.length,columns:t.columns})),totalRows},data:backupData},jsonContent=JSON.stringify(backupFile,null,2);if(this.config.encryptionKey)await writeFile(filePath,encryptBackup(jsonContent,this.config.encryptionKey));else await writeFile(filePath,jsonContent,"utf-8");let fileStats=await stat2(filePath);return logRecord.status="completed",logRecord.completedAt=new Date().toISOString(),logRecord.tableCount=backupData.length,logRecord.rowCount=totalRows,logRecord.sizeBytes=fileStats.size,logRecord.includedTables=tableNames,await this.updateLogRecord(logRecord),this.logger.info("[Backup] Backup completed",{backupId,schemaName:resolvedSchema,tables:backupData.length,rows:totalRows,sizeBytes:fileStats.size}),await this.enforceMaxBackups(),logRecord}catch(err){let msg=err instanceof Error?err.message:String(err);return logRecord.status="failed",logRecord.errorMessage=msg,logRecord.completedAt=new Date().toISOString(),await this.updateLogRecord(logRecord),this.logger.error("[Backup] Backup failed",err,{backupId,schemaName:resolvedSchema}),logRecord}}async restoreFromBackup(backupId,performedBy,targetSchemaName,targetSchemaTables){if(!this.config.allowRestore)return{success:!1,message:"Restore is disabled in configuration"};let resolvedTables=targetSchemaTables||this.schemaTables,logRecord=await this.getLogRecord(backupId);if(!logRecord)return{success:!1,message:"Backup not found"};if(logRecord.status!=="completed")return{success:!1,message:`Cannot restore from backup with status: ${logRecord.status}`};let filePath=join4(this.config.storagePath,logRecord.fileName);try{let raw=await readFile(filePath),content;if(isEncryptedBackup(raw)){if(!this.config.encryptionKey)return{success:!1,message:"Backup is encrypted but no encryption key is configured"};content=decryptBackup(raw,this.config.encryptionKey)}else content=raw.toString("utf-8");let backupFile=JSON.parse(content);await this.createBackup("pre_restore",performedBy,targetSchemaName,targetSchemaTables);let tablesRestored=0,rowsRestored=0,ordered=backupFile.data.map((tableData)=>({tableData,table:resolvedTables[tableData.tableName]})).filter((entry)=>{if(!entry.table)return this.logger.warn(`[Backup] Skipping restore for ${entry.tableData.tableName}: table not found in schema`),!1;return!0});return await this.db.transaction(async(tx)=>{for(let{table}of[...ordered].reverse())await tx.delete(table);for(let{tableData,table}of ordered){if(tableData.rows.length===0)continue;let chunkSize=500;for(let i=0;i<tableData.rows.length;i+=chunkSize){let chunk=reviveRowTypes(table,tableData.rows.slice(i,i+chunkSize));await tx.insert(table).values(chunk)}tablesRestored++,rowsRestored+=tableData.rows.length}}),logRecord.status="restored",await this.updateLogRecord(logRecord),this.logger.info("[Backup] Restore completed",{backupId,tablesRestored,rowsRestored}),{success:!0,message:`Restored ${tablesRestored} tables with ${rowsRestored} rows`,tablesRestored,rowsRestored}}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.error("[Backup] Restore failed",err,{backupId}),{success:!1,message:`Restore failed: ${msg}`}}}async listBackups(){if(!this.backupLogsTable)return[];return await this.db.select().from(this.backupLogsTable).orderBy(sql2`created_at DESC`).limit(100)}async getBackupFilePath(backupId){let record=await this.getLogRecord(backupId);if(!record)return null;return join4(this.config.storagePath,record.fileName)}async deleteBackup(backupId){let record=await this.getLogRecord(backupId);if(!record)return!1;let filePath=join4(this.config.storagePath,record.fileName);try{await unlink3(filePath)}catch{}if(this.backupLogsTable)await this.db.delete(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId));return!0}startScheduler(){if(!this.config.schedule.enabled||!this.config.schedule.cron)return;if(!parseCron(this.config.schedule.cron))this.logger.error("[Backup] Cron expression not understood \u2014 falling back to the default",{cron:this.config.schedule.cron,fallback:DEFAULT_CRON,expected:'five fields ("0 2 * * *", "0 3 * * MON", "*/15 * * * *") or a macro (@daily, @weekly, @monthly)'}),this.config={...this.config,schedule:{...this.config.schedule,cron:DEFAULT_CRON}};this.logger.info("[Backup] Scheduler started",{cron:this.config.schedule.cron,timeZone:this.scheduleTimeZone(),retentionDays:this.config.schedule.retentionDays,replicaSafe:Boolean(this.lock)}),this.schedulerActive=!0,this.scheduleNextRun()}scheduleTimeZone(){return this.config.schedule.timeZone||"UTC"}scheduleNextRun(){if(!this.schedulerActive)return;let now=new Date,nextRun=nextCronRun(this.config.schedule.cron,now,this.scheduleTimeZone());if(!nextRun){this.logger.error("[Backup] Cron expression matches no future time \u2014 scheduler stopped",{cron:this.config.schedule.cron}),this.schedulerActive=!1;return}let delayMs=nextRun.getTime()-now.getTime();this.logger.debug?.("[Backup] Next scheduled backup",{at:nextRun.toISOString(),inMs:delayMs});let hop=nextHopMs(delayMs);this.cronTimer=setTimeout(async()=>{if(Date.now()<nextRun.getTime()){this.scheduleNextRun();return}try{if(await this.claimScheduledRun(nextRun))this.logger.info("[Backup] Scheduled backup starting..."),await this.createBackup("scheduled"),await this.cleanupExpiredBackups()}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.error("[Backup] Scheduled backup failed",{error:msg})}finally{this.scheduleNextRun()}},hop)}async claimScheduledRun(fireTime){if(!this.lock)return!0;let key=`nucleus:backup:schedule:${this.schemaName}:${fireTime.toISOString()}`;try{let result=await this.lock.acquireLock(key,3600);if(result.success&&result.data===!1)return this.logger.info("[Backup] Another replica owns this run \u2014 skipping",{fireTime:fireTime.toISOString()}),!1;return!0}catch(err){return this.logger.warn("[Backup] Lock unavailable \u2014 running anyway",{error:err instanceof Error?err.message:String(err)}),!0}}stopScheduler(){if(this.schedulerActive=!1,this.cronTimer)clearTimeout(this.cronTimer),this.cronTimer=null,this.logger.info("[Backup] Scheduler stopped")}getBackupTableNames(tables){return selectBackupTables(tables,this.config.excludeTables)}async insertLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.insert(this.backupLogsTable).values({id:record.id,backupName:record.backupName,fileName:record.fileName,schemaName:record.schemaName,format:record.format,status:record.status,trigger:record.trigger,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),excludedTables:JSON.stringify(record.excludedTables),errorMessage:record.errorMessage,startedAt:record.startedAt?new Date(record.startedAt):null,completedAt:record.completedAt?new Date(record.completedAt):null,performedBy:record.performedBy,cronExpression:record.cronExpression,retentionDays:record.retentionDays,createdAt:new Date,updatedAt:new Date})}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to insert backup log: ${msg}`)}}async updateLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.update(this.backupLogsTable).set({status:record.status,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),errorMessage:record.errorMessage,completedAt:record.completedAt?new Date(record.completedAt):null,updatedAt:new Date}).where(eq7(col(this.backupLogsTable,"id"),record.id))}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to update backup log: ${msg}`)}}async getLogRecord(backupId){if(!this.backupLogsTable)return null;return(await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId)).limit(1))[0]||null}async enforceMaxBackups(){if(!this.backupLogsTable)return;let allBackups=await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"status"),"completed")).orderBy(sql2`created_at DESC`);if(allBackups.length>this.config.maxBackups){let toDelete=allBackups.slice(this.config.maxBackups);for(let backup of toDelete){let b=backup;await this.deleteBackup(b.id)}this.logger.info("[Backup] Old backups cleaned up",{deleted:toDelete.length})}}async cleanupExpiredBackups(){if(!this.backupLogsTable||!this.config.schedule.retentionDays)return;let cutoff=new Date;cutoff.setDate(cutoff.getDate()-this.config.schedule.retentionDays);let{lt}=await import("drizzle-orm"),expired=await this.db.select().from(this.backupLogsTable).where(lt(col(this.backupLogsTable,"createdAt"),cutoff));for(let backup of expired){let b=backup;await this.deleteBackup(b.id)}if(expired.length>0)this.logger.info("[Backup] Expired backups cleaned up",{deleted:expired.length,retentionDays:this.config.schedule.retentionDays})}}var col=(table,name)=>table[name],MAX_TIMEOUT_MS=2147483647,DEFAULT_CRON="0 2 * * *";var init_BackupService=__esm(()=>{init_cron();init_encryption()});var init_Backup=__esm(()=>{init_BackupService()});function parseTimeToSeconds(time){let match=time.match(/^(\d+)(s|m|h|d)$/);if(!match||!match[1]||!match[2])return 300;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value;case"m":return value*60;case"h":return value*3600;case"d":return value*86400;default:return 300}}function generateSecureId(){let bytes=new Uint8Array(24);return crypto.getRandomValues(bytes),Array.from(bytes).map((b)=>b.toString(16).padStart(2,"0")).join("")}function hashAnswer(answer){let hasher=new Bun.CryptoHasher("sha256");return hasher.update(answer),hasher.digest("hex")}function timingSafeEqual(a,b){if(a.length!==b.length){let dummy=new Uint8Array(32);return crypto.getRandomValues(dummy),!1}let encoder=new TextEncoder,bufA=encoder.encode(a),bufB=encoder.encode(b),result=0;for(let i=0;i<bufA.length;i++)result|=(bufA[i]??0)^(bufB[i]??0);return result===0}function getSecureRandomInt(min,max){let range=max-min+1,bytesNeeded=Math.ceil(Math.log2(range)/8)||1,maxValue=256**bytesNeeded,limit=maxValue-maxValue%range,randomValue,bytes=new Uint8Array(bytesNeeded);do crypto.getRandomValues(bytes),randomValue=bytes.reduce((acc,byte,i)=>acc+byte*256**i,0);while(randomValue>=limit);return min+randomValue%range}function generateMathChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],{min,max}=config.mathRange,operations=["+","-","\xD7"],operation=operations[getSecureRandomInt(0,operations.length-1)],num1=getSecureRandomInt(min,max),num2=getSecureRandomInt(min,max),answer;switch(operation){case"+":answer=num1+num2;break;case"-":if(num1<num2)[num1,num2]=[num2,num1];answer=num1-num2;break;case"\xD7":num1=getSecureRandomInt(1,12),num2=getSecureRandomInt(1,12),answer=num1*num2;break;default:answer=num1+num2}return{question:`${num1} ${operation} ${num2} = ?`,answer:answer.toString()}}function generateTextChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],text="";for(let i=0;i<config.textLength;i++)text+=CHARACTERS.charAt(getSecureRandomInt(0,CHARACTERS.length-1));return{question:text,answer:text}}function generateImageChallenge(difficulty){let textChallenge=generateTextChallenge(difficulty),width=200,height=60,svgContent=generateCaptchaSVG(textChallenge.answer,200,60),imageData=`data:image/svg+xml;base64,${Buffer.from(svgContent).toString("base64")}`;return{question:"Enter the text shown in the image",answer:textChallenge.answer,imageData}}function getSecureFloat(){let bytes=new Uint32Array(1);return crypto.getRandomValues(bytes),(bytes[0]??0)/4294967295}function generateCaptchaSVG(text,width,height){let bgR=240+getSecureFloat()*15,bgG=240+getSecureFloat()*15,bgB=240+getSecureFloat()*15,bgColor=`rgb(${bgR}, ${bgG}, ${bgB})`,noiseLines="";for(let i=0;i<12;i++){let x1=getSecureFloat()*width,y1=getSecureFloat()*height,x2=getSecureFloat()*width,y2=getSecureFloat()*height,r=getSecureFloat()*100+100,g=getSecureFloat()*100+100,b=getSecureFloat()*100+100,strokeWidth=1+getSecureFloat()*2;noiseLines+=`<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="rgb(${r},${g},${b})" stroke-width="${strokeWidth}"/>`}let noiseCurves="";for(let i=0;i<4;i++){let startX2=getSecureFloat()*width,startY=getSecureFloat()*height,cp1X=getSecureFloat()*width,cp1Y=getSecureFloat()*height,cp2X=getSecureFloat()*width,cp2Y=getSecureFloat()*height,endX=getSecureFloat()*width,endY=getSecureFloat()*height,r=getSecureFloat()*80+80,g=getSecureFloat()*80+80,b=getSecureFloat()*80+80;noiseCurves+=`<path d="M${startX2},${startY} C${cp1X},${cp1Y} ${cp2X},${cp2Y} ${endX},${endY}" stroke="rgb(${r},${g},${b})" stroke-width="2" fill="none"/>`}let noiseDots="";for(let i=0;i<80;i++){let x=getSecureFloat()*width,y=getSecureFloat()*height,r=getSecureFloat()*150+50,g=getSecureFloat()*150+50,b=getSecureFloat()*150+50,radius=getSecureFloat()*3+1;noiseDots+=`<circle cx="${x}" cy="${y}" r="${radius}" fill="rgb(${r},${g},${b})"/>`}let textElements="",charWidth=width/(text.length+2),startX=charWidth;for(let i=0;i<text.length;i++){let x=startX+i*charWidth+(getSecureFloat()-0.5)*15,y=height/2+8+(getSecureFloat()-0.5)*12,rotation=(getSecureFloat()-0.5)*40,fontSize=22+getSecureFloat()*10,r=getSecureFloat()*80,g=getSecureFloat()*80,b=getSecureFloat()*80,skewX=(getSecureFloat()-0.5)*15,scaleY=0.9+getSecureFloat()*0.3;textElements+=`<text x="${x}" y="${y}" font-family="Arial, Helvetica, sans-serif" font-size="${fontSize}" font-weight="bold" fill="rgb(${r},${g},${b})" transform="rotate(${rotation}, ${x}, ${y}) skewX(${skewX}) scale(1, ${scaleY})" style="font-style: ${getSecureFloat()>0.5?"italic":"normal"}">${text[i]}</text>`}let overlayLines="";for(let i=0;i<3;i++){let y=10+getSecureFloat()*(height-20),r=getSecureFloat()*60+60,g=getSecureFloat()*60+60,b=getSecureFloat()*60+60;overlayLines+=`<line x1="0" y1="${y}" x2="${width}" y2="${y+(getSecureFloat()-0.5)*20}" stroke="rgb(${r},${g},${b})" stroke-width="1.5"/>`}return`<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">
 		<defs>
 			<filter id="noise" x="0%" y="0%" width="100%" height="100%">
 				<feTurbulence type="fractalNoise" baseFrequency="0.04" numOctaves="2" result="noise"/>
@@ -551,7 +551,7 @@ ${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algor
       where table_schema = ${schemaName}
         and table_name = ${tableName}
         and column_name = 'expires_at'
-    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql15.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function positive(value2,fallback){return typeof value2==="number"&&Number.isFinite(value2)&&value2>0?value2:fallback}function resolveFetchLimits(options={}){let retries=typeof options.retries==="number"&&Number.isFinite(options.retries)?Math.min(1,Math.max(0,Math.floor(options.retries))):DISCOVERY_FETCH_DEFAULTS.retries,retryDelayMs=typeof options.retryDelayMs==="number"&&Number.isFinite(options.retryDelayMs)&&options.retryDelayMs>=0?options.retryDelayMs:DISCOVERY_FETCH_DEFAULTS.retryDelayMs;return{timeoutMs:positive(options.timeoutMs,DISCOVERY_FETCH_DEFAULTS.timeoutMs),maxBytes:positive(options.maxBytes,DISCOVERY_FETCH_DEFAULTS.maxBytes),retries,retryDelayMs,hookTimeoutMs:positive(options.hookTimeoutMs,DISCOVERY_FETCH_DEFAULTS.hookTimeoutMs)}}function withDeadline2(work,ms,onTimeout,onExpire){return new Promise((resolve2,reject)=>{let timer=setTimeout(()=>{onExpire?.(),reject(onTimeout())},ms);work.then((value2)=>{clearTimeout(timer),resolve2(value2)},(error3)=>{clearTimeout(timer),reject(error3)})})}function discoveryUrl(baseUrl,openapiPath){let joined=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,parsed;try{parsed=new URL(joined)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined}`,!1)}if(parsed.protocol!=="http:"&&parsed.protocol!=="https:")throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined} (only http and https are fetched)`,!1);return joined}async function discard2(response){await response.body?.cancel().catch(()=>{return})}async function readCapped(response,maxBytes,url){let tooLarge=()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI document exceeds ${maxBytes} bytes for ${url}`,!1),advertised=Number(response.headers.get("content-length"));if(Number.isFinite(advertised)&&advertised>maxBytes)throw await discard2(response),tooLarge();let body=response.body;if(!body)return"";let reader=body.getReader(),chunks=[],size=0;while(!0){let part=await reader.read();if(part.done)break;if(size+=part.value.byteLength,size>maxBytes)throw await reader.cancel().catch(()=>{return}),tooLarge();chunks.push(part.value)}return new TextDecoder().decode(Buffer.concat(chunks,size))}async function attempt(url,fetchImpl,limits){let controller=new AbortController,work=(async()=>{let response;try{response=await fetchImpl(url,{headers:{accept:"application/json"},redirect:"manual",signal:controller.signal})}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed for ${url}: ${reason}`,!0)}if(response.type==="opaqueredirect"||REDIRECT_STATUSES.has(response.status))throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch refused a redirect (${response.status}) for ${url}`,!1);if(!response.ok)throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed ${response.status} for ${url}`,response.status===429||response.status>=500);let text3;try{text3=await readCapped(response,limits.maxBytes,url)}catch(error3){if(error3 instanceof DiscoveryFetchError)throw error3;let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI body read failed for ${url}: ${reason}`,!0)}try{return JSON.parse(text3)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_document (not JSON) for ${url}`,!1)}})();try{return await withDeadline2(work,limits.timeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch timed out after ${limits.timeoutMs}ms for ${url}`,!0),()=>controller.abort())}finally{controller.abort()}}async function fetchDiscoveryJson(url,fetchImpl,options={}){let limits=resolveFetchLimits(options),lastError;for(let tried=0;tried<=limits.retries;tried++){if(tried>0)await Bun.sleep(limits.retryDelayMs);try{return await attempt(url,fetchImpl,limits)}catch(error3){if(lastError=error3,!(error3 instanceof DiscoveryFetchError&&error3.retryable))throw error3}}throw lastError}var DISCOVERY_FETCH_DEFAULTS,DiscoveryFetchError,REDIRECT_STATUSES;var init_fetch2=__esm(()=>{DISCOVERY_FETCH_DEFAULTS=Object.freeze({timeoutMs:5000,maxBytes:16777216,retries:1,retryDelayMs:250,hookTimeoutMs:60000});DiscoveryFetchError=class DiscoveryFetchError extends Error{retryable;constructor(message,retryable){super(message);this.name="DiscoveryFetchError",this.retryable=retryable}};REDIRECT_STATUSES=new Set([301,302,303,307,308])});function isDiscoveryHooks(value2){return typeof value2==="object"&&value2!==null&&"captureConfig"in value2&&typeof value2.captureConfig==="function"&&"fetchDocument"in value2&&typeof value2.fetchDocument==="function"&&"run"in value2&&typeof value2.run==="function"}function configureAuthorizationDiscovery(hooks){if(!isDiscoveryHooks(hooks))throw TypeError("configureAuthorizationDiscovery: captureConfig, fetchDocument and run must all be functions");return installed.set(hooks),()=>{if(installed.get()===hooks)installed.set(void 0)}}function authorizationDiscoveryHooks(){return installed.get()}function hostDiscoveryConfig(config){let view={};if(config.enabled!==void 0)view.enabled=config.enabled;if(config.runOnBoot!==void 0)view.runOnBoot=config.runOnBoot;if(config.services)view.services=config.services.map((service)=>{let copy2={id:service.id,baseUrl:service.baseUrl};if(service.openapi!==void 0)copy2.openapi=service.openapi;if(service.exclude)copy2.exclude=[...service.exclude];return copy2});return view}function hostRunCeilingMs(serviceCount,hookTimeoutMs){return(Math.max(0,serviceCount)+1)*hookTimeoutMs}function isDiscoveryResult(value2){return typeof value2==="object"&&value2!==null&&"services"in value2&&Array.isArray(value2.services)}function isThenable(value2){return typeof value2==="object"&&value2!==null&&"then"in value2&&typeof value2.then==="function"}function warnCaptureFailed(logger2,error3){logger2.warn("[Discovery] Host captureConfig hook failed",{error:error3 instanceof Error?error3.message:String(error3)})}function captureDiscoveryConfig(config,logger2){let hooks=authorizationDiscoveryHooks();if(!hooks)return;let returned;try{returned=hooks.captureConfig(hostDiscoveryConfig(config))}catch(error3){warnCaptureFailed(logger2,error3);return}if(isThenable(returned))Promise.resolve(returned).then(void 0,(error3)=>warnCaptureFailed(logger2,error3))}var installed;var init_hooks=__esm(()=>{installed=processRegistry("nucleus-core-ts.authorizationDiscovery.hooks.v1",isDiscoveryHooks)});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}function isRecord2(value2){return typeof value2==="object"&&value2!==null&&!Array.isArray(value2)}function toOperation(value2){let operation={};if(Array.isArray(value2.tags))operation.tags=value2.tags.filter((tag)=>typeof tag==="string");if(typeof value2.operationId==="string")operation.operationId=value2.operationId;if(typeof value2.summary==="string")operation.summary=value2.summary;if(typeof value2.description==="string")operation.description=value2.description;return operation}function toOpenApiDoc(value2){if(!isRecord2(value2))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (not a JSON object)",!1);if(value2.paths===void 0)return{};if(!isRecord2(value2.paths))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (paths is not an object)",!1);return{paths:Object.fromEntries(Object.entries(value2.paths).flatMap(([path7,item])=>isRecord2(item)?[[path7,operationsOf(item)]]:[]))}}function operationsOf(item){return Object.fromEntries(Object.entries(item).flatMap(([method,operation])=>isRecord2(operation)?[[method,toOperation(operation)]]:[]))}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(hooks){let{hookTimeoutMs}=resolveFetchLimits(options),document2=await withDeadline2(Promise.resolve().then(()=>hooks.fetchDocument(baseUrl,openapiPath,fetchImpl)),hookTimeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: host fetchDocument hook timed out after ${hookTimeoutMs}ms`,!0));return toOpenApiDoc(document2)}let url=discoveryUrl(baseUrl,openapiPath);return toOpenApiDoc(await fetchDiscoveryJson(url,fetchImpl,options))}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{init_fetch2();init_hooks();HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest,EMPTY_CATALOG_ERROR:()=>EMPTY_CATALOG_ERROR});import{eq as eq72,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){if(specs.length===0)throw Error(EMPTY_CATALOG_ERROR);let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq72(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq72(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(!hooks)return reconcileServices(db,schemaTables,config,logger2,fetchImpl,options);let services=config.services??[],execute=(serviceIds)=>reconcileServices(db,schemaTables,serviceIds?{...config,services:services.filter((svc)=>serviceIds.includes(svc.id))}:config,logger2,fetchImpl,options),ceilingMs=hostRunCeilingMs(services.length,resolveFetchLimits(options).hookTimeoutMs);logger2.info("[Discovery] Running through the host discovery hooks",{services:services.map((svc)=>svc.id),ceilingMs});let returned=await withDeadline2(Promise.resolve().then(()=>hooks.run(hostDiscoveryConfig(config),execute)),ceilingMs,()=>Error(`endpointDiscovery: host run hook timed out after ${ceilingMs}ms`));if(!isDiscoveryResult(returned))throw Error("endpointDiscovery: host run hook returned no DiscoveryResult");return returned}async function reconcileServices(db,schemaTables,config,logger2,fetchImpl,options){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl,options),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var EMPTY_CATALOG_ERROR="endpointDiscovery: empty_catalog";var init_seed=__esm(()=>{init_fetch2();init_hooks();init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord3(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord3(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord3(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord3(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord3(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});function covers(prefix,claim){return claim===prefix||claim.startsWith(`${prefix}.`)}function dotPrefixes(action,maxLength=action.length){let prefixes=[];for(let dot=action.indexOf(".");dot>=0&&dot<=maxLength;)prefixes.push(action.slice(0,dot)),dot=action.indexOf(".",dot+1);if(action.length<=maxLength)prefixes.push(action);return prefixes}function roleGrants(list2){let grants=new Set(list2.filter((grant)=>grant!=="")),above=new Set;for(let grant of grants){if(grant.endsWith(".*"))continue;for(let prefix of dotPrefixes(grant).slice(0,-1))above.add(prefix)}return{grants,above}}function catalogActions(catalog){return[...new Set(catalog)].filter((action)=>action!==""&&!action.endsWith(".*")).sort()}function family(guard4){if(guard4.valueType!=="int"||typeof guard4.threshold!=="number")return null;if(!Number.isFinite(guard4.threshold))return null;if(guard4.op==="gt"||guard4.op==="gte")return"upper";if(guard4.op==="lt"||guard4.op==="lte")return"lower";return null}function permissiveness(guard4){let threshold=typeof guard4.threshold==="number"?guard4.threshold:0;if(guard4.op==="gt"||guard4.op==="gte")return[threshold,guard4.op==="gt"?1:0];return[-threshold,guard4.op==="lt"?1:0]}function compare2(a,b){return a[0]!==b[0]?a[0]-b[0]:a[1]-b[1]}function keptCover(node,actions,dropped,catalog){let droppedHere=actions.filter((action)=>dropped.has(action)).length;if(droppedHere===0)return[node];if(droppedHere===actions.length)return[];if(catalog.has(node)&&!dropped.has(node))return[node];let children=new Map;for(let action of actions){if(action===node)continue;let rest3=action.slice(node.length+1),dot=rest3.indexOf("."),child=`${node}.${dot>=0?rest3.slice(0,dot):rest3}`,under=children.get(child);if(under)under.push(action);else children.set(child,[action])}return[...children].flatMap(([child,under])=>keptCover(child,under,dropped,catalog))}function decideAction(action,guards,roles,held,longestHeld){let prefixes=dotPrefixes(action,longestHeld),granting=new Set,partial3=new Set;for(let[roleId,role]of roles)if(prefixes.some((prefix)=>role.grants.has(prefix)))granting.add(roleId);else if(role.above.has(action))partial3.add(roleId);let heldPrefix=prefixes.find((prefix)=>held.has(prefix)),onAction=guards.map((guard4,index)=>({guard:guard4,index})).filter(({guard:guard4})=>granting.has(guard4.roleId)&&guard4.invalidates.some((entry)=>covers(entry,action))),guarded=new Set(onAction.map(({guard:guard4})=>guard4.roleId)),unlimited=[...granting].some((roleId)=>!guarded.has(roleId)),winners=new Map;if(unlimited)return{granting,partial:partial3,heldPrefix,unlimited,winners};let strictest=new Map;for(let entry of onAction){let kind=family(entry.guard);if(!kind)continue;let group=`${kind}:${entry.guard.key}`,byRole=strictest.get(group)??new Map;strictest.set(group,byRole);let known=byRole.get(entry.guard.roleId);if(!known||compare2(permissiveness(entry.guard),permissiveness(known.guard))<0)byRole.set(entry.guard.roleId,entry)}for(let[group,byRole]of strictest){let best;for(let candidate of byRole.values()){let order=best?compare2(permissiveness(candidate.guard),permissiveness(best.guard)):1;if(!best||order>0||order===0&&candidate.index<best.index)best=candidate}if(best)winners.set(group,best.guard.roleId)}return{granting,partial:partial3,heldPrefix,unlimited,winners}}function stillLimits(guard4,decision){if(!decision.granting.has(guard4.roleId)){if(!decision.partial.has(guard4.roleId))return!0;return decision.granting.size===0&&decision.heldPrefix!==void 0}if(decision.unlimited)return!1;let kind=family(guard4);if(!kind)return!0;return decision.winners.get(`${kind}:${guard4.key}`)===guard4.roleId}function suppressEntries(invalidates,limited,decide){let suppress=new Set(invalidates);for(let action of limited){let claim=decide(action).heldPrefix;if(claim!==void 0&&!dotPrefixes(claim).some((prefix)=>suppress.has(prefix)))suppress.add(claim)}return[...suppress]}function mostGenerousTargets(input){let{guards}=input,roles=new Map;for(let[roleId,grants]of input.grantsByRole)roles.set(roleId,roleGrants(grants));let held=new Set([...roles.values()].flatMap(({grants})=>[...grants]));for(let claim of input.heldWithoutGrant??[])if(claim!=="")held.add(claim);let heldList=[...held],longestHeld=heldList.reduce((longest,claim)=>Math.max(longest,claim.length),0),reached=(entry)=>heldList.some((claim)=>covers(entry,claim)||covers(claim,entry)),actions=catalogActions(input.catalog),actionSet=new Set(actions),decisions=new Map,decide=(action)=>{let known=decisions.get(action);if(known)return known;let decision=decideAction(action,guards,roles,held,longestHeld);return decisions.set(action,decision),decision};return guards.map((guard4)=>{let invalidates=new Set,limited=new Set;for(let target2 of guard4.invalidates){let under=actions.filter((action)=>covers(target2,action)),targetActions=under.length>0?under:[target2],dropped=new Set(targetActions.filter((action)=>!stillLimits(guard4,decide(action))));for(let entry of keptCover(target2,targetActions,dropped,actionSet))if(entry===target2||reached(entry))invalidates.add(entry);for(let action of targetActions)if(!dropped.has(action)&&actionSet.has(action))limited.add(action)}return{invalidates:[...invalidates],suppress:suppressEntries([...invalidates],[...limited],decide)}})}async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map,grantActionByClaimId=new Map,inactiveActionByClaimId=new Map;for(let c of claimRows){let action=String(c.action??""),policy=parseGuardPolicy(c.policy);if(c.isActive===!1){if(action)inactiveActionByClaimId.set(String(c.id),action)}else if(policy)guardByClaimId.set(String(c.id),{action,policy});else if(action)grantActionByClaimId.set(String(c.id),action)}if(guardByClaimId.size===0)return EMPTY;let mine=(await db.select().from(userRolesTable)).filter((r)=>String(r.userId??r.user_id)===userId),roleIds=new Set(mine.filter((r)=>r.isActive!==!1).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let assignedRoleIds=new Set(mine.map((r)=>String(r.roleId??r.role_id))),rcRows=(await db.select().from(roleClaimsTable)).filter((rc)=>assignedRoleIds.has(String(rc.roleId??rc.role_id))).map((row)=>({row,key:assignmentKey(row)})).sort((a,b)=>a.key<b.key?-1:a.key>b.key?1:0).map(({row})=>row),assignments=[],grantsByRole=new Map,heldWithoutGrant=[];for(let rc of rcRows){let roleId=String(rc.roleId??rc.role_id),claimId=String(rc.claimId??rc.claim_id),inactive=inactiveActionByClaimId.get(claimId);if(inactive){heldWithoutGrant.push(inactive);continue}let grant=grantActionByClaimId.get(claimId);if(rc.isActive===!1||!roleIds.has(roleId)){let action=grant??guardByClaimId.get(claimId)?.action;if(action)heldWithoutGrant.push(action);continue}if(grant){if(!countsAsGrant(rc.scope)){heldWithoutGrant.push(grant);continue}let held=grantsByRole.get(roleId);if(held)held.push(grant);else grantsByRole.set(roleId,[grant]);continue}let guard4=guardByClaimId.get(claimId);if(!guard4)continue;if(guard4.action)heldWithoutGrant.push(guard4.action);let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;assignments.push({roleId,action:guard4.action,policy:guard4.policy,condition})}if(assignments.length===0)return EMPTY;let keyOf=(a)=>resolveGuardKey(a.policy.keyTemplate,{userId,tenant:ctx.tenant}),targets=mostGenerousTargets({guards:assignments.map((a)=>({roleId:a.roleId,key:keyOf(a),valueType:a.policy.valueType,op:a.condition.op,threshold:a.condition.value,invalidates:a.condition.invalidates})),grantsByRole,heldWithoutGrant,catalog:[...grantActionByClaimId.values()]}),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let[index,assignment]of assignments.entries()){let invalidates=targets[index]?.invalidates??[],suppress=targets[index]?.suppress??invalidates;if(invalidates.length===0&&assignment.condition.invalidates.length>0)continue;let{policy,condition}=assignment,key2=keyOf(assignment),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,policy.valueType,condition),current=normalizeCurrent(value2,policy.valueType);if(guards.push({action:assignment.action,key:key2,valueType:policy.valueType,op:condition.op,threshold:condition.value,current,invalidates,holds}),holds&&suppress.length>0){for(let a of suppress)suppressed.add(a);firedGuards.push({action:assignment.action,key:key2,invalidates:suppress})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function countsAsGrant(scope){return!(typeof scope==="string"&&scope.includes("="))}function assignmentKey(row){return[row.roleId??row.role_id,row.claimId??row.claim_id,row.scope,row.id].map((value2)=>value2==null?"":typeof value2==="string"?value2:JSON.stringify(value2)).join("\x00")}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq73}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq73(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq73(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and34,eq as eq74,isNull as isNull9}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and34(eq74(col17(table,"challenge"),challenge),eq74(col17(table,"challengeType"),challengeType),isNull9(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq74(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq74(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq74(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard3(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard3(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard3,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg;captureDiscoveryConfig(discovery,logger2);let token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_hooks();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{batch,createStore}from"h-state";import{useEffectEvent}from"react";function createInitialState(endpoints){let state={};for(let key of Object.keys(endpoints))state[key]={isPending:!1,data:null,error:null,code:null};return state}function createActionsFacade(endpoints,buildAction){let cache=new Map;return new Proxy({},{get(_target,property){if(typeof property!=="string")return;if(!Object.hasOwn(endpoints,property))return;if(cache.has(property))return cache.get(property);let action=buildAction(property);return cache.set(property,action),action},has(_target,property){return typeof property==="string"&&Object.hasOwn(endpoints,property)},ownKeys(){return Object.keys(endpoints)},getOwnPropertyDescriptor(){return{enumerable:!0,configurable:!0}}})}function applyResponse(response,fallbackError){if(response.isSuccess&&response.data!==void 0)return{data:response.data,error:null,code:response.code??null};return{data:null,error:response.errors??fallbackError??null,code:response.code??null}}function createApiHook(endpoints,factory){let{useStore}=createStore(createInitialState(endpoints),{_callEndpoint:(store)=>async(endpointKey,options)=>{if(!store[endpointKey])return;batch(()=>{store[endpointKey].isPending=!0,store[endpointKey].error=null});try{let response=await factory(endpointKey,options.payload);if(batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].code=response.code??null;let applied=applyResponse(response);store[endpointKey].data=applied.data,store[endpointKey].error=applied.error}),response.isSuccess)options.onAfterHandle?.(response.data??response);else options.onErrorHandle?.(response.errors??{message:"Request failed"},response.code,response.requestId)}catch(err){batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].data=null,store[endpointKey].error={message:err instanceof Error?err.message:"Unknown error"}}),options.onErrorHandle?.({message:err instanceof Error?err.message:"Unknown error"},null)}}});return function(){let store=useStore(),callEndpoint=useEffectEvent((endpointKey,options)=>{store._callEndpoint(endpointKey,options)});return createActionsFacade(endpoints,(property)=>{let key=property;return{state:store[key],start:(options)=>{callEndpoint(key,options)}}})}}var system_tables_default={$schema:"../schemas/nucleus.tables.schema.json",tables:[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}]};function deriveAuthEndpoints(configs){let out={};for(let config of Object.values(configs)){let subs=config.subEndpoints??[{key:config.key,method:config.method,suffix:""}];for(let sub of subs){let base=sub.defaultRoute??config.defaultRoute,entry={method:sub.method??config.method,path:`${base}${sub.suffix??""}`},isPublic=sub.isPublic??config.defaultIsPublic;if(isPublic!==void 0)entry.isPublic=isPublic;entry._payload=sub._payload??config._payload,entry._success=sub._success??config._success,entry._error=sub._error??config._error,out[sub.key]=entry}}return out}var AUTH_ENDPOINT_CONFIGS={login:{key:"LOGIN",method:"POST",defaultRoute:"/auth/login",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},register:{key:"REGISTER",method:"POST",defaultRoute:"/auth/register",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},logout:{key:"LOGOUT",method:"POST",defaultRoute:"/auth/logout",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},refresh:{key:"REFRESH",method:"POST",defaultRoute:"/auth/refresh",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},me:{key:"ME",method:"GET",defaultRoute:"/auth/me",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordChange:{key:"PASSWORD_CHANGE",method:"POST",defaultRoute:"/auth/password-change",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordSet:{key:"PASSWORD_SET",method:"POST",defaultRoute:"/auth/password-set",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordReset:{key:"PASSWORD_RESET_REQUEST",method:"POST",defaultRoute:"/auth/password-reset",defaultIsPublic:!0,subEndpoints:[{key:"PASSWORD_RESET_REQUEST",method:"POST",suffix:"/request",_payload:void 0,_success:void 0,_error:void 0},{key:"PASSWORD_RESET_CONFIRM",method:"POST",suffix:"/confirm",_payload:void 0,_success:void 0,_error:void 0}]},sessions:{key:"SESSIONS",method:"GET",defaultRoute:"/auth/sessions",defaultIsPublic:!1,subEndpoints:[{key:"SESSIONS",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_CURRENT",method:"GET",suffix:"/current",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_STATS",method:"GET",suffix:"/stats",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_PENDING",method:"GET",suffix:"/pending",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE",method:"DELETE",suffix:"/:sessionId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE_ALL",method:"DELETE",suffix:"/all",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_LIST",method:"GET",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_REVOKE",method:"DELETE",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_APPROVE",method:"POST",suffix:"/approve",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REJECT",method:"POST",suffix:"/reject",_payload:void 0,_success:void 0,_error:void 0}]},magicLink:{key:"MAGIC_LINK",method:"POST",defaultRoute:"/auth/magic-link",defaultIsPublic:!0,subEndpoints:[{key:"MAGIC_LINK",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"MAGIC_LINK_VERIFY",method:"GET",suffix:"/verify",routeKey:"verifyRoute",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},invite:{key:"INVITE",method:"POST",defaultRoute:"/auth/invite",defaultIsPublic:!1,subEndpoints:[{key:"INVITE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"INVITE_VERIFY",method:"POST",suffix:"/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},emailVerification:{key:"VERIFY_EMAIL",method:"GET",defaultRoute:"/verify-email",defaultIsPublic:!0,subEndpoints:[{key:"VERIFY_EMAIL",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"RESEND_VERIFICATION",method:"POST",suffix:"",routeKey:"resendRoute",defaultRoute:"/resend-verification",_payload:void 0,_success:void 0,_error:void 0}]},captcha:{key:"CAPTCHA",method:"GET",defaultRoute:"/auth/captcha",defaultIsPublic:!0,subEndpoints:[{key:"CAPTCHA_GENERATE",method:"GET",suffix:"/generate",_payload:void 0,_success:void 0,_error:void 0},{key:"CAPTCHA_VALIDATE",method:"POST",suffix:"/validate",_payload:void 0,_success:void 0,_error:void 0}]},oauth:{key:"OAUTH_PROVIDERS",method:"GET",defaultRoute:"/auth/oauth",defaultIsPublic:!0,subEndpoints:[{key:"OAUTH_PROVIDERS",method:"GET",suffix:"/providers",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_REDIRECT",method:"GET",suffix:"/:provider",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_ACCOUNTS",method:"GET",suffix:"/accounts",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_UNLINK",method:"DELETE",suffix:"/unlink/:provider",_payload:void 0,_success:void 0,_error:void 0}]},webauthn:{key:"WEBAUTHN",method:"POST",defaultRoute:"/auth/webauthn",defaultIsPublic:!1,subEndpoints:[{key:"WEBAUTHN_REGISTER_OPTIONS",method:"POST",suffix:"/register/options",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REGISTER_VERIFY",method:"POST",suffix:"/register/verify",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_OPTIONS",method:"POST",suffix:"/authenticate/options",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_VERIFY",method:"POST",suffix:"/authenticate/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_LIST",method:"GET",suffix:"/credentials",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REVOKE",method:"DELETE",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_RENAME",method:"PATCH",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0}]},apiKeys:{key:"API_KEYS",method:"GET",defaultRoute:"/auth/api-keys",defaultIsPublic:!1,subEndpoints:[{key:"API_KEYS_CREATE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_LIST",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_DETAIL",method:"GET",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_UPDATE",method:"PATCH",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_REVOKE",method:"DELETE",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0}]}},ADMIN_ENDPOINTS={ADMIN_IMPERSONATE:{method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_IMPERSONATE_STOP:{method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CHANGE_USER_ID:{method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_USER:{method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_HARD_DELETE_USER:{method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_LOCK_USER:{method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UNLOCK_USER:{method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_MARK_EMAIL_VERIFIED:{method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},UNPUBLISHED_AUTH_KEYS=[];function publishedAuthEndpoints(){let all=deriveAuthEndpoints(AUTH_ENDPOINT_CONFIGS),excluded=new Set(UNPUBLISHED_AUTH_KEYS);return Object.fromEntries(Object.entries(all).filter(([key])=>!excluded.has(key)))}var AUTH_ENDPOINTS={...publishedAuthEndpoints(),...ADMIN_ENDPOINTS},CONFIG_ENDPOINTS={CONFIG_GET:{method:"GET",path:"/nucleus/config",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTIONS:{method:"GET",path:"/nucleus/config/sections",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_GET:{method:"GET",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_UPDATE:{method:"PATCH",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_ENV:{method:"GET",path:"/nucleus/config/env",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_GET:{method:"GET",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_CLEAR:{method:"DELETE",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_RESTART:{method:"POST",path:"/nucleus/config/restart",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},VERIFICATION_ENDPOINTS={VERIFICATION_STATUS:{method:"GET",path:"/verification/status/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_DECIDE:{method:"POST",path:"/verification/decide/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_CANCEL:{method:"POST",path:"/verification/:entity_name/:entity_id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_PENDING:{method:"GET",path:"/verification/pending",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_HISTORY:{method:"GET",path:"/verification/history/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START:{method:"POST",path:"/verification/start",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START_FOR_ENTITY:{method:"POST",path:"/verification/start-for-entity",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_ENTITY_STATUSES:{method:"GET",path:"/verification/entity-statuses/:entity_name",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_LIST:{method:"GET",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_GET:{method:"GET",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_SAVE:{method:"POST",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_FEASIBILITY:{method:"POST",path:"/verification/flows/feasibility",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_PUBLISH:{method:"POST",path:"/verification/flows/:flow_id/publish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_UNPUBLISH:{method:"POST",path:"/verification/flows/:flow_id/unpublish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_DELETE:{method:"DELETE",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_LIST:{method:"GET",path:"/notifications",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_UNSEEN_COUNT:{method:"GET",path:"/notifications/unseen-count",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_SEEN:{method:"POST",path:"/notifications/:notification_id/seen",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_ALL_SEEN:{method:"POST",path:"/notifications/seen-all",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},CHAT_ENDPOINTS={CHAT_LIST_CONVERSATIONS:{method:"GET",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_CREATE_CONVERSATION:{method:"POST",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_CONVERSATION:{method:"GET",path:"/chat/conversations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_MESSAGES:{method:"GET",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_SEND_MESSAGE:{method:"POST",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_MARK_READ:{method:"POST",path:"/chat/conversations/:id/read",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_TYPING:{method:"POST",path:"/chat/conversations/:id/typing",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_ADD_PARTICIPANTS:{method:"POST",path:"/chat/conversations/:id/participants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_REMOVE_PARTICIPANT:{method:"DELETE",path:"/chat/conversations/:id/participants/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_EDIT_MESSAGE:{method:"PATCH",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_DELETE_MESSAGE:{method:"DELETE",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MONITORING_ENDPOINTS={MONITORING_HEALTH_CHECK:{method:"GET",path:"/monitoring/health",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_SETTINGS:{method:"GET",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_CHANGE_SETTINGS:{method:"PATCH",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_LOGS:{method:"GET",path:"/monitoring/logs",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},PAYMENT_ENDPOINTS={PAYMENT_INITIALIZE:{method:"POST",path:"/payments/initialize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTIONS:{method:"GET",path:"/payments/transactions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTION_DETAIL:{method:"GET",path:"/payments/transactions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_BIN_QUERY:{method:"POST",path:"/payments/bin-query",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DETAIL:{method:"POST",path:"/payments/payment-detail",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REFUND:{method:"POST",path:"/payments/refund",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SAVE_CARD:{method:"POST",path:"/payments/cards/save",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CARDS:{method:"GET",path:"/payments/cards",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CARD:{method:"DELETE",path:"/payments/cards/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SYNC_CARDS:{method:"POST",path:"/payments/cards/sync",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REGISTER_SUB_MERCHANT:{method:"POST",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUB_MERCHANT:{method:"PUT",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUB_MERCHANTS:{method:"GET",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUB_MERCHANT:{method:"GET",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SPLITS:{method:"GET",path:"/payments/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_APPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DISAPPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/disapprove",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRODUCT:{method:"POST",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRODUCT:{method:"PUT",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRODUCTS:{method:"GET",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRODUCT:{method:"GET",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRODUCT:{method:"DELETE",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRICE:{method:"POST",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRICE:{method:"PUT",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRICES:{method:"GET",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRICE:{method:"GET",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRICE:{method:"DELETE",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_CUSTOMER:{method:"POST",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_CUSTOMER:{method:"PUT",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CUSTOMERS:{method:"GET",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_CUSTOMER:{method:"GET",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CUSTOMER:{method:"DELETE",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUBSCRIPTION:{method:"PUT",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUBSCRIPTIONS:{method:"GET",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUBSCRIPTION:{method:"GET",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REPORT_USAGE:{method:"POST",path:"/payments/usage-records",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_USAGE_SUMMARIES:{method:"GET",path:"/payments/usage-records/:subscriptionItemId/summaries",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_INVOICE:{method:"POST",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_FINALIZE_INVOICE:{method:"POST",path:"/payments/invoices/:id/finalize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SEND_INVOICE:{method:"POST",path:"/payments/invoices/:id/send",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_VOID_INVOICE:{method:"POST",path:"/payments/invoices/:id/void",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_PAY_INVOICE:{method:"POST",path:"/payments/invoices/:id/pay",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_INVOICES:{method:"GET",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_INVOICE:{method:"GET",path:"/payments/invoices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_BALANCE:{method:"GET",path:"/payments/balance",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PAYOUT:{method:"POST",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PAYOUTS:{method:"GET",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PAYOUT:{method:"GET",path:"/payments/payouts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_PAYOUT:{method:"POST",path:"/payments/payouts/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_TRANSFER:{method:"POST",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_TRANSFERS:{method:"GET",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},TENANT_ENDPOINTS={TENANT_CHECK_SUBDOMAIN:{method:"GET",path:"/tenants/check-subdomain/:subdomain",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},TENANT_PROVISION:{method:"POST",path:"/tenants/provision",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_LIST:{method:"GET",path:"/tenants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_DETAIL:{method:"GET",path:"/tenants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SUSPEND:{method:"POST",path:"/tenants/:id/suspend",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_REACTIVATE:{method:"POST",path:"/tenants/:id/reactivate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SELF_SIGNUP:{method:"POST",path:"/tenants/self-signup",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}},DOMAIN_ENDPOINTS={DOMAIN_RESOLVE:{method:"GET",path:"/domains/resolve",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_HOSTNAME:{method:"POST",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_HOSTNAMES:{method:"GET",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_HOSTNAME:{method:"GET",path:"/domains/hostnames/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_HOSTNAME_INSTRUCTIONS:{method:"GET",path:"/domains/hostnames/:id/instructions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_VERIFY_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/verify",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_ACTIVATE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/activate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_DISABLE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/disable",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_MAKE_PRIMARY:{method:"POST",path:"/domains/hostnames/:id/make-primary",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_REFRESH_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/refresh-status",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_REGISTRATION:{method:"POST",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_REGISTRATIONS:{method:"GET",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_REGISTRATION:{method:"GET",path:"/domains/registrations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CANCEL_REGISTRATION:{method:"POST",path:"/domains/registrations/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_TRANSFER_OUT:{method:"POST",path:"/domains/registrations/:id/transfer-out",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MARKETPLACE_ENDPOINTS={PAYMENT_MARKETPLACE_RECORD_SPLIT:{method:"POST",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_SPLITS:{method:"GET",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_BALANCE:{method:"GET",path:"/payment/marketplace/balance/:ownerId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RELEASE_RESERVE:{method:"POST",path:"/payment/marketplace/reserves/:id/release",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_SETTLEMENT_POLICY:{method:"GET",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_UPSERT_SETTLEMENT_POLICY:{method:"POST",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REQUEST_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_PAYOUTS:{method:"GET",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_PAYOUT:{method:"GET",path:"/payment/marketplace/payout-requests/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_APPROVE_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REJECT_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/reject",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_OPEN_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_DISPUTES:{method:"GET",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RESOLVE_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes/:id/resolve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},COHORT_ENDPOINTS={ADMIN_LIST_COHORTS:{method:"GET",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_GET_COHORT:{method:"GET",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_COHORT:{method:"POST",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UPDATE_COHORT:{method:"PATCH",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_DELETE_COHORT:{method:"DELETE",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_BULK_CREATE:{method:"POST",path:"/auth/admin/cohorts/:id/bulk-create",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DEACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/deactivate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_ACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/activate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DELETE_USERS:{method:"POST",path:"/auth/admin/cohorts/:id/delete-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_EXPORT:{method:"GET",path:"/auth/admin/cohorts/:id/export",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}};var SYSTEM_TABLE_NAMES=["profiles","addresses","phones","files","users","roles","claims","user_roles","role_claims","audit_logs","monitoring_metrics","integration_sources","integration_endpoints","integration_mappings","integration_runs","integration_run_items"],systemTables=system_tables_default.tables.filter((t)=>SYSTEM_TABLE_NAMES.includes(t.table_name));function toUpperSnakeCase(str){return str.replace(/([a-z])([A-Z])/g,"$1_$2").replace(/[\s-]+/g,"_").toUpperCase()}function snakeToCamelCase(str){return str.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function singularize(str){if(str.endsWith("ies"))return`${str.slice(0,-3)}y`;if(str.endsWith("ses"))return`${str.slice(0,-2)}`;if(str.endsWith("s"))return str.slice(0,-1);return str}function generateEntityEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName),singularName=toUpperSnakeCase(singularize(tableName));switch(method){case"GET":return`GET_${upperName}`;case"POST":return`ADD_${singularName}`;case"PUT":return`UPDATE_${singularName}`;case"PATCH":return`PATCH_${singularName}`;case"DELETE":return`DELETE_${singularName}`}}function generateBulkEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName);switch(method){case"POST":return`BULK_ADD_${upperName}`;case"PUT":return`BULK_UPDATE_${upperName}`;case"DELETE":return`BULK_DELETE_${upperName}`}}function isMethodExcluded(table,method){if(!table.excluded_methods)return!1;let methodMap={GET:"GET",POST:"POST",PUT:"PUT",PATCH:"PATCH",DELETE:"DELETE"};return table.excluded_methods.includes(methodMap[method])}function generateEndpointsFromConfig(config){let endpoints={};for(let table of config.entities){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,sid=table.serviceId;if(!isMethodExcluded(table,"GET")){endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0},endpoints[`GET_${toUpperSnakeCase(tableName)}_DISTINCT`]={method:"GET",path:`${basePath}/distinct/:field`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}if(!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:table.is_public?.POST??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:table.is_public?.PUT??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:table.is_public?.PATCH??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled){if(!isMethodExcluded(table,"POST"))endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:table.is_public?.POST??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:table.is_public?.PUT??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}}return endpoints}function generateAuthEndpoints(config){let endpoints={},auth=config.authentication;if(!auth?.enabled)return endpoints;for(let[featureKey,endpointConfig]of Object.entries(AUTH_ENDPOINT_CONFIGS)){let feature=auth[featureKey];if(!feature?.enabled)continue;let feat=feature,baseRoute=feat.route||endpointConfig.defaultRoute,isPublic=feat.isPublic??endpointConfig.defaultIsPublic;if("subEndpoints"in endpointConfig&&endpointConfig.subEndpoints)for(let sub of endpointConfig.subEndpoints){let subRoute="routeKey"in sub&&sub.routeKey&&feature[sub.routeKey]?String(feature[sub.routeKey]):("defaultRoute"in sub)&&sub.defaultRoute?String(sub.defaultRoute):`${baseRoute}${sub.suffix}`,subIsPublic="isPublic"in sub&&typeof sub.isPublic==="boolean"?sub.isPublic:isPublic;endpoints[sub.key]={method:sub.method,path:subRoute,isPublic:subIsPublic,_payload:sub._payload,_success:sub._success,_error:sub._error}}else if("_payload"in endpointConfig)endpoints[endpointConfig.key]={method:endpointConfig.method,path:baseRoute,isPublic,_payload:endpointConfig._payload,_success:endpointConfig._success,_error:endpointConfig._error}}return endpoints}function generateSystemTableEndpoints(){let endpoints={};for(let table of systemTables){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,isFormData=tableName==="files";endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));if(endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled)endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}}return endpoints}function generateMonitoringEndpoints(config){if(!config.liveMonitoring?.enabled)return{};return{...MONITORING_ENDPOINTS}}function generateAdminEndpoints(config){let endpoints={};if(!config.authentication?.enabled)return endpoints;return endpoints.ADMIN_IMPERSONATE={method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_IMPERSONATE_STOP={method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CHANGE_USER_ID={method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CREATE_USER={method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_HARD_DELETE_USER={method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_LOCK_USER={method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_UNLOCK_USER={method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_MARK_EMAIL_VERIFIED={method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generateCohortEndpoints(config){let auth=config.authentication;if(!auth?.enabled||!auth.cohorts?.enabled)return{};return{...COHORT_ENDPOINTS}}function generateVerificationEndpoints(config){let endpoints={},verification=config.verification;if(!verification?.enabled)return endpoints;let basePath=verification.endpoints?.basePath||"/verifications",flowBasePath=verification.flowEndpoints?.basePath||"/verification-flows";if(endpoints.VERIFICATION_STATUS={method:"GET",path:`${basePath}/status/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_DECIDE={method:"POST",path:`${basePath}/:entity_name/:entity_id/decide`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_CANCEL={method:"POST",path:`${basePath}/:entity_name/:entity_id/cancel`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_PENDING={method:"GET",path:`${basePath}/pending`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_HISTORY={method:"GET",path:`${basePath}/history/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START={method:"POST",path:`${basePath}/start`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START_FOR_ENTITY={method:"POST",path:`${basePath}/start-for-entity`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_ENTITY_STATUSES={method:"GET",path:`${basePath}/statuses/:entity_name`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},verification.flowEndpoints?.enabled!==!1)endpoints.FLOW_LIST={method:"GET",path:flowBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_GET={method:"GET",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_SAVE={method:"POST",path:flowBasePath,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_FEASIBILITY={method:"POST",path:`${flowBasePath}/feasibility`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_PUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/publish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_UNPUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/unpublish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_DELETE={method:"DELETE",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};return endpoints}function generateNotificationEndpoints(config){let endpoints={},notification=config.notification;if(!notification?.enabled||notification.endpoints?.enabled===!1)return endpoints;let notifBasePath=notification.endpoints?.basePath||"/notifications";return endpoints.NOTIFICATION_LIST={method:"GET",path:notifBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_UNSEEN_COUNT={method:"GET",path:`${notifBasePath}/unseen-count`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_SEEN={method:"POST",path:`${notifBasePath}/:notification_id/seen`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_ALL_SEEN={method:"POST",path:`${notifBasePath}/seen-all`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generatePaymentEndpoints(config){if(!config.payment?.enabled)return{};return{...PAYMENT_ENDPOINTS}}function generateConfigEndpoints(config){if(!config.configManagement?.enabled)return{};return{...CONFIG_ENDPOINTS}}function generateTenantEndpoints(config){if(!config.database?.isMultiTenant)return{};return{...TENANT_ENDPOINTS}}function generateChatEndpoints(config){if(!config.chat?.enabled)return{};return{...CHAT_ENDPOINTS}}function generateDomainEndpoints(config){if(!config.domains?.enabled)return{};return{...DOMAIN_ENDPOINTS}}function generateMarketplaceEndpoints(config){let payment=config.payment;if(!payment?.enabled||!payment.marketplace?.enabled)return{};return{...MARKETPLACE_ENDPOINTS}}function generateAllEndpoints(config,extraEndpoints){let entityEndpoints=generateEndpointsFromConfig(config),authEndpoints=generateAuthEndpoints(config),adminEndpoints=generateAdminEndpoints(config),cohortEndpoints=generateCohortEndpoints(config),systemEndpoints=generateSystemTableEndpoints(),monitoringEndpoints=generateMonitoringEndpoints(config),verificationEndpoints=generateVerificationEndpoints(config),chatEndpoints=generateChatEndpoints(config),tenantEndpoints=generateTenantEndpoints(config),domainEndpoints=generateDomainEndpoints(config),marketplaceEndpoints=generateMarketplaceEndpoints(config),notificationEndpoints=generateNotificationEndpoints(config),paymentEndpoints=generatePaymentEndpoints(config),configEndpoints=generateConfigEndpoints(config);return{...entityEndpoints,...authEndpoints,...adminEndpoints,...cohortEndpoints,...systemEndpoints,...monitoringEndpoints,...verificationEndpoints,...chatEndpoints,...tenantEndpoints,...domainEndpoints,...marketplaceEndpoints,...notificationEndpoints,...paymentEndpoints,...configEndpoints,...extraEndpoints??{}}}init_Logger();var DEFAULT_CONFIG2={timeout:30000,retries:0,retryDelay:1000,debug:!1};class ServerFetch{config;logger;constructor(config={}){this.config={...DEFAULT_CONFIG2,...config},this.logger=new Logger({service:"ServerFetch",prettyPrint:this.config.debug,colorize:this.config.debug,auditEnabled:!1})}buildUrl(url){if(url.startsWith("http://")||url.startsWith("https://"))return url;return this.config.baseUrl?`${this.config.baseUrl}${url}`:url}buildHeaders(customHeaders){let headers=new Headers;if(this.config.defaultHeaders)for(let[key,value]of Object.entries(this.config.defaultHeaders))headers.set(key,value);if(customHeaders)if(customHeaders instanceof Headers)customHeaders.forEach((value,key)=>{headers.set(key,value)});else if(Array.isArray(customHeaders))for(let[key,value]of customHeaders)headers.set(key,value);else for(let[key,value]of Object.entries(customHeaders))headers.set(key,value);return headers}parseResponseHeaders(headers){let result={};if(headers.forEach((value,key)=>{if(key.toLowerCase()==="set-cookie"){let existing=result[key];result[key]=existing?`${existing}, ${value}`:value}else result[key]=value}),typeof headers.getSetCookie==="function"){let setCookies=headers.getSetCookie();if(setCookies.length>0)result["set-cookie"]=setCookies.join(", ")}return result}async executeWithTimeout(promise,timeoutMs,_requestId){let controller=new AbortController,timeoutId=setTimeout(()=>controller.abort(),timeoutMs);try{return await Promise.race([promise,new Promise((_,reject)=>{controller.signal.addEventListener("abort",()=>{reject(Error(`Request timeout after ${timeoutMs}ms`))})})])}finally{clearTimeout(timeoutId)}}async fetch(options){let requestId=randomId(),startTime=performance.now(),url=this.buildUrl(options.url),headers=this.buildHeaders(options.headers),timeout=options.timeout??this.config.timeout??30000,retries=options.retries??this.config.retries??0,retryDelay=options.retryDelay??this.config.retryDelay??1000,body;if(options.body)if(typeof options.body==="object"&&!(options.body instanceof FormData)&&!(options.body instanceof URLSearchParams)&&!(options.body instanceof Blob)&&!(options.body instanceof ArrayBuffer)){if(body=JSON.stringify(options.body),!headers.has("content-type"))headers.set("content-type","application/json")}else body=options.body;this.logger.debug(`[${requestId}] ${options.method} ${url}`,{method:options.method,url,hasBody:!!body});let lastError=null,attempt=0;while(attempt<=retries)try{let response=await this.executeWithTimeout(fetch(url,{method:options.method,headers,body}),timeout,requestId),durationMs2=performance.now()-startTime,responseHeaders=this.parseResponseHeaders(response.headers),rawSetCookies=typeof response.headers.getSetCookie==="function"?response.headers.getSetCookie():[],responseData,errorData,rawText=await response.text();if(rawText)try{let json=JSON.parse(rawText);if(response.ok)responseData=json;else errorData=json}catch{if(!response.ok)errorData={message:rawText||response.statusText}}else if(!response.ok)errorData={message:response.statusText};let result={isSuccess:response.ok,response:responseData,errors:errorData,code:response.status,headers:responseHeaders,rawSetCookies,durationMs:durationMs2,requestId,createdAt:new Date};if(response.ok)this.logger.info(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2)});else this.logger.warn(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2),error:errorData});return result}catch(error){if(lastError=error instanceof Error?error:Error(String(error)),attempt++,attempt<=retries)this.logger.warn(`[${requestId}] Retry ${attempt}/${retries} after error`,{method:options.method,url,error:lastError.message,attempt,retries}),await new Promise((resolve)=>setTimeout(resolve,retryDelay))}let durationMs=performance.now()-startTime;return this.logger.error(`[${requestId}] ${options.method} ${url} failed`,lastError,{method:options.method,url,durationMs:Math.round(durationMs),attempts:attempt}),{isSuccess:!1,response:void 0,errors:{message:lastError?.message||"Unknown error"},code:null,headers:{},rawSetCookies:[],durationMs,requestId,createdAt:new Date}}async get(url,options){return this.fetch({...options,url,method:"GET"})}async post(url,body,options){return this.fetch({...options,url,method:"POST",body})}async put(url,body,options){return this.fetch({...options,url,method:"PUT",body})}async patch(url,body,options){return this.fetch({...options,url,method:"PATCH",body})}async delete(url,options){return this.fetch({...options,url,method:"DELETE"})}}var serverFetch=new ServerFetch;var RESPONSE_CONTROL_FLAGS=["requiresCaptcha","requiresApproval","attemptsRemaining","requestId","code","detail"];function serverRequestId(response){let fromBody=(value)=>{if(!value||typeof value!=="object")return;let id=value.requestId;return typeof id==="string"&&id.length>0?id:void 0};return fromBody(response.errors)??fromBody(response.response)??response.headers?.["x-request-id"]??void 0}function normalizeResponseShape(response){if(!response||typeof response!=="object"||Array.isArray(response))return response;let raw=response;if(!("success"in raw)||"data"in raw)return response;let{success,isSuccess,message,error,...rest}=raw,controlFlags={};for(let flag of RESPONSE_CONTROL_FLAGS)if(flag in rest)controlFlags[flag]=rest[flag],delete rest[flag];return{success,...isSuccess!==void 0?{isSuccess}:{},...message!==void 0?{message}:{},...error!==void 0?{error}:{},...controlFlags,...Object.keys(rest).length>0?{data:rest}:{}}}var DEFAULT_TOKEN_NAMES={accessToken:"access_token",refreshToken:"refresh_token",sessionToken:"session_token"};function splitSetCookieHeader(header){let cookies=[],current="";for(let i=0;i<header.length;i++){let char=header[i];if(char===","){let next=header.slice(i+1).trimStart();if(/^[a-zA-Z0-9_-]+=/.test(next)){cookies.push(current.trim()),current="";continue}}current+=char}if(current.trim())cookies.push(current.trim());return cookies}function buildRequestHeaders(headersStore,tokenNames){let headers={},forwardHeaders=["x-forwarded-for","x-real-ip","user-agent","accept-language","x-request-id","x-client-ip","cf-connecting-ip","true-client-ip","x-tenant-id","x-app-origin"];for(let header of forwardHeaders){let value=headersStore.get(header);if(value)headers[header]=value}if(!headers["user-agent"])headers["user-agent"]="Nucleus-ServerAction/1.0";let accessToken=headersStore.get(`x-${tokenNames.accessToken}`),refreshToken=headersStore.get(`x-${tokenNames.refreshToken}`),sessionToken=headersStore.get(`x-${tokenNames.sessionToken}`);if(accessToken)headers[`x-${tokenNames.accessToken}`]=accessToken;if(refreshToken)headers[`x-${tokenNames.refreshToken}`]=refreshToken;if(sessionToken)headers[`x-${tokenNames.sessionToken}`]=sessionToken;let cookieHeader=headersStore.get("cookie");if(cookieHeader)headers.cookie=cookieHeader;return headers}function toCamelCase(str){return str.replace(/_([a-z])/g,(_,c)=>c.toUpperCase())}function convertKeysToCamelCase(obj){let result={};for(let[key,value]of Object.entries(obj)){let camelKey=key.startsWith("_")?key:toCamelCase(key);if(value instanceof Date)result[camelKey]=value.toISOString();else if(value&&typeof value==="object"&&!Array.isArray(value))result[camelKey]=convertKeysToCamelCase(value);else result[camelKey]=value}return result}var JSON_STRINGIFY_KEYS=new Set(["filters","sort","with","searchFields","select","distinctOn"]);function appendQueryParams(url,params){let searchParams=new URLSearchParams;for(let[key,value]of Object.entries(params)){if(value===void 0||value===null)continue;if(JSON_STRINGIFY_KEYS.has(key)&&typeof value==="object"){searchParams.append(key,JSON.stringify(value));continue}if(value instanceof Date)searchParams.append(key,value.toISOString());else if(Array.isArray(value))searchParams.append(key,value.filter((v)=>v!=null).map(String).join(","));else if(typeof value==="object")searchParams.append(key,JSON.stringify(value));else searchParams.append(key,String(value))}let queryString=searchParams.toString();if(!queryString)return url;return url.includes("?")?`${url}&${queryString}`:`${url}?${queryString}`}var DEFAULT_REFRESH_EXCLUDED=["/auth/login","/auth/logout","/auth/register","/auth/refresh"];function mergeCookieHeader(existing,setCookies){let jar=new Map;for(let part of(existing??"").split(";")){let eq=part.indexOf("=");if(eq<=0)continue;jar.set(part.slice(0,eq).trim(),part.slice(eq+1).trim())}for(let raw of setCookies){let[pair]=raw.split(";");if(!pair)continue;let eq=pair.indexOf("=");if(eq<=0)continue;let name=pair.slice(0,eq).trim(),value=pair.slice(eq+1).trim();if(value===""||/max-age\s*=\s*0(?!\d)/i.test(raw))jar.delete(name);else jar.set(name,value)}return Array.from(jar,([k,v])=>`${k}=${v}`).join("; ")}function setCookiesOf(response){if(response.rawSetCookies.length>0)return response.rawSetCookies;let joined=response.headers["set-cookie"];return joined?splitSetCookieHeader(joined):[]}function createServerFactory(endpoints,config,getCookies,getHeaders){let tokenNames={...DEFAULT_TOKEN_NAMES,...config.tokenNames},serverFetch2=new ServerFetch({baseUrl:config.baseUrl,debug:config.debug,timeout:30000,retries:0});return async function(endpointKey,payload){let endpoint=endpoints[endpointKey];if(!endpoint)return{isSuccess:!1,errors:{message:`Endpoint "${endpointKey}" not found`},code:404};let cookieStore=await getCookies(),headersStore=await getHeaders(),allHeaders={};if(headersStore.forEach((value,key)=>{allHeaders[key]=value}),(endpoint.path.includes("/auth/login")||endpoint.path.includes("/auth/oauth"))&&endpoint.method==="POST")try{cookieStore.delete(tokenNames.accessToken),cookieStore.delete(tokenNames.refreshToken),cookieStore.delete(tokenNames.sessionToken)}catch(_){}let headers=buildRequestHeaders(headersStore,tokenNames),url=endpoint.path,body,pathParamNames=new Set,pathParamRegex=/:([a-zA-Z_][a-zA-Z0-9_]*)/g,paramMatch=pathParamRegex.exec(url);while(paramMatch!==null){if(paramMatch[1])pathParamNames.add(paramMatch[1]);paramMatch=pathParamRegex.exec(url)}if(payload&&typeof payload==="object"&&!(payload instanceof FormData)){let payloadObj=payload;for(let[key,value]of Object.entries(payloadObj))if(value!=null){if(pathParamNames.has(key))url=url.replace(`:${key}`,String(value));else if(key.startsWith("_")&&pathParamNames.has(key.substring(1)))url=url.replace(`:${key.substring(1)}`,String(value));else if(key==="id"&&pathParamNames.has("id"))url=url.replace(":id",String(value))}}if(endpoint.method==="GET"&&payload&&typeof payload==="object"){let queryPayload={...payload};for(let paramName of pathParamNames)delete queryPayload[paramName],delete queryPayload[`_${paramName}`];url=appendQueryParams(url,queryPayload)}else if(payload!==void 0){if(endpoint.isFormData&&payload instanceof FormData)body=payload;else if(Array.isArray(payload)){if(body=payload.map((item)=>item&&typeof item==="object"?convertKeysToCamelCase(item):item),!headers["content-type"])headers["content-type"]="application/json"}else if(body=endpoint.skipCamelCase?payload:convertKeysToCamelCase(payload),!headers["content-type"])headers["content-type"]="application/json"}let send=(requestHeaders)=>serverFetch2.fetch({url,method:endpoint.method,headers:requestHeaders,body}),response=await send(headers),refreshCfg=config.refresh;if(response.code===401&&refreshCfg?.enabled!==!1&&!(refreshCfg?.excludePaths??DEFAULT_REFRESH_EXCLUDED).some((p)=>endpoint.path.includes(p))){let refreshResponse=await serverFetch2.fetch({url:refreshCfg?.endpoint??"/auth/refresh",method:"POST",headers}),issued=setCookiesOf(refreshResponse);if(refreshResponse.isSuccess&&issued.length>0)applySetCookieHeaders(cookieStore,issued),response=await send({...headers,cookie:mergeCookieHeader(headers.cookie,issued)})}let setCookiesToProcess=response.rawSetCookies.length>0?response.rawSetCookies:response.headers["set-cookie"]?splitSetCookieHeader(response.headers["set-cookie"]):[];if(setCookiesToProcess.length>0)applySetCookieHeaders(cookieStore,setCookiesToProcess);let normalizedResponse=response.response;if(response.isSuccess)normalizedResponse=normalizeResponseShape(normalizedResponse);return{isSuccess:response.isSuccess,data:normalizedResponse,errors:response.errors,code:response.code,requestId:serverRequestId(response),message:response.isSuccess?void 0:response.errors?.message}}}function applySetCookieHeaders(cookieStore,setCookies){try{for(let cookie of setCookies){let[nameValue,...options]=cookie.split(";");if(!nameValue)continue;let eqIdx=nameValue.indexOf("=");if(eqIdx===-1)continue;let name=nameValue.substring(0,eqIdx).trim(),value=nameValue.substring(eqIdx+1).trim();if(!name)continue;let cookieOptions={},maxAge;for(let opt of options){let trimmed=opt.trim(),optEqIdx=trimmed.indexOf("="),optName=optEqIdx===-1?trimmed:trimmed.substring(0,optEqIdx),optValue=optEqIdx===-1?void 0:trimmed.substring(optEqIdx+1);if(!optName)continue;let optNameLower=optName.toLowerCase();if(optNameLower==="path")cookieOptions.path=optValue;else if(optNameLower==="domain")cookieOptions.domain=optValue;else if(optNameLower==="max-age")maxAge=Number(optValue),cookieOptions.maxAge=maxAge;else if(optNameLower==="expires"&&optValue)cookieOptions.expires=new Date(optValue);else if(optNameLower==="httponly")cookieOptions.httpOnly=!0;else if(optNameLower==="secure")cookieOptions.secure=!0;else if(optNameLower==="samesite")cookieOptions.sameSite=optValue}if(value===""||maxAge!==void 0&&maxAge<=0)cookieStore.delete(name);else cookieStore.set(name,value,cookieOptions)}}catch(cookieError){console.warn("[ServerFactory] Failed to process Set-Cookie headers:",cookieError instanceof Error?cookieError.message:String(cookieError))}}var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];import{batch as batch2,createStore as createStore2}from"h-state";var initialState={connection:{status:"disconnected",clientId:null,subscribedTopics:[],error:null,reconnectAttempt:0},events:[],maxEvents:100},{useStore:usePubSubStore}=createStore2(initialState,{setConnectionStatus:(store)=>(status)=>{store.connection.status=status},setClientId:(store)=>(clientId)=>{store.connection.clientId=clientId},setSubscribedTopics:(store)=>(topics)=>{store.connection.subscribedTopics=topics},setError:(store)=>(error)=>{store.connection.error=error},setReconnectAttempt:(store)=>(attempt)=>{store.connection.reconnectAttempt=attempt},addEvent:(store)=>(event)=>{let updated=[event,...store.events];store.events=updated.slice(0,store.maxEvents)},clearEvents:(store)=>()=>{store.events=[]},reset:(store)=>()=>{batch2(()=>{store.connection.status="disconnected",store.connection.clientId=null,store.connection.subscribedTopics=[],store.connection.error=null,store.connection.reconnectAttempt=0,store.events=[]})}});import{useEffect}from"react";var SYNTHESIZED_AUTH_HEADER="x-nucleus-auth-synthesized";function sessionEndedByProxy(response){return response.status===401&&response.headers.get("x-nucleus-auth-synthesized")==="session-ended"}var WINDOW_EVENTS=["online","focus","pageshow"];function armReturnListeners(env,onReturn){let fired=!1,timer=null,setTimer=env.setTimeout??((fn,ms)=>{let handle=setTimeout(fn,ms);return handle.unref?.(),handle}),clearTimer=env.clearTimeout??((h)=>clearTimeout(h)),disarm=()=>{for(let type of WINDOW_EVENTS)env.window.removeEventListener(type,check);if(env.document.removeEventListener("visibilitychange",check),timer!==null)clearTimer(timer),timer=null};function fire(){if(fired)return;fired=!0,disarm(),onReturn()}function check(){if(fired)return;if(env.document.visibilityState==="hidden")return;if(env.navigator?.onLine===!1)return;fire()}for(let type of WINDOW_EVENTS)env.window.addEventListener(type,check);return env.document.addEventListener("visibilitychange",check),timer=setTimer(fire,120000),()=>{fired=!0,disarm()}}function buildWsUrl(config){let path=config.wsPath||"/api/events/subscribe",topics=(config.topics||["*"]).join(","),query=`?userId=${encodeURIComponent(config.userId)}&topics=${encodeURIComponent(topics)}`;if(config.wsUrl)return`${config.wsUrl.replace(/\/$/,"")}${path}${query}`;if(typeof window>"u")return"";return`${window.location.protocol==="https:"?"wss:":"ws:"}//${window.location.host}${path}${query}`}var connections=new Map,eventIdCounter=0;function log(conn,...args){if(conn.options.debug)console.log("[usePubSub]",...args)}function clearTimers(conn){if(conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout),conn.reconnectTimeout=null;if(conn.stopWaitingForReturn)conn.stopWaitingForReturn(),conn.stopWaitingForReturn=null}function detachSocket(conn){let ws=conn.ws;if(!ws)return;if(ws.onopen=null,ws.onmessage=null,ws.onerror=null,ws.onclose=null,ws.readyState===WebSocket.OPEN||ws.readyState===WebSocket.CONNECTING)ws.close();conn.ws=null}function startHeartbeat(conn){if(conn.heartbeat)clearInterval(conn.heartbeat);conn.heartbeat=setInterval(()=>{if(conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ping"}))},conn.options.heartbeatInterval)}var HANDSHAKE_FAILURE_LIMIT=3;async function confirmSessionThenDecide(conn){let path=conn.options.sessionProbePath;if(!path){log(conn,"Handshake failing; no probe configured, continuing to reconnect"),conn.handshakeFailures=0,scheduleReconnect(conn);return}try{let res=await fetch(path,{credentials:"include",method:"GET"});if(res.status===401||res.status===403)if(res.headers.get(SYNTHESIZED_AUTH_HEADER)&&!sessionEndedByProxy(res))log(conn,"Probe 401 came from the proxy, not the API; treating as a network problem");else{conn.dispatch.setConnectionStatus("unauthorized"),conn.dispatch.setError(Error("Session is no longer valid")),log(conn,`Session probe says ${res.status}; not retrying`),waitForReturn(conn);return}else log(conn,`Session probe says ${res.status}; the session is fine, retrying`)}catch{log(conn,"Session probe could not be made; treating as a network problem")}conn.handshakeFailures=0,scheduleReconnect(conn)}function waitForReturn(conn){if(typeof window>"u"||typeof document>"u")return;if(connections.get(conn.url)!==conn)return;if(conn.stopWaitingForReturn)return;conn.stopWaitingForReturn=armReturnListeners({window,document,navigator:typeof navigator>"u"?void 0:navigator},()=>{if(connections.get(conn.url)!==conn)return;conn.stopWaitingForReturn=null,conn.reconnectAttempt=0,conn.handshakeFailures=0,log(conn,"Network or tab came back; reconnecting"),openSocket(conn)})}function scheduleReconnect(conn){if(!conn.options.autoReconnect)return;if(connections.get(conn.url)!==conn)return;if(conn.reconnectAttempt>=conn.options.maxReconnectAttempts){conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setError(Error("Max reconnection attempts reached")),log(conn,"Max reconnect attempts reached; waiting for network or tab to return"),waitForReturn(conn);return}let delay=Math.min(conn.options.reconnectBaseDelay*2**conn.reconnectAttempt,conn.options.reconnectMaxDelay);if(conn.reconnectAttempt+=1,conn.dispatch.setConnectionStatus("reconnecting"),conn.dispatch.setReconnectAttempt(conn.reconnectAttempt),log(conn,`Reconnecting in ${delay}ms (attempt ${conn.reconnectAttempt})`),conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout);conn.reconnectTimeout=setTimeout(()=>{if(connections.get(conn.url)===conn)openSocket(conn)},delay)}function handleMessage(conn,raw){let message;try{message=JSON.parse(raw)}catch{log(conn,"Failed to parse message");return}switch(message.type){case"connected":conn.reconnectAttempt=0,conn.handshakeFailures=0,conn.dispatch.setConnectionStatus("connected"),conn.dispatch.setClientId(message.clientId),conn.dispatch.setSubscribedTopics(message.subscribedTopics),conn.dispatch.setReconnectAttempt(0),conn.dispatch.setError(null),log(conn,"Connected, clientId:",message.clientId);break;case"subscribed":conn.dispatch.setSubscribedTopics(message.topics),log(conn,"Subscribed to:",message.topics);break;case"event":{if(conn.dispatch.addEvent({id:`evt_${Date.now()}_${eventIdCounter++}`,topic:message.topic,data:message.data,timestamp:message.timestamp,receivedAt:Date.now(),messageId:message.messageId,isRedelivery:message.isRedelivery}),message.messageId&&conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ack",messageId:message.messageId}));break}case"pong":break;case"error":conn.dispatch.setError(Error(message.error)),log(conn,"Server error:",message.error);break}}function openSocket(conn){if(conn.ws?.readyState===WebSocket.OPEN||conn.ws?.readyState===WebSocket.CONNECTING)return;detachSocket(conn),conn.dispatch.setConnectionStatus("connecting"),conn.dispatch.setError(null),log(conn,"Connecting to:",conn.url);let ws=new WebSocket(conn.url);conn.ws=ws;let opened=!1;ws.onopen=()=>{log(conn,"WebSocket opened"),opened=!0,startHeartbeat(conn)},ws.onmessage=(event)=>handleMessage(conn,event.data),ws.onerror=()=>{log(conn,"WebSocket error"),conn.dispatch.setError(Error("WebSocket connection error"))},ws.onclose=(event)=>{if(log(conn,"WebSocket closed",event.code,event.reason),conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null),connections.get(conn.url)!==conn)return;if(event.code===4001){log(conn,"Handshake bearer refused (4001); asking whether the session is still valid"),confirmSessionThenDecide(conn);return}if(!opened){if(conn.handshakeFailures+=1,conn.handshakeFailures>=HANDSHAKE_FAILURE_LIMIT){confirmSessionThenDecide(conn);return}}else conn.handshakeFailures=0;scheduleReconnect(conn)}}function acquire(url,dispatch,options){let conn=connections.get(url);if(!conn)conn={url,ws:null,refCount:0,reconnectAttempt:0,handshakeFailures:0,stopWaitingForReturn:null,heartbeat:null,reconnectTimeout:null,dispatch,options},connections.set(url,conn);else conn.dispatch=dispatch,conn.options=options;conn.refCount+=1,openSocket(conn)}function release(url){let conn=connections.get(url);if(!conn)return;if(conn.refCount-=1,conn.refCount>0)return;connections.delete(url),clearTimers(conn),detachSocket(conn),conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null)}function send(url,payload){let ws=connections.get(url)?.ws;if(ws?.readyState===WebSocket.OPEN)ws.send(JSON.stringify(payload))}function usePubSub(config){let store=usePubSubStore(),url=config.userId?buildWsUrl(config):"";return useEffect(()=>{if(!url)return;let dispatch={setConnectionStatus:store.setConnectionStatus,setClientId:store.setClientId,setSubscribedTopics:store.setSubscribedTopics,setError:store.setError,setReconnectAttempt:store.setReconnectAttempt,addEvent:store.addEvent},options={autoReconnect:config.autoReconnect??!0,maxReconnectAttempts:config.maxReconnectAttempts??10,sessionProbePath:config.sessionProbePath??"/auth/me",reconnectBaseDelay:config.reconnectBaseDelay??1000,reconnectMaxDelay:config.reconnectMaxDelay??30000,heartbeatInterval:config.heartbeatInterval??30000,debug:config.debug??!1};return acquire(url,dispatch,options),()=>release(url)},[url]),{isConnected:store.connection.status==="connected",isConnecting:store.connection.status==="connecting"||store.connection.status==="reconnecting",sessionExpired:store.connection.status==="unauthorized",clientId:store.connection.clientId,subscribedTopics:store.connection.subscribedTopics,events:store.events,error:store.connection.error,reconnectAttempt:store.connection.reconnectAttempt,connect:()=>{let conn=connections.get(url);if(conn)openSocket(conn)},disconnect:()=>release(url),subscribe:(topics)=>send(url,{type:"subscribe",topics}),unsubscribe:(topics)=>send(url,{type:"unsubscribe",topics}),clearEvents:store.clearEvents,getEventsByTopic:(topic)=>store.events.filter((e)=>e.topic===topic)}}function createRateWindow(windowMs=5000){let samples=[];return{push(at,bytes){let last=samples[samples.length-1];if(last&&at<=last.at){last.bytes=Math.max(last.bytes,bytes);return}samples.push({at,bytes});let cutoff=at-windowMs;while(samples.length>2&&samples[0].at<cutoff)samples.shift()},ratePerSecond(){if(samples.length<2)return null;let first=samples[0],last=samples[samples.length-1],spanMs=last.at-first.at;if(spanMs<700)return null;let delta=last.bytes-first.bytes;if(delta<=0)return null;return delta*1000/spanMs},reset(){samples.length=0}}}function uploadFraction(sentBytes,totalBytes){if(totalBytes===null||totalBytes<=0)return null;return Math.min(1,Math.max(0,sentBytes/totalBytes))}function uploadPercent(sentBytes,totalBytes){let fraction=uploadFraction(sentBytes,totalBytes);if(fraction===null)return null;if(fraction>=1)return 100;return Math.min(99,Math.floor(fraction*100))}function secondsRemaining(sentBytes,totalBytes,bytesPerSecond){if(totalBytes===null||totalBytes<=0)return null;let left=totalBytes-sentBytes;if(left<=0)return 0;if(bytesPerSecond===null||bytesPerSecond<=0)return null;return left/bytesPerSecond}function buildProgress(params){let{sentBytes,totalBytes,startedAt,now,window:window2,retrying=!1}=params;window2.push(now,sentBytes);let bytesPerSecond=window2.ratePerSecond();return{sentBytes,totalBytes,fraction:uploadFraction(sentBytes,totalBytes),percent:uploadPercent(sentBytes,totalBytes),bytesPerSecond,secondsRemaining:secondsRemaining(sentBytes,totalBytes,bytesPerSecond),elapsedMs:Math.max(0,now-startedAt),retrying}}var MIN_REPORT_INTERVAL_MS=120;function uploadWithProgress(body,options){let xhr=options.createRequest?options.createRequest():new XMLHttpRequest,window2=createRateWindow(),startedAt=Date.now(),lastReportAt=0,settled=!1,lastSent=0,lastTotal=null,report=(sentBytes,totalBytes,force)=>{if(!options.onProgress)return;let now=Date.now();if(!force&&now-lastReportAt<MIN_REPORT_INTERVAL_MS)return;lastReportAt=now,options.onProgress(buildProgress({sentBytes,totalBytes,startedAt,now,window:window2}))};return{done:new Promise((resolve)=>{let settle=(outcome)=>{if(settled)return;settled=!0,resolve(outcome)};xhr.open("POST",options.url,!0),xhr.withCredentials=options.withCredentials!==!1;for(let[key,value]of Object.entries(options.headers??{}))xhr.setRequestHeader(key,value);if(options.timeoutMs)xhr.timeout=options.timeoutMs;xhr.upload.onprogress=(event)=>{lastSent=event.loaded,lastTotal=event.lengthComputable?event.total:null,report(lastSent,lastTotal,!1)},xhr.upload.onload=()=>{report(lastTotal??lastSent,lastTotal,!0)},xhr.onload=()=>{let parsed=null;try{parsed=xhr.responseText?JSON.parse(xhr.responseText):null}catch{parsed=null}if(xhr.status<200||xhr.status>=300){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||xhr.statusText||"",cancelled:!1});return}let data=options.parse?options.parse(parsed):parsed;if(data===null||data===void 0){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||"The server accepted the upload but returned nothing usable",cancelled:!1});return}settle({ok:!0,data})},xhr.onerror=()=>{settle({ok:!1,status:null,message:"The upload could not reach the server",cancelled:!1})},xhr.ontimeout=()=>{settle({ok:!1,status:null,message:"The upload timed out",cancelled:!1})},xhr.onabort=()=>{settle({ok:!1,status:null,message:"",cancelled:!0})},xhr.send(body)}),abort:()=>{xhr.abort()}}}function serverMessage(parsed){if(!parsed||typeof parsed!=="object")return"";let body=parsed;for(let key of["message","error","detail"]){let value=body[key];if(typeof value==="string"&&value)return value}return""}import{useCallback,useRef,useState}from"react";function useUpload(options){let[progress,setProgress]=useState(null),[uploading,setUploading]=useState(!1),[outcome,setOutcome]=useState(null),handleRef=useRef(null),optionsRef=useRef(options);optionsRef.current=options;let runId=useRef(0),cancel=useCallback(()=>{handleRef.current?.abort(),handleRef.current=null},[]),reset=useCallback(()=>{setProgress(null),setOutcome(null)},[]),start=useCallback(async(body,overrides)=>{handleRef.current?.abort();let id=++runId.current;setUploading(!0),setOutcome(null),setProgress(null);let merged={...optionsRef.current,...overrides},handle=uploadWithProgress(body,{...merged,onProgress:(p)=>{if(id!==runId.current)return;setProgress(p),merged.onProgress?.(p)}});handleRef.current=handle;let result=await handle.done;if(id!==runId.current)return result;return handleRef.current=null,setUploading(!1),setOutcome(result),result},[]);return{progress,uploading,outcome,start,cancel,reset}}import{createHash as createHash8,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and35,desc as desc7,eq as eq75,lt as lt3,ne as ne7,sql as sql15}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_activeGrants();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();init_redactSecrets();var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column:column2}of ownership){let columns=required.get(table)??new Set;columns.add(column2),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column2 of columns){let entry=perTable.get(column2)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column2)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column2,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column2,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column:column2,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and13,eq as eq17,inArray as inArray4,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq17(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and13(inArray4(getCol(participants,"conversationId"),conversationIds),eq17(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and15,desc as desc3,eq as eq19,inArray as inArray6}from"drizzle-orm";import{and as and14,eq as eq18,inArray as inArray5}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and14(eq18(getCol(tables.participants,"conversationId"),conversationId),eq18(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray5(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq19(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq19(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and15(inArray6(getCol(tables.conversations,"id"),conversationIds),eq19(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray6(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq19(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq19(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and16,desc as desc4,eq as eq20,inArray as inArray7,isNull as isNull3,lt,ne as ne2,sql as sql7}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null,size=fileRow.size??input.size??null,allowedTypes=ctx.config.attachments?.allowedMimeTypes??[];if(allowedTypes.length>0&&(!mimeType||!allowedTypes.includes(mimeType)))throw new ChatError("validation",`Attachment file ${input.fileId} is a ${mimeType??"unknown"} file, which this conversation does not accept`);let maxBytes=ctx.config.attachments?.maxFileSizeBytes??null;if(maxBytes!=null&&size!=null&&size>maxBytes)throw new ChatError("validation",`Attachment file ${input.fileId} is ${size} bytes, over the ${maxBytes} byte limit for attachments`);return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq20(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq20(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql7`${getCol(tables.participants,"unreadCount")} + 1`}).where(and16(eq20(getCol(tables.participants,"conversationId"),params.conversationId),ne2(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq20(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and16(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and16(eq20(getCol(tables.messages,"id"),targetMessageId),eq20(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq20(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq20(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq20(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray7(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}import{and as and17,eq as eq21,isNotNull}from"drizzle-orm";async function isVerificationSignatureFile(args){let{db,schemaTables,fileId}=args,verifications=resolveSchemaTable(schemaTables,"verifications");if(!verifications)return!1;let signatureId=verifications.signatureId;if(!signatureId)return!1;return(await db.select().from(verifications).where(and17(isNotNull(signatureId),eq21(signatureId,fileId))).limit(1)).length>0}init_SystemCollector();init_lifecycle();init_Notification();init_profileSync();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column2){return column2.default!==void 0||column2.defaultRaw!==void 0||column2.generatedAlwaysAs!==void 0||column2.generatedAlwaysAsIdentity===!0||column2.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables2,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables2){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column2 of config.columns??[]){if(builtInNames.has(column2.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column2.notNull===!0&&column2.nullable!==!0&&!hasDbDefault(column2))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function unhonouredIsPublicDeclarations(config){let auth=config.authentication;if(!auth)return[];let notes=[],alwaysPublic=[["authentication.sessions",auth.sessions],["authentication.passwordSet",auth.passwordSet],["authentication.webauthn",auth.webauthn],["authentication.invite",auth.invite],["authentication.register.emailVerification",auth.register?.emailVerification]];for(let[name2,feature]of alwaysPublic)if(feature?.enabled&&feature.isPublic===!1)notes.push(`${name2}.isPublic is false but these routes stay public: the flow is reached without a session`);if(auth.me?.isPublic===!0)notes.push("authentication.me.isPublic is true but /auth/me is never published as public");let sessionToken=auth.sessionToken;if(sessionToken){let named=["secret","algorithm","issuer","audience"].filter((k)=>sessionToken[k]!==void 0);if(named.length>0)notes.push(`authentication.sessionToken.${named.join("/")} is set, but the session token is an opaque id looked up in the store rather than a JWT: nothing signs or verifies it`)}return notes}function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables2,basePath,schema){return buildEntityPublicRoutes(systemTables2,basePath,schema)}function buildPublicRoutes(config,systemTables2,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables2,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_ApiKey();init_activeGrants();init_GodminSetup();init_Middleware();async function resolveApiKeyPermissions(input){let{db,tables,userId,keyAllowedRoles,keyAllowedClaims,userData,logger:logger2}=input,roles=keyAllowedRoles;if(tables.userRoles&&tables.roles)roles=intersectPermissions(await readActiveRoleNames(db,tables,userId),keyAllowedRoles);let claims=keyAllowedClaims,claimScopes={};if(tables.userRoles&&tables.roleClaims&&tables.claims){let grants=await readActiveClaimGrants(db,tables,userId);claims=intersectPermissions(grantedActions(grants),keyAllowedClaims);let effective=new Set(claims),effectiveGrants=grants.filter((grant)=>effective.has(grant.action));if(effectiveGrants.some((grant)=>!!grant.scope)){let resolved=resolveClaimScopes(effectiveGrants,userData,logger2);if(claimScopes=resolved.claimScopes,resolved.dropped.length>0){let dropped=new Set(resolved.dropped);claims=claims.filter((action)=>!dropped.has(action))}}}roles=roles.filter((role)=>!isGodminRole(role));let narrowedRoles=keyAllowedRoles.length-roles.length,narrowedClaims=keyAllowedClaims.length-claims.length;if(narrowedRoles>0||narrowedClaims>0)logger2.debug("[AUTH] API key narrowed to its owner's active grants",{userId,narrowedRoles,narrowedClaims});return{roles,claims,claimScopes}}init_routeCollector();import{eq as eq24}from"drizzle-orm";init_types3();init_adminGuard();init_requireGodmin();init_passwordPolicy();import{eq as eq23}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId,roleLookup){if(!mayActAsGodmin(roleLookup.request))return!1;let user=(await db.select().from(usersTable).where(eq23(col7(usersTable,"id"),userId)).limit(1))[0];if(!user)return!1;let byColumn=Boolean(user.isGod),{rolesTable,userRolesTable,logger:logger2}=roleLookup,byRole=!byColumn&&(hasGodminRole(roleLookup.request)||(rolesTable&&userRolesTable?await userHasGodminRoleInDb(db,{[AUTHORIZATION_TABLE_KEYS.roles]:rolesTable,[AUTHORIZATION_TABLE_KEYS.userRoles]:userRolesTable},userId,logger2):!1));if(!byColumn&&!byRole)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var handleActivateUsers=(db,usersTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq24(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq26,inArray as inArray8}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2,godmin)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq26(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy,entry.email);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray8(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray8(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq27}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq27(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq28,inArray as inArray11}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray11(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray11(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray11(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq28(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq29}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq29(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq30}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq30(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
+    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql15.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function positive(value2,fallback){return typeof value2==="number"&&Number.isFinite(value2)&&value2>0?value2:fallback}function resolveFetchLimits(options={}){let retries=typeof options.retries==="number"&&Number.isFinite(options.retries)?Math.min(1,Math.max(0,Math.floor(options.retries))):DISCOVERY_FETCH_DEFAULTS.retries,retryDelayMs=typeof options.retryDelayMs==="number"&&Number.isFinite(options.retryDelayMs)&&options.retryDelayMs>=0?options.retryDelayMs:DISCOVERY_FETCH_DEFAULTS.retryDelayMs;return{timeoutMs:positive(options.timeoutMs,DISCOVERY_FETCH_DEFAULTS.timeoutMs),maxBytes:positive(options.maxBytes,DISCOVERY_FETCH_DEFAULTS.maxBytes),retries,retryDelayMs,hookTimeoutMs:positive(options.hookTimeoutMs,DISCOVERY_FETCH_DEFAULTS.hookTimeoutMs)}}function withDeadline2(work,ms,onTimeout,onExpire){return new Promise((resolve2,reject)=>{let timer=setTimeout(()=>{onExpire?.(),reject(onTimeout())},ms);work.then((value2)=>{clearTimeout(timer),resolve2(value2)},(error3)=>{clearTimeout(timer),reject(error3)})})}function discoveryUrl(baseUrl,openapiPath){let joined=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,parsed;try{parsed=new URL(joined)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined}`,!1)}if(parsed.protocol!=="http:"&&parsed.protocol!=="https:")throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined} (only http and https are fetched)`,!1);return joined}async function discard2(response){await response.body?.cancel().catch(()=>{return})}async function readCapped(response,maxBytes,url){let tooLarge=()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI document exceeds ${maxBytes} bytes for ${url}`,!1),advertised=Number(response.headers.get("content-length"));if(Number.isFinite(advertised)&&advertised>maxBytes)throw await discard2(response),tooLarge();let body=response.body;if(!body)return"";let reader=body.getReader(),chunks=[],size=0;while(!0){let part=await reader.read();if(part.done)break;if(size+=part.value.byteLength,size>maxBytes)throw await reader.cancel().catch(()=>{return}),tooLarge();chunks.push(part.value)}return new TextDecoder().decode(Buffer.concat(chunks,size))}async function attempt(url,fetchImpl,limits){let controller=new AbortController,work=(async()=>{let response;try{response=await fetchImpl(url,{headers:{accept:"application/json"},redirect:"manual",signal:controller.signal})}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed for ${url}: ${reason}`,!0)}if(response.type==="opaqueredirect"||REDIRECT_STATUSES.has(response.status))throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch refused a redirect (${response.status}) for ${url}`,!1);if(!response.ok)throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed ${response.status} for ${url}`,response.status===429||response.status>=500);let text3;try{text3=await readCapped(response,limits.maxBytes,url)}catch(error3){if(error3 instanceof DiscoveryFetchError)throw error3;let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI body read failed for ${url}: ${reason}`,!0)}try{return JSON.parse(text3)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_document (not JSON) for ${url}`,!1)}})();try{return await withDeadline2(work,limits.timeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch timed out after ${limits.timeoutMs}ms for ${url}`,!0),()=>controller.abort())}finally{controller.abort()}}async function fetchDiscoveryJson(url,fetchImpl,options={}){let limits=resolveFetchLimits(options),lastError;for(let tried=0;tried<=limits.retries;tried++){if(tried>0)await Bun.sleep(limits.retryDelayMs);try{return await attempt(url,fetchImpl,limits)}catch(error3){if(lastError=error3,!(error3 instanceof DiscoveryFetchError&&error3.retryable))throw error3}}throw lastError}var DISCOVERY_FETCH_DEFAULTS,DiscoveryFetchError,REDIRECT_STATUSES;var init_fetch2=__esm(()=>{DISCOVERY_FETCH_DEFAULTS=Object.freeze({timeoutMs:5000,maxBytes:16777216,retries:1,retryDelayMs:250,hookTimeoutMs:60000});DiscoveryFetchError=class DiscoveryFetchError extends Error{retryable;constructor(message,retryable){super(message);this.name="DiscoveryFetchError",this.retryable=retryable}};REDIRECT_STATUSES=new Set([301,302,303,307,308])});function isDiscoveryHooks(value2){return typeof value2==="object"&&value2!==null&&"captureConfig"in value2&&typeof value2.captureConfig==="function"&&"fetchDocument"in value2&&typeof value2.fetchDocument==="function"&&"run"in value2&&typeof value2.run==="function"}function configureAuthorizationDiscovery(hooks){if(!isDiscoveryHooks(hooks))throw TypeError("configureAuthorizationDiscovery: captureConfig, fetchDocument and run must all be functions");return installed.set(hooks),()=>{if(installed.get()===hooks)installed.set(void 0)}}function authorizationDiscoveryHooks(){return installed.get()}function hostDiscoveryConfig(config){let view={};if(config.enabled!==void 0)view.enabled=config.enabled;if(config.runOnBoot!==void 0)view.runOnBoot=config.runOnBoot;if(config.services)view.services=config.services.map((service)=>{let copy2={id:service.id,baseUrl:service.baseUrl};if(service.openapi!==void 0)copy2.openapi=service.openapi;if(service.exclude)copy2.exclude=[...service.exclude];return copy2});return view}function hostRunCeilingMs(serviceCount,hookTimeoutMs){return(Math.max(0,serviceCount)+1)*hookTimeoutMs}function isDiscoveryResult(value2){return typeof value2==="object"&&value2!==null&&"services"in value2&&Array.isArray(value2.services)}function isThenable(value2){return typeof value2==="object"&&value2!==null&&"then"in value2&&typeof value2.then==="function"}function warnCaptureFailed(logger2,error3){logger2.warn("[Discovery] Host captureConfig hook failed",{error:error3 instanceof Error?error3.message:String(error3)})}function captureDiscoveryConfig(config,logger2){let hooks=authorizationDiscoveryHooks();if(!hooks)return;let returned;try{returned=hooks.captureConfig(hostDiscoveryConfig(config))}catch(error3){warnCaptureFailed(logger2,error3);return}if(isThenable(returned))Promise.resolve(returned).then(void 0,(error3)=>warnCaptureFailed(logger2,error3))}var installed;var init_hooks=__esm(()=>{installed=processRegistry("nucleus-core-ts.authorizationDiscovery.hooks.v1",isDiscoveryHooks)});var utf8;var init_routePath=__esm(()=>{utf8=new TextDecoder("utf-8",{ignoreBOM:!0})});var init_routeMatch=__esm(()=>{init_routePath()});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}function isRecord2(value2){return typeof value2==="object"&&value2!==null&&!Array.isArray(value2)}function toOperation(value2){let operation={};if(Array.isArray(value2.tags))operation.tags=value2.tags.filter((tag)=>typeof tag==="string");if(typeof value2.operationId==="string")operation.operationId=value2.operationId;if(typeof value2.summary==="string")operation.summary=value2.summary;if(typeof value2.description==="string")operation.description=value2.description;return operation}function toOpenApiDoc(value2){if(!isRecord2(value2))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (not a JSON object)",!1);if(value2.paths===void 0)return{};if(!isRecord2(value2.paths))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (paths is not an object)",!1);return{paths:Object.fromEntries(Object.entries(value2.paths).flatMap(([path7,item])=>isRecord2(item)?[[path7,operationsOf(item)]]:[]))}}function operationsOf(item){return Object.fromEntries(Object.entries(item).flatMap(([method,operation])=>isRecord2(operation)?[[method,toOperation(operation)]]:[]))}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(hooks){let{hookTimeoutMs}=resolveFetchLimits(options),document2=await withDeadline2(Promise.resolve().then(()=>hooks.fetchDocument(baseUrl,openapiPath,fetchImpl)),hookTimeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: host fetchDocument hook timed out after ${hookTimeoutMs}ms`,!0));return toOpenApiDoc(document2)}let url=discoveryUrl(baseUrl,openapiPath);return toOpenApiDoc(await fetchDiscoveryJson(url,fetchImpl,options))}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{init_routeMatch();init_fetch2();init_hooks();HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest,EMPTY_CATALOG_ERROR:()=>EMPTY_CATALOG_ERROR});import{eq as eq72,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){if(specs.length===0)throw Error(EMPTY_CATALOG_ERROR);let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq72(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq72(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(!hooks)return reconcileServices(db,schemaTables,config,logger2,fetchImpl,options);let services=config.services??[],execute=(serviceIds)=>reconcileServices(db,schemaTables,serviceIds?{...config,services:services.filter((svc)=>serviceIds.includes(svc.id))}:config,logger2,fetchImpl,options),ceilingMs=hostRunCeilingMs(services.length,resolveFetchLimits(options).hookTimeoutMs);logger2.info("[Discovery] Running through the host discovery hooks",{services:services.map((svc)=>svc.id),ceilingMs});let returned=await withDeadline2(Promise.resolve().then(()=>hooks.run(hostDiscoveryConfig(config),execute)),ceilingMs,()=>Error(`endpointDiscovery: host run hook timed out after ${ceilingMs}ms`));if(!isDiscoveryResult(returned))throw Error("endpointDiscovery: host run hook returned no DiscoveryResult");return returned}async function reconcileServices(db,schemaTables,config,logger2,fetchImpl,options){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl,options),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var EMPTY_CATALOG_ERROR="endpointDiscovery: empty_catalog";var init_seed=__esm(()=>{init_fetch2();init_hooks();init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord3(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord3(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord3(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord3(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord3(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});function covers(prefix,claim){return claim===prefix||claim.startsWith(`${prefix}.`)}function dotPrefixes(action,maxLength=action.length){let prefixes=[];for(let dot=action.indexOf(".");dot>=0&&dot<=maxLength;)prefixes.push(action.slice(0,dot)),dot=action.indexOf(".",dot+1);if(action.length<=maxLength)prefixes.push(action);return prefixes}function roleGrants(list2){let grants=new Set(list2.filter((grant)=>grant!=="")),above=new Set;for(let grant of grants){if(grant.endsWith(".*"))continue;for(let prefix of dotPrefixes(grant).slice(0,-1))above.add(prefix)}return{grants,above}}function catalogActions(catalog){return[...new Set(catalog)].filter((action)=>action!==""&&!action.endsWith(".*")).sort()}function family(guard4){if(guard4.valueType!=="int"||typeof guard4.threshold!=="number")return null;if(!Number.isFinite(guard4.threshold))return null;if(guard4.op==="gt"||guard4.op==="gte")return"upper";if(guard4.op==="lt"||guard4.op==="lte")return"lower";return null}function permissiveness(guard4){let threshold=typeof guard4.threshold==="number"?guard4.threshold:0;if(guard4.op==="gt"||guard4.op==="gte")return[threshold,guard4.op==="gt"?1:0];return[-threshold,guard4.op==="lt"?1:0]}function compare2(a,b){return a[0]!==b[0]?a[0]-b[0]:a[1]-b[1]}function keptCover(node,actions,dropped,catalog){let droppedHere=actions.filter((action)=>dropped.has(action)).length;if(droppedHere===0)return[node];if(droppedHere===actions.length)return[];if(catalog.has(node)&&!dropped.has(node))return[node];let children=new Map;for(let action of actions){if(action===node)continue;let rest3=action.slice(node.length+1),dot=rest3.indexOf("."),child=`${node}.${dot>=0?rest3.slice(0,dot):rest3}`,under=children.get(child);if(under)under.push(action);else children.set(child,[action])}return[...children].flatMap(([child,under])=>keptCover(child,under,dropped,catalog))}function decideAction(action,guards,roles,held,longestHeld){let prefixes=dotPrefixes(action,longestHeld),granting=new Set,partial3=new Set;for(let[roleId,role]of roles)if(prefixes.some((prefix)=>role.grants.has(prefix)))granting.add(roleId);else if(role.above.has(action))partial3.add(roleId);let heldPrefix=prefixes.find((prefix)=>held.has(prefix)),onAction=guards.map((guard4,index)=>({guard:guard4,index})).filter(({guard:guard4})=>granting.has(guard4.roleId)&&guard4.invalidates.some((entry)=>covers(entry,action))),guarded=new Set(onAction.map(({guard:guard4})=>guard4.roleId)),unlimited=[...granting].some((roleId)=>!guarded.has(roleId)),winners=new Map;if(unlimited)return{granting,partial:partial3,heldPrefix,unlimited,winners};let strictest=new Map;for(let entry of onAction){let kind=family(entry.guard);if(!kind)continue;let group=`${kind}:${entry.guard.key}`,byRole=strictest.get(group)??new Map;strictest.set(group,byRole);let known=byRole.get(entry.guard.roleId);if(!known||compare2(permissiveness(entry.guard),permissiveness(known.guard))<0)byRole.set(entry.guard.roleId,entry)}for(let[group,byRole]of strictest){let best;for(let candidate of byRole.values()){let order=best?compare2(permissiveness(candidate.guard),permissiveness(best.guard)):1;if(!best||order>0||order===0&&candidate.index<best.index)best=candidate}if(best)winners.set(group,best.guard.roleId)}return{granting,partial:partial3,heldPrefix,unlimited,winners}}function stillLimits(guard4,decision){if(!decision.granting.has(guard4.roleId)){if(!decision.partial.has(guard4.roleId))return!0;return decision.granting.size===0&&decision.heldPrefix!==void 0}if(decision.unlimited)return!1;let kind=family(guard4);if(!kind)return!0;return decision.winners.get(`${kind}:${guard4.key}`)===guard4.roleId}function suppressEntries(invalidates,limited,decide){let suppress=new Set(invalidates);for(let action of limited){let claim=decide(action).heldPrefix;if(claim!==void 0&&!dotPrefixes(claim).some((prefix)=>suppress.has(prefix)))suppress.add(claim)}return[...suppress]}function mostGenerousTargets(input){let{guards}=input,roles=new Map;for(let[roleId,grants]of input.grantsByRole)roles.set(roleId,roleGrants(grants));let held=new Set([...roles.values()].flatMap(({grants})=>[...grants]));for(let claim of input.heldWithoutGrant??[])if(claim!=="")held.add(claim);let heldList=[...held],longestHeld=heldList.reduce((longest,claim)=>Math.max(longest,claim.length),0),reached=(entry)=>heldList.some((claim)=>covers(entry,claim)||covers(claim,entry)),actions=catalogActions(input.catalog),actionSet=new Set(actions),decisions=new Map,decide=(action)=>{let known=decisions.get(action);if(known)return known;let decision=decideAction(action,guards,roles,held,longestHeld);return decisions.set(action,decision),decision};return guards.map((guard4)=>{let invalidates=new Set,limited=new Set;for(let target2 of guard4.invalidates){let under=actions.filter((action)=>covers(target2,action)),targetActions=under.length>0?under:[target2],dropped=new Set(targetActions.filter((action)=>!stillLimits(guard4,decide(action))));for(let entry of keptCover(target2,targetActions,dropped,actionSet))if(entry===target2||reached(entry))invalidates.add(entry);for(let action of targetActions)if(!dropped.has(action)&&actionSet.has(action))limited.add(action)}return{invalidates:[...invalidates],suppress:suppressEntries([...invalidates],[...limited],decide)}})}async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map,grantActionByClaimId=new Map,inactiveActionByClaimId=new Map;for(let c of claimRows){let action=String(c.action??""),policy=parseGuardPolicy(c.policy);if(c.isActive===!1){if(action)inactiveActionByClaimId.set(String(c.id),action)}else if(policy)guardByClaimId.set(String(c.id),{action,policy});else if(action)grantActionByClaimId.set(String(c.id),action)}if(guardByClaimId.size===0)return EMPTY;let mine=(await db.select().from(userRolesTable)).filter((r)=>String(r.userId??r.user_id)===userId),roleIds=new Set(mine.filter((r)=>r.isActive!==!1).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let assignedRoleIds=new Set(mine.map((r)=>String(r.roleId??r.role_id))),rcRows=(await db.select().from(roleClaimsTable)).filter((rc)=>assignedRoleIds.has(String(rc.roleId??rc.role_id))).map((row)=>({row,key:assignmentKey(row)})).sort((a,b)=>a.key<b.key?-1:a.key>b.key?1:0).map(({row})=>row),assignments=[],grantsByRole=new Map,heldWithoutGrant=[];for(let rc of rcRows){let roleId=String(rc.roleId??rc.role_id),claimId=String(rc.claimId??rc.claim_id),inactive=inactiveActionByClaimId.get(claimId);if(inactive){heldWithoutGrant.push(inactive);continue}let grant=grantActionByClaimId.get(claimId);if(rc.isActive===!1||!roleIds.has(roleId)){let action=grant??guardByClaimId.get(claimId)?.action;if(action)heldWithoutGrant.push(action);continue}if(grant){if(!countsAsGrant(rc.scope)){heldWithoutGrant.push(grant);continue}let held=grantsByRole.get(roleId);if(held)held.push(grant);else grantsByRole.set(roleId,[grant]);continue}let guard4=guardByClaimId.get(claimId);if(!guard4)continue;if(guard4.action)heldWithoutGrant.push(guard4.action);let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;assignments.push({roleId,action:guard4.action,policy:guard4.policy,condition})}if(assignments.length===0)return EMPTY;let keyOf=(a)=>resolveGuardKey(a.policy.keyTemplate,{userId,tenant:ctx.tenant}),targets=mostGenerousTargets({guards:assignments.map((a)=>({roleId:a.roleId,key:keyOf(a),valueType:a.policy.valueType,op:a.condition.op,threshold:a.condition.value,invalidates:a.condition.invalidates})),grantsByRole,heldWithoutGrant,catalog:[...grantActionByClaimId.values()]}),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let[index,assignment]of assignments.entries()){let invalidates=targets[index]?.invalidates??[],suppress=targets[index]?.suppress??invalidates;if(invalidates.length===0&&assignment.condition.invalidates.length>0)continue;let{policy,condition}=assignment,key2=keyOf(assignment),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,policy.valueType,condition),current=normalizeCurrent(value2,policy.valueType);if(guards.push({action:assignment.action,key:key2,valueType:policy.valueType,op:condition.op,threshold:condition.value,current,invalidates,holds}),holds&&suppress.length>0){for(let a of suppress)suppressed.add(a);firedGuards.push({action:assignment.action,key:key2,invalidates:suppress})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function countsAsGrant(scope){return!(typeof scope==="string"&&scope.includes("="))}function assignmentKey(row){return[row.roleId??row.role_id,row.claimId??row.claim_id,row.scope,row.id].map((value2)=>value2==null?"":typeof value2==="string"?value2:JSON.stringify(value2)).join("\x00")}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq73}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq73(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq73(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and34,eq as eq74,isNull as isNull9}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and34(eq74(col17(table,"challenge"),challenge),eq74(col17(table,"challengeType"),challengeType),isNull9(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq74(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq74(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq74(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard3(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard3(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard3,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg;captureDiscoveryConfig(discovery,logger2);let token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_hooks();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{batch,createStore}from"h-state";import{useEffectEvent}from"react";function createInitialState(endpoints){let state={};for(let key of Object.keys(endpoints))state[key]={isPending:!1,data:null,error:null,code:null};return state}function createActionsFacade(endpoints,buildAction){let cache=new Map;return new Proxy({},{get(_target,property){if(typeof property!=="string")return;if(!Object.hasOwn(endpoints,property))return;if(cache.has(property))return cache.get(property);let action=buildAction(property);return cache.set(property,action),action},has(_target,property){return typeof property==="string"&&Object.hasOwn(endpoints,property)},ownKeys(){return Object.keys(endpoints)},getOwnPropertyDescriptor(){return{enumerable:!0,configurable:!0}}})}function applyResponse(response,fallbackError){if(response.isSuccess&&response.data!==void 0)return{data:response.data,error:null,code:response.code??null};return{data:null,error:response.errors??fallbackError??null,code:response.code??null}}function createApiHook(endpoints,factory){let{useStore}=createStore(createInitialState(endpoints),{_callEndpoint:(store)=>async(endpointKey,options)=>{if(!store[endpointKey])return;batch(()=>{store[endpointKey].isPending=!0,store[endpointKey].error=null});try{let response=await factory(endpointKey,options.payload);if(batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].code=response.code??null;let applied=applyResponse(response);store[endpointKey].data=applied.data,store[endpointKey].error=applied.error}),response.isSuccess)options.onAfterHandle?.(response.data??response);else options.onErrorHandle?.(response.errors??{message:"Request failed"},response.code,response.requestId)}catch(err){batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].data=null,store[endpointKey].error={message:err instanceof Error?err.message:"Unknown error"}}),options.onErrorHandle?.({message:err instanceof Error?err.message:"Unknown error"},null)}}});return function(){let store=useStore(),callEndpoint=useEffectEvent((endpointKey,options)=>{store._callEndpoint(endpointKey,options)});return createActionsFacade(endpoints,(property)=>{let key=property;return{state:store[key],start:(options)=>{callEndpoint(key,options)}}})}}var system_tables_default={$schema:"../schemas/nucleus.tables.schema.json",tables:[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}]};function deriveAuthEndpoints(configs){let out={};for(let config of Object.values(configs)){let subs=config.subEndpoints??[{key:config.key,method:config.method,suffix:""}];for(let sub of subs){let base=sub.defaultRoute??config.defaultRoute,entry={method:sub.method??config.method,path:`${base}${sub.suffix??""}`},isPublic=sub.isPublic??config.defaultIsPublic;if(isPublic!==void 0)entry.isPublic=isPublic;entry._payload=sub._payload??config._payload,entry._success=sub._success??config._success,entry._error=sub._error??config._error,out[sub.key]=entry}}return out}var AUTH_ENDPOINT_CONFIGS={login:{key:"LOGIN",method:"POST",defaultRoute:"/auth/login",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},register:{key:"REGISTER",method:"POST",defaultRoute:"/auth/register",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},logout:{key:"LOGOUT",method:"POST",defaultRoute:"/auth/logout",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},refresh:{key:"REFRESH",method:"POST",defaultRoute:"/auth/refresh",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},me:{key:"ME",method:"GET",defaultRoute:"/auth/me",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordChange:{key:"PASSWORD_CHANGE",method:"POST",defaultRoute:"/auth/password-change",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordSet:{key:"PASSWORD_SET",method:"POST",defaultRoute:"/auth/password-set",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordReset:{key:"PASSWORD_RESET_REQUEST",method:"POST",defaultRoute:"/auth/password-reset",defaultIsPublic:!0,subEndpoints:[{key:"PASSWORD_RESET_REQUEST",method:"POST",suffix:"/request",_payload:void 0,_success:void 0,_error:void 0},{key:"PASSWORD_RESET_CONFIRM",method:"POST",suffix:"/confirm",_payload:void 0,_success:void 0,_error:void 0}]},sessions:{key:"SESSIONS",method:"GET",defaultRoute:"/auth/sessions",defaultIsPublic:!1,subEndpoints:[{key:"SESSIONS",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_CURRENT",method:"GET",suffix:"/current",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_STATS",method:"GET",suffix:"/stats",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_PENDING",method:"GET",suffix:"/pending",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE",method:"DELETE",suffix:"/:sessionId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE_ALL",method:"DELETE",suffix:"/all",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_LIST",method:"GET",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_REVOKE",method:"DELETE",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_APPROVE",method:"POST",suffix:"/approve",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REJECT",method:"POST",suffix:"/reject",_payload:void 0,_success:void 0,_error:void 0}]},magicLink:{key:"MAGIC_LINK",method:"POST",defaultRoute:"/auth/magic-link",defaultIsPublic:!0,subEndpoints:[{key:"MAGIC_LINK",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"MAGIC_LINK_VERIFY",method:"GET",suffix:"/verify",routeKey:"verifyRoute",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},invite:{key:"INVITE",method:"POST",defaultRoute:"/auth/invite",defaultIsPublic:!1,subEndpoints:[{key:"INVITE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"INVITE_VERIFY",method:"POST",suffix:"/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},emailVerification:{key:"VERIFY_EMAIL",method:"GET",defaultRoute:"/verify-email",defaultIsPublic:!0,subEndpoints:[{key:"VERIFY_EMAIL",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"RESEND_VERIFICATION",method:"POST",suffix:"",routeKey:"resendRoute",defaultRoute:"/resend-verification",_payload:void 0,_success:void 0,_error:void 0}]},captcha:{key:"CAPTCHA",method:"GET",defaultRoute:"/auth/captcha",defaultIsPublic:!0,subEndpoints:[{key:"CAPTCHA_GENERATE",method:"GET",suffix:"/generate",_payload:void 0,_success:void 0,_error:void 0},{key:"CAPTCHA_VALIDATE",method:"POST",suffix:"/validate",_payload:void 0,_success:void 0,_error:void 0}]},oauth:{key:"OAUTH_PROVIDERS",method:"GET",defaultRoute:"/auth/oauth",defaultIsPublic:!0,subEndpoints:[{key:"OAUTH_PROVIDERS",method:"GET",suffix:"/providers",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_REDIRECT",method:"GET",suffix:"/:provider",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_ACCOUNTS",method:"GET",suffix:"/accounts",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_UNLINK",method:"DELETE",suffix:"/unlink/:provider",_payload:void 0,_success:void 0,_error:void 0}]},webauthn:{key:"WEBAUTHN",method:"POST",defaultRoute:"/auth/webauthn",defaultIsPublic:!1,subEndpoints:[{key:"WEBAUTHN_REGISTER_OPTIONS",method:"POST",suffix:"/register/options",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REGISTER_VERIFY",method:"POST",suffix:"/register/verify",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_OPTIONS",method:"POST",suffix:"/authenticate/options",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_VERIFY",method:"POST",suffix:"/authenticate/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_LIST",method:"GET",suffix:"/credentials",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REVOKE",method:"DELETE",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_RENAME",method:"PATCH",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0}]},apiKeys:{key:"API_KEYS",method:"GET",defaultRoute:"/auth/api-keys",defaultIsPublic:!1,subEndpoints:[{key:"API_KEYS_CREATE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_LIST",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_DETAIL",method:"GET",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_UPDATE",method:"PATCH",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_REVOKE",method:"DELETE",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0}]}},ADMIN_ENDPOINTS={ADMIN_IMPERSONATE:{method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_IMPERSONATE_STOP:{method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CHANGE_USER_ID:{method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_USER:{method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_HARD_DELETE_USER:{method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_LOCK_USER:{method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UNLOCK_USER:{method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_MARK_EMAIL_VERIFIED:{method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},UNPUBLISHED_AUTH_KEYS=[];function publishedAuthEndpoints(){let all=deriveAuthEndpoints(AUTH_ENDPOINT_CONFIGS),excluded=new Set(UNPUBLISHED_AUTH_KEYS);return Object.fromEntries(Object.entries(all).filter(([key])=>!excluded.has(key)))}var AUTH_ENDPOINTS={...publishedAuthEndpoints(),...ADMIN_ENDPOINTS},CONFIG_ENDPOINTS={CONFIG_GET:{method:"GET",path:"/nucleus/config",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTIONS:{method:"GET",path:"/nucleus/config/sections",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_GET:{method:"GET",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_UPDATE:{method:"PATCH",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_ENV:{method:"GET",path:"/nucleus/config/env",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_GET:{method:"GET",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_CLEAR:{method:"DELETE",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_RESTART:{method:"POST",path:"/nucleus/config/restart",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},VERIFICATION_ENDPOINTS={VERIFICATION_STATUS:{method:"GET",path:"/verification/status/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_DECIDE:{method:"POST",path:"/verification/decide/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_CANCEL:{method:"POST",path:"/verification/:entity_name/:entity_id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_PENDING:{method:"GET",path:"/verification/pending",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_HISTORY:{method:"GET",path:"/verification/history/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START:{method:"POST",path:"/verification/start",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START_FOR_ENTITY:{method:"POST",path:"/verification/start-for-entity",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_ENTITY_STATUSES:{method:"GET",path:"/verification/entity-statuses/:entity_name",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_LIST:{method:"GET",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_GET:{method:"GET",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_SAVE:{method:"POST",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_FEASIBILITY:{method:"POST",path:"/verification/flows/feasibility",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_PUBLISH:{method:"POST",path:"/verification/flows/:flow_id/publish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_UNPUBLISH:{method:"POST",path:"/verification/flows/:flow_id/unpublish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_DELETE:{method:"DELETE",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_LIST:{method:"GET",path:"/notifications",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_UNSEEN_COUNT:{method:"GET",path:"/notifications/unseen-count",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_SEEN:{method:"POST",path:"/notifications/:notification_id/seen",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_ALL_SEEN:{method:"POST",path:"/notifications/seen-all",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},CHAT_ENDPOINTS={CHAT_LIST_CONVERSATIONS:{method:"GET",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_CREATE_CONVERSATION:{method:"POST",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_CONVERSATION:{method:"GET",path:"/chat/conversations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_MESSAGES:{method:"GET",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_SEND_MESSAGE:{method:"POST",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_MARK_READ:{method:"POST",path:"/chat/conversations/:id/read",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_TYPING:{method:"POST",path:"/chat/conversations/:id/typing",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_ADD_PARTICIPANTS:{method:"POST",path:"/chat/conversations/:id/participants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_REMOVE_PARTICIPANT:{method:"DELETE",path:"/chat/conversations/:id/participants/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_EDIT_MESSAGE:{method:"PATCH",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_DELETE_MESSAGE:{method:"DELETE",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MONITORING_ENDPOINTS={MONITORING_HEALTH_CHECK:{method:"GET",path:"/monitoring/health",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_SETTINGS:{method:"GET",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_CHANGE_SETTINGS:{method:"PATCH",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_LOGS:{method:"GET",path:"/monitoring/logs",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},PAYMENT_ENDPOINTS={PAYMENT_INITIALIZE:{method:"POST",path:"/payments/initialize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTIONS:{method:"GET",path:"/payments/transactions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTION_DETAIL:{method:"GET",path:"/payments/transactions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_BIN_QUERY:{method:"POST",path:"/payments/bin-query",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DETAIL:{method:"POST",path:"/payments/payment-detail",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REFUND:{method:"POST",path:"/payments/refund",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SAVE_CARD:{method:"POST",path:"/payments/cards/save",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CARDS:{method:"GET",path:"/payments/cards",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CARD:{method:"DELETE",path:"/payments/cards/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SYNC_CARDS:{method:"POST",path:"/payments/cards/sync",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REGISTER_SUB_MERCHANT:{method:"POST",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUB_MERCHANT:{method:"PUT",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUB_MERCHANTS:{method:"GET",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUB_MERCHANT:{method:"GET",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SPLITS:{method:"GET",path:"/payments/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_APPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DISAPPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/disapprove",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRODUCT:{method:"POST",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRODUCT:{method:"PUT",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRODUCTS:{method:"GET",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRODUCT:{method:"GET",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRODUCT:{method:"DELETE",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRICE:{method:"POST",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRICE:{method:"PUT",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRICES:{method:"GET",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRICE:{method:"GET",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRICE:{method:"DELETE",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_CUSTOMER:{method:"POST",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_CUSTOMER:{method:"PUT",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CUSTOMERS:{method:"GET",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_CUSTOMER:{method:"GET",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CUSTOMER:{method:"DELETE",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUBSCRIPTION:{method:"PUT",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUBSCRIPTIONS:{method:"GET",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUBSCRIPTION:{method:"GET",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REPORT_USAGE:{method:"POST",path:"/payments/usage-records",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_USAGE_SUMMARIES:{method:"GET",path:"/payments/usage-records/:subscriptionItemId/summaries",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_INVOICE:{method:"POST",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_FINALIZE_INVOICE:{method:"POST",path:"/payments/invoices/:id/finalize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SEND_INVOICE:{method:"POST",path:"/payments/invoices/:id/send",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_VOID_INVOICE:{method:"POST",path:"/payments/invoices/:id/void",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_PAY_INVOICE:{method:"POST",path:"/payments/invoices/:id/pay",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_INVOICES:{method:"GET",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_INVOICE:{method:"GET",path:"/payments/invoices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_BALANCE:{method:"GET",path:"/payments/balance",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PAYOUT:{method:"POST",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PAYOUTS:{method:"GET",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PAYOUT:{method:"GET",path:"/payments/payouts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_PAYOUT:{method:"POST",path:"/payments/payouts/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_TRANSFER:{method:"POST",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_TRANSFERS:{method:"GET",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},TENANT_ENDPOINTS={TENANT_CHECK_SUBDOMAIN:{method:"GET",path:"/tenants/check-subdomain/:subdomain",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},TENANT_PROVISION:{method:"POST",path:"/tenants/provision",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_LIST:{method:"GET",path:"/tenants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_DETAIL:{method:"GET",path:"/tenants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SUSPEND:{method:"POST",path:"/tenants/:id/suspend",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_REACTIVATE:{method:"POST",path:"/tenants/:id/reactivate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SELF_SIGNUP:{method:"POST",path:"/tenants/self-signup",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}},DOMAIN_ENDPOINTS={DOMAIN_RESOLVE:{method:"GET",path:"/domains/resolve",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_HOSTNAME:{method:"POST",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_HOSTNAMES:{method:"GET",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_HOSTNAME:{method:"GET",path:"/domains/hostnames/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_HOSTNAME_INSTRUCTIONS:{method:"GET",path:"/domains/hostnames/:id/instructions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_VERIFY_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/verify",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_ACTIVATE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/activate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_DISABLE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/disable",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_MAKE_PRIMARY:{method:"POST",path:"/domains/hostnames/:id/make-primary",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_REFRESH_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/refresh-status",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_REGISTRATION:{method:"POST",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_REGISTRATIONS:{method:"GET",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_REGISTRATION:{method:"GET",path:"/domains/registrations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CANCEL_REGISTRATION:{method:"POST",path:"/domains/registrations/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_TRANSFER_OUT:{method:"POST",path:"/domains/registrations/:id/transfer-out",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MARKETPLACE_ENDPOINTS={PAYMENT_MARKETPLACE_RECORD_SPLIT:{method:"POST",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_SPLITS:{method:"GET",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_BALANCE:{method:"GET",path:"/payment/marketplace/balance/:ownerId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RELEASE_RESERVE:{method:"POST",path:"/payment/marketplace/reserves/:id/release",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_SETTLEMENT_POLICY:{method:"GET",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_UPSERT_SETTLEMENT_POLICY:{method:"POST",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REQUEST_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_PAYOUTS:{method:"GET",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_PAYOUT:{method:"GET",path:"/payment/marketplace/payout-requests/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_APPROVE_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REJECT_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/reject",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_OPEN_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_DISPUTES:{method:"GET",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RESOLVE_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes/:id/resolve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},COHORT_ENDPOINTS={ADMIN_LIST_COHORTS:{method:"GET",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_GET_COHORT:{method:"GET",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_COHORT:{method:"POST",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UPDATE_COHORT:{method:"PATCH",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_DELETE_COHORT:{method:"DELETE",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_BULK_CREATE:{method:"POST",path:"/auth/admin/cohorts/:id/bulk-create",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DEACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/deactivate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_ACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/activate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DELETE_USERS:{method:"POST",path:"/auth/admin/cohorts/:id/delete-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_EXPORT:{method:"GET",path:"/auth/admin/cohorts/:id/export",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}};var SYSTEM_TABLE_NAMES=["profiles","addresses","phones","files","users","roles","claims","user_roles","role_claims","audit_logs","monitoring_metrics","integration_sources","integration_endpoints","integration_mappings","integration_runs","integration_run_items"],systemTables=system_tables_default.tables.filter((t)=>SYSTEM_TABLE_NAMES.includes(t.table_name));function toUpperSnakeCase(str){return str.replace(/([a-z])([A-Z])/g,"$1_$2").replace(/[\s-]+/g,"_").toUpperCase()}function snakeToCamelCase(str){return str.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function singularize(str){if(str.endsWith("ies"))return`${str.slice(0,-3)}y`;if(str.endsWith("ses"))return`${str.slice(0,-2)}`;if(str.endsWith("s"))return str.slice(0,-1);return str}function generateEntityEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName),singularName=toUpperSnakeCase(singularize(tableName));switch(method){case"GET":return`GET_${upperName}`;case"POST":return`ADD_${singularName}`;case"PUT":return`UPDATE_${singularName}`;case"PATCH":return`PATCH_${singularName}`;case"DELETE":return`DELETE_${singularName}`}}function generateBulkEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName);switch(method){case"POST":return`BULK_ADD_${upperName}`;case"PUT":return`BULK_UPDATE_${upperName}`;case"DELETE":return`BULK_DELETE_${upperName}`}}function isMethodExcluded(table,method){if(!table.excluded_methods)return!1;let methodMap={GET:"GET",POST:"POST",PUT:"PUT",PATCH:"PATCH",DELETE:"DELETE"};return table.excluded_methods.includes(methodMap[method])}function generateEndpointsFromConfig(config){let endpoints={};for(let table of config.entities){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,sid=table.serviceId;if(!isMethodExcluded(table,"GET")){endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0},endpoints[`GET_${toUpperSnakeCase(tableName)}_DISTINCT`]={method:"GET",path:`${basePath}/distinct/:field`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}if(!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:table.is_public?.POST??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:table.is_public?.PUT??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:table.is_public?.PATCH??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled){if(!isMethodExcluded(table,"POST"))endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:table.is_public?.POST??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:table.is_public?.PUT??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}}return endpoints}function generateAuthEndpoints(config){let endpoints={},auth=config.authentication;if(!auth?.enabled)return endpoints;for(let[featureKey,endpointConfig]of Object.entries(AUTH_ENDPOINT_CONFIGS)){let feature=auth[featureKey];if(!feature?.enabled)continue;let feat=feature,baseRoute=feat.route||endpointConfig.defaultRoute,isPublic=feat.isPublic??endpointConfig.defaultIsPublic;if("subEndpoints"in endpointConfig&&endpointConfig.subEndpoints)for(let sub of endpointConfig.subEndpoints){let subRoute="routeKey"in sub&&sub.routeKey&&feature[sub.routeKey]?String(feature[sub.routeKey]):("defaultRoute"in sub)&&sub.defaultRoute?String(sub.defaultRoute):`${baseRoute}${sub.suffix}`,subIsPublic="isPublic"in sub&&typeof sub.isPublic==="boolean"?sub.isPublic:isPublic;endpoints[sub.key]={method:sub.method,path:subRoute,isPublic:subIsPublic,_payload:sub._payload,_success:sub._success,_error:sub._error}}else if("_payload"in endpointConfig)endpoints[endpointConfig.key]={method:endpointConfig.method,path:baseRoute,isPublic,_payload:endpointConfig._payload,_success:endpointConfig._success,_error:endpointConfig._error}}return endpoints}function generateSystemTableEndpoints(){let endpoints={};for(let table of systemTables){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,isFormData=tableName==="files";endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));if(endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled)endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}}return endpoints}function generateMonitoringEndpoints(config){if(!config.liveMonitoring?.enabled)return{};return{...MONITORING_ENDPOINTS}}function generateAdminEndpoints(config){let endpoints={};if(!config.authentication?.enabled)return endpoints;return endpoints.ADMIN_IMPERSONATE={method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_IMPERSONATE_STOP={method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CHANGE_USER_ID={method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CREATE_USER={method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_HARD_DELETE_USER={method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_LOCK_USER={method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_UNLOCK_USER={method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_MARK_EMAIL_VERIFIED={method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generateCohortEndpoints(config){let auth=config.authentication;if(!auth?.enabled||!auth.cohorts?.enabled)return{};return{...COHORT_ENDPOINTS}}function generateVerificationEndpoints(config){let endpoints={},verification=config.verification;if(!verification?.enabled)return endpoints;let basePath=verification.endpoints?.basePath||"/verifications",flowBasePath=verification.flowEndpoints?.basePath||"/verification-flows";if(endpoints.VERIFICATION_STATUS={method:"GET",path:`${basePath}/status/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_DECIDE={method:"POST",path:`${basePath}/:entity_name/:entity_id/decide`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_CANCEL={method:"POST",path:`${basePath}/:entity_name/:entity_id/cancel`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_PENDING={method:"GET",path:`${basePath}/pending`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_HISTORY={method:"GET",path:`${basePath}/history/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START={method:"POST",path:`${basePath}/start`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START_FOR_ENTITY={method:"POST",path:`${basePath}/start-for-entity`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_ENTITY_STATUSES={method:"GET",path:`${basePath}/statuses/:entity_name`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},verification.flowEndpoints?.enabled!==!1)endpoints.FLOW_LIST={method:"GET",path:flowBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_GET={method:"GET",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_SAVE={method:"POST",path:flowBasePath,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_FEASIBILITY={method:"POST",path:`${flowBasePath}/feasibility`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_PUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/publish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_UNPUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/unpublish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_DELETE={method:"DELETE",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};return endpoints}function generateNotificationEndpoints(config){let endpoints={},notification=config.notification;if(!notification?.enabled||notification.endpoints?.enabled===!1)return endpoints;let notifBasePath=notification.endpoints?.basePath||"/notifications";return endpoints.NOTIFICATION_LIST={method:"GET",path:notifBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_UNSEEN_COUNT={method:"GET",path:`${notifBasePath}/unseen-count`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_SEEN={method:"POST",path:`${notifBasePath}/:notification_id/seen`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_ALL_SEEN={method:"POST",path:`${notifBasePath}/seen-all`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generatePaymentEndpoints(config){if(!config.payment?.enabled)return{};return{...PAYMENT_ENDPOINTS}}function generateConfigEndpoints(config){if(!config.configManagement?.enabled)return{};return{...CONFIG_ENDPOINTS}}function generateTenantEndpoints(config){if(!config.database?.isMultiTenant)return{};return{...TENANT_ENDPOINTS}}function generateChatEndpoints(config){if(!config.chat?.enabled)return{};return{...CHAT_ENDPOINTS}}function generateDomainEndpoints(config){if(!config.domains?.enabled)return{};return{...DOMAIN_ENDPOINTS}}function generateMarketplaceEndpoints(config){let payment=config.payment;if(!payment?.enabled||!payment.marketplace?.enabled)return{};return{...MARKETPLACE_ENDPOINTS}}function generateAllEndpoints(config,extraEndpoints){let entityEndpoints=generateEndpointsFromConfig(config),authEndpoints=generateAuthEndpoints(config),adminEndpoints=generateAdminEndpoints(config),cohortEndpoints=generateCohortEndpoints(config),systemEndpoints=generateSystemTableEndpoints(),monitoringEndpoints=generateMonitoringEndpoints(config),verificationEndpoints=generateVerificationEndpoints(config),chatEndpoints=generateChatEndpoints(config),tenantEndpoints=generateTenantEndpoints(config),domainEndpoints=generateDomainEndpoints(config),marketplaceEndpoints=generateMarketplaceEndpoints(config),notificationEndpoints=generateNotificationEndpoints(config),paymentEndpoints=generatePaymentEndpoints(config),configEndpoints=generateConfigEndpoints(config);return{...entityEndpoints,...authEndpoints,...adminEndpoints,...cohortEndpoints,...systemEndpoints,...monitoringEndpoints,...verificationEndpoints,...chatEndpoints,...tenantEndpoints,...domainEndpoints,...marketplaceEndpoints,...notificationEndpoints,...paymentEndpoints,...configEndpoints,...extraEndpoints??{}}}init_Logger();var DEFAULT_CONFIG2={timeout:30000,retries:0,retryDelay:1000,debug:!1};class ServerFetch{config;logger;constructor(config={}){this.config={...DEFAULT_CONFIG2,...config},this.logger=new Logger({service:"ServerFetch",prettyPrint:this.config.debug,colorize:this.config.debug,auditEnabled:!1})}buildUrl(url){if(url.startsWith("http://")||url.startsWith("https://"))return url;return this.config.baseUrl?`${this.config.baseUrl}${url}`:url}buildHeaders(customHeaders){let headers=new Headers;if(this.config.defaultHeaders)for(let[key,value]of Object.entries(this.config.defaultHeaders))headers.set(key,value);if(customHeaders)if(customHeaders instanceof Headers)customHeaders.forEach((value,key)=>{headers.set(key,value)});else if(Array.isArray(customHeaders))for(let[key,value]of customHeaders)headers.set(key,value);else for(let[key,value]of Object.entries(customHeaders))headers.set(key,value);return headers}parseResponseHeaders(headers){let result={};if(headers.forEach((value,key)=>{if(key.toLowerCase()==="set-cookie"){let existing=result[key];result[key]=existing?`${existing}, ${value}`:value}else result[key]=value}),typeof headers.getSetCookie==="function"){let setCookies=headers.getSetCookie();if(setCookies.length>0)result["set-cookie"]=setCookies.join(", ")}return result}async executeWithTimeout(promise,timeoutMs,_requestId){let controller=new AbortController,timeoutId=setTimeout(()=>controller.abort(),timeoutMs);try{return await Promise.race([promise,new Promise((_,reject)=>{controller.signal.addEventListener("abort",()=>{reject(Error(`Request timeout after ${timeoutMs}ms`))})})])}finally{clearTimeout(timeoutId)}}async fetch(options){let requestId=randomId(),startTime=performance.now(),url=this.buildUrl(options.url),headers=this.buildHeaders(options.headers),timeout=options.timeout??this.config.timeout??30000,retries=options.retries??this.config.retries??0,retryDelay=options.retryDelay??this.config.retryDelay??1000,body;if(options.body)if(typeof options.body==="object"&&!(options.body instanceof FormData)&&!(options.body instanceof URLSearchParams)&&!(options.body instanceof Blob)&&!(options.body instanceof ArrayBuffer)){if(body=JSON.stringify(options.body),!headers.has("content-type"))headers.set("content-type","application/json")}else body=options.body;this.logger.debug(`[${requestId}] ${options.method} ${url}`,{method:options.method,url,hasBody:!!body});let lastError=null,attempt=0;while(attempt<=retries)try{let response=await this.executeWithTimeout(fetch(url,{method:options.method,headers,body}),timeout,requestId),durationMs2=performance.now()-startTime,responseHeaders=this.parseResponseHeaders(response.headers),rawSetCookies=typeof response.headers.getSetCookie==="function"?response.headers.getSetCookie():[],responseData,errorData,rawText=await response.text();if(rawText)try{let json=JSON.parse(rawText);if(response.ok)responseData=json;else errorData=json}catch{if(!response.ok)errorData={message:rawText||response.statusText}}else if(!response.ok)errorData={message:response.statusText};let result={isSuccess:response.ok,response:responseData,errors:errorData,code:response.status,headers:responseHeaders,rawSetCookies,durationMs:durationMs2,requestId,createdAt:new Date};if(response.ok)this.logger.info(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2)});else this.logger.warn(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2),error:errorData});return result}catch(error){if(lastError=error instanceof Error?error:Error(String(error)),attempt++,attempt<=retries)this.logger.warn(`[${requestId}] Retry ${attempt}/${retries} after error`,{method:options.method,url,error:lastError.message,attempt,retries}),await new Promise((resolve)=>setTimeout(resolve,retryDelay))}let durationMs=performance.now()-startTime;return this.logger.error(`[${requestId}] ${options.method} ${url} failed`,lastError,{method:options.method,url,durationMs:Math.round(durationMs),attempts:attempt}),{isSuccess:!1,response:void 0,errors:{message:lastError?.message||"Unknown error"},code:null,headers:{},rawSetCookies:[],durationMs,requestId,createdAt:new Date}}async get(url,options){return this.fetch({...options,url,method:"GET"})}async post(url,body,options){return this.fetch({...options,url,method:"POST",body})}async put(url,body,options){return this.fetch({...options,url,method:"PUT",body})}async patch(url,body,options){return this.fetch({...options,url,method:"PATCH",body})}async delete(url,options){return this.fetch({...options,url,method:"DELETE"})}}var serverFetch=new ServerFetch;var RESPONSE_CONTROL_FLAGS=["requiresCaptcha","requiresApproval","attemptsRemaining","requestId","code","detail"];function serverRequestId(response){let fromBody=(value)=>{if(!value||typeof value!=="object")return;let id=value.requestId;return typeof id==="string"&&id.length>0?id:void 0};return fromBody(response.errors)??fromBody(response.response)??response.headers?.["x-request-id"]??void 0}function normalizeResponseShape(response){if(!response||typeof response!=="object"||Array.isArray(response))return response;let raw=response;if(!("success"in raw)||"data"in raw)return response;let{success,isSuccess,message,error,...rest}=raw,controlFlags={};for(let flag of RESPONSE_CONTROL_FLAGS)if(flag in rest)controlFlags[flag]=rest[flag],delete rest[flag];return{success,...isSuccess!==void 0?{isSuccess}:{},...message!==void 0?{message}:{},...error!==void 0?{error}:{},...controlFlags,...Object.keys(rest).length>0?{data:rest}:{}}}var DEFAULT_TOKEN_NAMES={accessToken:"access_token",refreshToken:"refresh_token",sessionToken:"session_token"};function splitSetCookieHeader(header){let cookies=[],current="";for(let i=0;i<header.length;i++){let char=header[i];if(char===","){let next=header.slice(i+1).trimStart();if(/^[a-zA-Z0-9_-]+=/.test(next)){cookies.push(current.trim()),current="";continue}}current+=char}if(current.trim())cookies.push(current.trim());return cookies}function buildRequestHeaders(headersStore,tokenNames){let headers={},forwardHeaders=["x-forwarded-for","x-real-ip","user-agent","accept-language","x-request-id","x-client-ip","cf-connecting-ip","true-client-ip","x-tenant-id","x-app-origin"];for(let header of forwardHeaders){let value=headersStore.get(header);if(value)headers[header]=value}if(!headers["user-agent"])headers["user-agent"]="Nucleus-ServerAction/1.0";let accessToken=headersStore.get(`x-${tokenNames.accessToken}`),refreshToken=headersStore.get(`x-${tokenNames.refreshToken}`),sessionToken=headersStore.get(`x-${tokenNames.sessionToken}`);if(accessToken)headers[`x-${tokenNames.accessToken}`]=accessToken;if(refreshToken)headers[`x-${tokenNames.refreshToken}`]=refreshToken;if(sessionToken)headers[`x-${tokenNames.sessionToken}`]=sessionToken;let cookieHeader=headersStore.get("cookie");if(cookieHeader)headers.cookie=cookieHeader;return headers}function toCamelCase(str){return str.replace(/_([a-z])/g,(_,c)=>c.toUpperCase())}function convertKeysToCamelCase(obj){let result={};for(let[key,value]of Object.entries(obj)){let camelKey=key.startsWith("_")?key:toCamelCase(key);if(value instanceof Date)result[camelKey]=value.toISOString();else if(value&&typeof value==="object"&&!Array.isArray(value))result[camelKey]=convertKeysToCamelCase(value);else result[camelKey]=value}return result}var JSON_STRINGIFY_KEYS=new Set(["filters","sort","with","searchFields","select","distinctOn"]);function appendQueryParams(url,params){let searchParams=new URLSearchParams;for(let[key,value]of Object.entries(params)){if(value===void 0||value===null)continue;if(JSON_STRINGIFY_KEYS.has(key)&&typeof value==="object"){searchParams.append(key,JSON.stringify(value));continue}if(value instanceof Date)searchParams.append(key,value.toISOString());else if(Array.isArray(value))searchParams.append(key,value.filter((v)=>v!=null).map(String).join(","));else if(typeof value==="object")searchParams.append(key,JSON.stringify(value));else searchParams.append(key,String(value))}let queryString=searchParams.toString();if(!queryString)return url;return url.includes("?")?`${url}&${queryString}`:`${url}?${queryString}`}var DEFAULT_REFRESH_EXCLUDED=["/auth/login","/auth/logout","/auth/register","/auth/refresh"];function mergeCookieHeader(existing,setCookies){let jar=new Map;for(let part of(existing??"").split(";")){let eq=part.indexOf("=");if(eq<=0)continue;jar.set(part.slice(0,eq).trim(),part.slice(eq+1).trim())}for(let raw of setCookies){let[pair]=raw.split(";");if(!pair)continue;let eq=pair.indexOf("=");if(eq<=0)continue;let name=pair.slice(0,eq).trim(),value=pair.slice(eq+1).trim();if(value===""||/max-age\s*=\s*0(?!\d)/i.test(raw))jar.delete(name);else jar.set(name,value)}return Array.from(jar,([k,v])=>`${k}=${v}`).join("; ")}function setCookiesOf(response){if(response.rawSetCookies.length>0)return response.rawSetCookies;let joined=response.headers["set-cookie"];return joined?splitSetCookieHeader(joined):[]}function createServerFactory(endpoints,config,getCookies,getHeaders){let tokenNames={...DEFAULT_TOKEN_NAMES,...config.tokenNames},serverFetch2=new ServerFetch({baseUrl:config.baseUrl,debug:config.debug,timeout:30000,retries:0});return async function(endpointKey,payload){let endpoint=endpoints[endpointKey];if(!endpoint)return{isSuccess:!1,errors:{message:`Endpoint "${endpointKey}" not found`},code:404};let cookieStore=await getCookies(),headersStore=await getHeaders(),allHeaders={};if(headersStore.forEach((value,key)=>{allHeaders[key]=value}),(endpoint.path.includes("/auth/login")||endpoint.path.includes("/auth/oauth"))&&endpoint.method==="POST")try{cookieStore.delete(tokenNames.accessToken),cookieStore.delete(tokenNames.refreshToken),cookieStore.delete(tokenNames.sessionToken)}catch(_){}let headers=buildRequestHeaders(headersStore,tokenNames),url=endpoint.path,body,pathParamNames=new Set,pathParamRegex=/:([a-zA-Z_][a-zA-Z0-9_]*)/g,paramMatch=pathParamRegex.exec(url);while(paramMatch!==null){if(paramMatch[1])pathParamNames.add(paramMatch[1]);paramMatch=pathParamRegex.exec(url)}if(payload&&typeof payload==="object"&&!(payload instanceof FormData)){let payloadObj=payload;for(let[key,value]of Object.entries(payloadObj))if(value!=null){if(pathParamNames.has(key))url=url.replace(`:${key}`,String(value));else if(key.startsWith("_")&&pathParamNames.has(key.substring(1)))url=url.replace(`:${key.substring(1)}`,String(value));else if(key==="id"&&pathParamNames.has("id"))url=url.replace(":id",String(value))}}if(endpoint.method==="GET"&&payload&&typeof payload==="object"){let queryPayload={...payload};for(let paramName of pathParamNames)delete queryPayload[paramName],delete queryPayload[`_${paramName}`];url=appendQueryParams(url,queryPayload)}else if(payload!==void 0){if(endpoint.isFormData&&payload instanceof FormData)body=payload;else if(Array.isArray(payload)){if(body=payload.map((item)=>item&&typeof item==="object"?convertKeysToCamelCase(item):item),!headers["content-type"])headers["content-type"]="application/json"}else if(body=endpoint.skipCamelCase?payload:convertKeysToCamelCase(payload),!headers["content-type"])headers["content-type"]="application/json"}let send=(requestHeaders)=>serverFetch2.fetch({url,method:endpoint.method,headers:requestHeaders,body}),response=await send(headers),refreshCfg=config.refresh;if(response.code===401&&refreshCfg?.enabled!==!1&&!(refreshCfg?.excludePaths??DEFAULT_REFRESH_EXCLUDED).some((p)=>endpoint.path.includes(p))){let refreshResponse=await serverFetch2.fetch({url:refreshCfg?.endpoint??"/auth/refresh",method:"POST",headers}),issued=setCookiesOf(refreshResponse);if(refreshResponse.isSuccess&&issued.length>0)applySetCookieHeaders(cookieStore,issued),response=await send({...headers,cookie:mergeCookieHeader(headers.cookie,issued)})}let setCookiesToProcess=response.rawSetCookies.length>0?response.rawSetCookies:response.headers["set-cookie"]?splitSetCookieHeader(response.headers["set-cookie"]):[];if(setCookiesToProcess.length>0)applySetCookieHeaders(cookieStore,setCookiesToProcess);let normalizedResponse=response.response;if(response.isSuccess)normalizedResponse=normalizeResponseShape(normalizedResponse);return{isSuccess:response.isSuccess,data:normalizedResponse,errors:response.errors,code:response.code,requestId:serverRequestId(response),message:response.isSuccess?void 0:response.errors?.message}}}function applySetCookieHeaders(cookieStore,setCookies){try{for(let cookie of setCookies){let[nameValue,...options]=cookie.split(";");if(!nameValue)continue;let eqIdx=nameValue.indexOf("=");if(eqIdx===-1)continue;let name=nameValue.substring(0,eqIdx).trim(),value=nameValue.substring(eqIdx+1).trim();if(!name)continue;let cookieOptions={},maxAge;for(let opt of options){let trimmed=opt.trim(),optEqIdx=trimmed.indexOf("="),optName=optEqIdx===-1?trimmed:trimmed.substring(0,optEqIdx),optValue=optEqIdx===-1?void 0:trimmed.substring(optEqIdx+1);if(!optName)continue;let optNameLower=optName.toLowerCase();if(optNameLower==="path")cookieOptions.path=optValue;else if(optNameLower==="domain")cookieOptions.domain=optValue;else if(optNameLower==="max-age")maxAge=Number(optValue),cookieOptions.maxAge=maxAge;else if(optNameLower==="expires"&&optValue)cookieOptions.expires=new Date(optValue);else if(optNameLower==="httponly")cookieOptions.httpOnly=!0;else if(optNameLower==="secure")cookieOptions.secure=!0;else if(optNameLower==="samesite")cookieOptions.sameSite=optValue}if(value===""||maxAge!==void 0&&maxAge<=0)cookieStore.delete(name);else cookieStore.set(name,value,cookieOptions)}}catch(cookieError){console.warn("[ServerFactory] Failed to process Set-Cookie headers:",cookieError instanceof Error?cookieError.message:String(cookieError))}}var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];import{batch as batch2,createStore as createStore2}from"h-state";var initialState={connection:{status:"disconnected",clientId:null,subscribedTopics:[],error:null,reconnectAttempt:0},events:[],maxEvents:100},{useStore:usePubSubStore}=createStore2(initialState,{setConnectionStatus:(store)=>(status)=>{store.connection.status=status},setClientId:(store)=>(clientId)=>{store.connection.clientId=clientId},setSubscribedTopics:(store)=>(topics)=>{store.connection.subscribedTopics=topics},setError:(store)=>(error)=>{store.connection.error=error},setReconnectAttempt:(store)=>(attempt)=>{store.connection.reconnectAttempt=attempt},addEvent:(store)=>(event)=>{let updated=[event,...store.events];store.events=updated.slice(0,store.maxEvents)},clearEvents:(store)=>()=>{store.events=[]},reset:(store)=>()=>{batch2(()=>{store.connection.status="disconnected",store.connection.clientId=null,store.connection.subscribedTopics=[],store.connection.error=null,store.connection.reconnectAttempt=0,store.events=[]})}});import{useEffect}from"react";var SYNTHESIZED_AUTH_HEADER="x-nucleus-auth-synthesized";function sessionEndedByProxy(response){return response.status===401&&response.headers.get("x-nucleus-auth-synthesized")==="session-ended"}var WINDOW_EVENTS=["online","focus","pageshow"];function armReturnListeners(env,onReturn){let fired=!1,timer=null,setTimer=env.setTimeout??((fn,ms)=>{let handle=setTimeout(fn,ms);return handle.unref?.(),handle}),clearTimer=env.clearTimeout??((h)=>clearTimeout(h)),disarm=()=>{for(let type of WINDOW_EVENTS)env.window.removeEventListener(type,check);if(env.document.removeEventListener("visibilitychange",check),timer!==null)clearTimer(timer),timer=null};function fire(){if(fired)return;fired=!0,disarm(),onReturn()}function check(){if(fired)return;if(env.document.visibilityState==="hidden")return;if(env.navigator?.onLine===!1)return;fire()}for(let type of WINDOW_EVENTS)env.window.addEventListener(type,check);return env.document.addEventListener("visibilitychange",check),timer=setTimer(fire,120000),()=>{fired=!0,disarm()}}function buildWsUrl(config){let path=config.wsPath||"/api/events/subscribe",topics=(config.topics||["*"]).join(","),query=`?userId=${encodeURIComponent(config.userId)}&topics=${encodeURIComponent(topics)}`;if(config.wsUrl)return`${config.wsUrl.replace(/\/$/,"")}${path}${query}`;if(typeof window>"u")return"";return`${window.location.protocol==="https:"?"wss:":"ws:"}//${window.location.host}${path}${query}`}var connections=new Map,eventIdCounter=0;function log(conn,...args){if(conn.options.debug)console.log("[usePubSub]",...args)}function clearTimers(conn){if(conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout),conn.reconnectTimeout=null;if(conn.stopWaitingForReturn)conn.stopWaitingForReturn(),conn.stopWaitingForReturn=null}function detachSocket(conn){let ws=conn.ws;if(!ws)return;if(ws.onopen=null,ws.onmessage=null,ws.onerror=null,ws.onclose=null,ws.readyState===WebSocket.OPEN||ws.readyState===WebSocket.CONNECTING)ws.close();conn.ws=null}function startHeartbeat(conn){if(conn.heartbeat)clearInterval(conn.heartbeat);conn.heartbeat=setInterval(()=>{if(conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ping"}))},conn.options.heartbeatInterval)}var HANDSHAKE_FAILURE_LIMIT=3;async function confirmSessionThenDecide(conn){let path=conn.options.sessionProbePath;if(!path){log(conn,"Handshake failing; no probe configured, continuing to reconnect"),conn.handshakeFailures=0,scheduleReconnect(conn);return}try{let res=await fetch(path,{credentials:"include",method:"GET"});if(res.status===401||res.status===403)if(res.headers.get(SYNTHESIZED_AUTH_HEADER)&&!sessionEndedByProxy(res))log(conn,"Probe 401 came from the proxy, not the API; treating as a network problem");else{conn.dispatch.setConnectionStatus("unauthorized"),conn.dispatch.setError(Error("Session is no longer valid")),log(conn,`Session probe says ${res.status}; not retrying`),waitForReturn(conn);return}else log(conn,`Session probe says ${res.status}; the session is fine, retrying`)}catch{log(conn,"Session probe could not be made; treating as a network problem")}conn.handshakeFailures=0,scheduleReconnect(conn)}function waitForReturn(conn){if(typeof window>"u"||typeof document>"u")return;if(connections.get(conn.url)!==conn)return;if(conn.stopWaitingForReturn)return;conn.stopWaitingForReturn=armReturnListeners({window,document,navigator:typeof navigator>"u"?void 0:navigator},()=>{if(connections.get(conn.url)!==conn)return;conn.stopWaitingForReturn=null,conn.reconnectAttempt=0,conn.handshakeFailures=0,log(conn,"Network or tab came back; reconnecting"),openSocket(conn)})}function scheduleReconnect(conn){if(!conn.options.autoReconnect)return;if(connections.get(conn.url)!==conn)return;if(conn.reconnectAttempt>=conn.options.maxReconnectAttempts){conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setError(Error("Max reconnection attempts reached")),log(conn,"Max reconnect attempts reached; waiting for network or tab to return"),waitForReturn(conn);return}let delay=Math.min(conn.options.reconnectBaseDelay*2**conn.reconnectAttempt,conn.options.reconnectMaxDelay);if(conn.reconnectAttempt+=1,conn.dispatch.setConnectionStatus("reconnecting"),conn.dispatch.setReconnectAttempt(conn.reconnectAttempt),log(conn,`Reconnecting in ${delay}ms (attempt ${conn.reconnectAttempt})`),conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout);conn.reconnectTimeout=setTimeout(()=>{if(connections.get(conn.url)===conn)openSocket(conn)},delay)}function handleMessage(conn,raw){let message;try{message=JSON.parse(raw)}catch{log(conn,"Failed to parse message");return}switch(message.type){case"connected":conn.reconnectAttempt=0,conn.handshakeFailures=0,conn.dispatch.setConnectionStatus("connected"),conn.dispatch.setClientId(message.clientId),conn.dispatch.setSubscribedTopics(message.subscribedTopics),conn.dispatch.setReconnectAttempt(0),conn.dispatch.setError(null),log(conn,"Connected, clientId:",message.clientId);break;case"subscribed":conn.dispatch.setSubscribedTopics(message.topics),log(conn,"Subscribed to:",message.topics);break;case"event":{if(conn.dispatch.addEvent({id:`evt_${Date.now()}_${eventIdCounter++}`,topic:message.topic,data:message.data,timestamp:message.timestamp,receivedAt:Date.now(),messageId:message.messageId,isRedelivery:message.isRedelivery}),message.messageId&&conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ack",messageId:message.messageId}));break}case"pong":break;case"error":conn.dispatch.setError(Error(message.error)),log(conn,"Server error:",message.error);break}}function openSocket(conn){if(conn.ws?.readyState===WebSocket.OPEN||conn.ws?.readyState===WebSocket.CONNECTING)return;detachSocket(conn),conn.dispatch.setConnectionStatus("connecting"),conn.dispatch.setError(null),log(conn,"Connecting to:",conn.url);let ws=new WebSocket(conn.url);conn.ws=ws;let opened=!1;ws.onopen=()=>{log(conn,"WebSocket opened"),opened=!0,startHeartbeat(conn)},ws.onmessage=(event)=>handleMessage(conn,event.data),ws.onerror=()=>{log(conn,"WebSocket error"),conn.dispatch.setError(Error("WebSocket connection error"))},ws.onclose=(event)=>{if(log(conn,"WebSocket closed",event.code,event.reason),conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null),connections.get(conn.url)!==conn)return;if(event.code===4001){log(conn,"Handshake bearer refused (4001); asking whether the session is still valid"),confirmSessionThenDecide(conn);return}if(!opened){if(conn.handshakeFailures+=1,conn.handshakeFailures>=HANDSHAKE_FAILURE_LIMIT){confirmSessionThenDecide(conn);return}}else conn.handshakeFailures=0;scheduleReconnect(conn)}}function acquire(url,dispatch,options){let conn=connections.get(url);if(!conn)conn={url,ws:null,refCount:0,reconnectAttempt:0,handshakeFailures:0,stopWaitingForReturn:null,heartbeat:null,reconnectTimeout:null,dispatch,options},connections.set(url,conn);else conn.dispatch=dispatch,conn.options=options;conn.refCount+=1,openSocket(conn)}function release(url){let conn=connections.get(url);if(!conn)return;if(conn.refCount-=1,conn.refCount>0)return;connections.delete(url),clearTimers(conn),detachSocket(conn),conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null)}function send(url,payload){let ws=connections.get(url)?.ws;if(ws?.readyState===WebSocket.OPEN)ws.send(JSON.stringify(payload))}function usePubSub(config){let store=usePubSubStore(),url=config.userId?buildWsUrl(config):"";return useEffect(()=>{if(!url)return;let dispatch={setConnectionStatus:store.setConnectionStatus,setClientId:store.setClientId,setSubscribedTopics:store.setSubscribedTopics,setError:store.setError,setReconnectAttempt:store.setReconnectAttempt,addEvent:store.addEvent},options={autoReconnect:config.autoReconnect??!0,maxReconnectAttempts:config.maxReconnectAttempts??10,sessionProbePath:config.sessionProbePath??"/auth/me",reconnectBaseDelay:config.reconnectBaseDelay??1000,reconnectMaxDelay:config.reconnectMaxDelay??30000,heartbeatInterval:config.heartbeatInterval??30000,debug:config.debug??!1};return acquire(url,dispatch,options),()=>release(url)},[url]),{isConnected:store.connection.status==="connected",isConnecting:store.connection.status==="connecting"||store.connection.status==="reconnecting",sessionExpired:store.connection.status==="unauthorized",clientId:store.connection.clientId,subscribedTopics:store.connection.subscribedTopics,events:store.events,error:store.connection.error,reconnectAttempt:store.connection.reconnectAttempt,connect:()=>{let conn=connections.get(url);if(conn)openSocket(conn)},disconnect:()=>release(url),subscribe:(topics)=>send(url,{type:"subscribe",topics}),unsubscribe:(topics)=>send(url,{type:"unsubscribe",topics}),clearEvents:store.clearEvents,getEventsByTopic:(topic)=>store.events.filter((e)=>e.topic===topic)}}function createRateWindow(windowMs=5000){let samples=[];return{push(at,bytes){let last=samples[samples.length-1];if(last&&at<=last.at){last.bytes=Math.max(last.bytes,bytes);return}samples.push({at,bytes});let cutoff=at-windowMs;while(samples.length>2&&samples[0].at<cutoff)samples.shift()},ratePerSecond(){if(samples.length<2)return null;let first=samples[0],last=samples[samples.length-1],spanMs=last.at-first.at;if(spanMs<700)return null;let delta=last.bytes-first.bytes;if(delta<=0)return null;return delta*1000/spanMs},reset(){samples.length=0}}}function uploadFraction(sentBytes,totalBytes){if(totalBytes===null||totalBytes<=0)return null;return Math.min(1,Math.max(0,sentBytes/totalBytes))}function uploadPercent(sentBytes,totalBytes){let fraction=uploadFraction(sentBytes,totalBytes);if(fraction===null)return null;if(fraction>=1)return 100;return Math.min(99,Math.floor(fraction*100))}function secondsRemaining(sentBytes,totalBytes,bytesPerSecond){if(totalBytes===null||totalBytes<=0)return null;let left=totalBytes-sentBytes;if(left<=0)return 0;if(bytesPerSecond===null||bytesPerSecond<=0)return null;return left/bytesPerSecond}function buildProgress(params){let{sentBytes,totalBytes,startedAt,now,window:window2,retrying=!1}=params;window2.push(now,sentBytes);let bytesPerSecond=window2.ratePerSecond();return{sentBytes,totalBytes,fraction:uploadFraction(sentBytes,totalBytes),percent:uploadPercent(sentBytes,totalBytes),bytesPerSecond,secondsRemaining:secondsRemaining(sentBytes,totalBytes,bytesPerSecond),elapsedMs:Math.max(0,now-startedAt),retrying}}var MIN_REPORT_INTERVAL_MS=120;function uploadWithProgress(body,options){let xhr=options.createRequest?options.createRequest():new XMLHttpRequest,window2=createRateWindow(),startedAt=Date.now(),lastReportAt=0,settled=!1,lastSent=0,lastTotal=null,report=(sentBytes,totalBytes,force)=>{if(!options.onProgress)return;let now=Date.now();if(!force&&now-lastReportAt<MIN_REPORT_INTERVAL_MS)return;lastReportAt=now,options.onProgress(buildProgress({sentBytes,totalBytes,startedAt,now,window:window2}))};return{done:new Promise((resolve)=>{let settle=(outcome)=>{if(settled)return;settled=!0,resolve(outcome)};xhr.open("POST",options.url,!0),xhr.withCredentials=options.withCredentials!==!1;for(let[key,value]of Object.entries(options.headers??{}))xhr.setRequestHeader(key,value);if(options.timeoutMs)xhr.timeout=options.timeoutMs;xhr.upload.onprogress=(event)=>{lastSent=event.loaded,lastTotal=event.lengthComputable?event.total:null,report(lastSent,lastTotal,!1)},xhr.upload.onload=()=>{report(lastTotal??lastSent,lastTotal,!0)},xhr.onload=()=>{let parsed=null;try{parsed=xhr.responseText?JSON.parse(xhr.responseText):null}catch{parsed=null}if(xhr.status<200||xhr.status>=300){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||xhr.statusText||"",cancelled:!1});return}let data=options.parse?options.parse(parsed):parsed;if(data===null||data===void 0){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||"The server accepted the upload but returned nothing usable",cancelled:!1});return}settle({ok:!0,data})},xhr.onerror=()=>{settle({ok:!1,status:null,message:"The upload could not reach the server",cancelled:!1})},xhr.ontimeout=()=>{settle({ok:!1,status:null,message:"The upload timed out",cancelled:!1})},xhr.onabort=()=>{settle({ok:!1,status:null,message:"",cancelled:!0})},xhr.send(body)}),abort:()=>{xhr.abort()}}}function serverMessage(parsed){if(!parsed||typeof parsed!=="object")return"";let body=parsed;for(let key of["message","error","detail"]){let value=body[key];if(typeof value==="string"&&value)return value}return""}import{useCallback,useRef,useState}from"react";function useUpload(options){let[progress,setProgress]=useState(null),[uploading,setUploading]=useState(!1),[outcome,setOutcome]=useState(null),handleRef=useRef(null),optionsRef=useRef(options);optionsRef.current=options;let runId=useRef(0),cancel=useCallback(()=>{handleRef.current?.abort(),handleRef.current=null},[]),reset=useCallback(()=>{setProgress(null),setOutcome(null)},[]),start=useCallback(async(body,overrides)=>{handleRef.current?.abort();let id=++runId.current;setUploading(!0),setOutcome(null),setProgress(null);let merged={...optionsRef.current,...overrides},handle=uploadWithProgress(body,{...merged,onProgress:(p)=>{if(id!==runId.current)return;setProgress(p),merged.onProgress?.(p)}});handleRef.current=handle;let result=await handle.done;if(id!==runId.current)return result;return handleRef.current=null,setUploading(!1),setOutcome(result),result},[]);return{progress,uploading,outcome,start,cancel,reset}}import{createHash as createHash8,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and35,desc as desc7,eq as eq75,lt as lt3,ne as ne7,sql as sql15}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_activeGrants();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();init_redactSecrets();var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column:column2}of ownership){let columns=required.get(table)??new Set;columns.add(column2),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column2 of columns){let entry=perTable.get(column2)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column2)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column2,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column2,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column:column2,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and13,eq as eq17,inArray as inArray4,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq17(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and13(inArray4(getCol(participants,"conversationId"),conversationIds),eq17(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and15,desc as desc3,eq as eq19,inArray as inArray6}from"drizzle-orm";import{and as and14,eq as eq18,inArray as inArray5}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and14(eq18(getCol(tables.participants,"conversationId"),conversationId),eq18(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray5(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq19(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq19(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and15(inArray6(getCol(tables.conversations,"id"),conversationIds),eq19(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray6(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq19(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq19(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and16,desc as desc4,eq as eq20,inArray as inArray7,isNull as isNull3,lt,ne as ne2,sql as sql7}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null,size=fileRow.size??input.size??null,allowedTypes=ctx.config.attachments?.allowedMimeTypes??[];if(allowedTypes.length>0&&(!mimeType||!allowedTypes.includes(mimeType)))throw new ChatError("validation",`Attachment file ${input.fileId} is a ${mimeType??"unknown"} file, which this conversation does not accept`);let maxBytes=ctx.config.attachments?.maxFileSizeBytes??null;if(maxBytes!=null&&size!=null&&size>maxBytes)throw new ChatError("validation",`Attachment file ${input.fileId} is ${size} bytes, over the ${maxBytes} byte limit for attachments`);return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq20(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq20(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql7`${getCol(tables.participants,"unreadCount")} + 1`}).where(and16(eq20(getCol(tables.participants,"conversationId"),params.conversationId),ne2(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq20(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and16(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and16(eq20(getCol(tables.messages,"id"),targetMessageId),eq20(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq20(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq20(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq20(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray7(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}import{and as and17,eq as eq21,isNotNull}from"drizzle-orm";async function isVerificationSignatureFile(args){let{db,schemaTables,fileId}=args,verifications=resolveSchemaTable(schemaTables,"verifications");if(!verifications)return!1;let signatureId=verifications.signatureId;if(!signatureId)return!1;return(await db.select().from(verifications).where(and17(isNotNull(signatureId),eq21(signatureId,fileId))).limit(1)).length>0}init_SystemCollector();init_lifecycle();init_Notification();init_profileSync();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column2){return column2.default!==void 0||column2.defaultRaw!==void 0||column2.generatedAlwaysAs!==void 0||column2.generatedAlwaysAsIdentity===!0||column2.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables2,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables2){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column2 of config.columns??[]){if(builtInNames.has(column2.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column2.notNull===!0&&column2.nullable!==!0&&!hasDbDefault(column2))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function unhonouredIsPublicDeclarations(config){let auth=config.authentication;if(!auth)return[];let notes=[],alwaysPublic=[["authentication.sessions",auth.sessions],["authentication.passwordSet",auth.passwordSet],["authentication.webauthn",auth.webauthn],["authentication.invite",auth.invite],["authentication.register.emailVerification",auth.register?.emailVerification]];for(let[name2,feature]of alwaysPublic)if(feature?.enabled&&feature.isPublic===!1)notes.push(`${name2}.isPublic is false but these routes stay public: the flow is reached without a session`);if(auth.me?.isPublic===!0)notes.push("authentication.me.isPublic is true but /auth/me is never published as public");let sessionToken=auth.sessionToken;if(sessionToken){let named=["secret","algorithm","issuer","audience"].filter((k)=>sessionToken[k]!==void 0);if(named.length>0)notes.push(`authentication.sessionToken.${named.join("/")} is set, but the session token is an opaque id looked up in the store rather than a JWT: nothing signs or verifies it`)}return notes}function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables2,basePath,schema){return buildEntityPublicRoutes(systemTables2,basePath,schema)}function buildPublicRoutes(config,systemTables2,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables2,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_ApiKey();init_activeGrants();init_GodminSetup();init_Middleware();async function resolveApiKeyPermissions(input){let{db,tables,userId,keyAllowedRoles,keyAllowedClaims,userData,logger:logger2}=input,roles=keyAllowedRoles;if(tables.userRoles&&tables.roles)roles=intersectPermissions(await readActiveRoleNames(db,tables,userId),keyAllowedRoles);let claims=keyAllowedClaims,claimScopes={};if(tables.userRoles&&tables.roleClaims&&tables.claims){let grants=await readActiveClaimGrants(db,tables,userId);claims=intersectPermissions(grantedActions(grants),keyAllowedClaims);let effective=new Set(claims),effectiveGrants=grants.filter((grant)=>effective.has(grant.action));if(effectiveGrants.some((grant)=>!!grant.scope)){let resolved=resolveClaimScopes(effectiveGrants,userData,logger2);if(claimScopes=resolved.claimScopes,resolved.dropped.length>0){let dropped=new Set(resolved.dropped);claims=claims.filter((action)=>!dropped.has(action))}}}roles=roles.filter((role)=>!isGodminRole(role));let narrowedRoles=keyAllowedRoles.length-roles.length,narrowedClaims=keyAllowedClaims.length-claims.length;if(narrowedRoles>0||narrowedClaims>0)logger2.debug("[AUTH] API key narrowed to its owner's active grants",{userId,narrowedRoles,narrowedClaims});return{roles,claims,claimScopes}}init_routeCollector();import{eq as eq24}from"drizzle-orm";init_types3();init_adminGuard();init_requireGodmin();init_passwordPolicy();import{eq as eq23}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId,roleLookup){if(!mayActAsGodmin(roleLookup.request))return!1;let user=(await db.select().from(usersTable).where(eq23(col7(usersTable,"id"),userId)).limit(1))[0];if(!user)return!1;let byColumn=Boolean(user.isGod),{rolesTable,userRolesTable,logger:logger2}=roleLookup,byRole=!byColumn&&(hasGodminRole(roleLookup.request)||(rolesTable&&userRolesTable?await userHasGodminRoleInDb(db,{[AUTHORIZATION_TABLE_KEYS.roles]:rolesTable,[AUTHORIZATION_TABLE_KEYS.userRoles]:userRolesTable},userId,logger2):!1));if(!byColumn&&!byRole)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var handleActivateUsers=(db,usersTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq24(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq26,inArray as inArray8}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2,godmin)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq26(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy,entry.email);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray8(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray8(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq27}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq27(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq28,inArray as inArray11}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray11(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray11(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray11(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq28(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq29}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq29(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq30}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq30(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
 `)};var handleListCohorts=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable);return{success:!0,data:{items:rows,meta:{totalItems:rows.length}}}};import{eq as eq31}from"drizzle-orm";var handleDeleteCohort=(db,usersTable,cohortsTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};return await db.update(usersTable).set({cohortId:null,updatedAt:new Date}).where(eq31(col7(usersTable,"cohortId"),ctx.params.id)),await db.delete(cohortsTable).where(eq31(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE",userId,summary:`Deleted cohort ${ctx.params.id}`}),{success:!0,data:null}};import{eq as eq32}from"drizzle-orm";var handleUpdateCohort=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let updates={updatedAt:new Date};if(ctx.body.name!==void 0)updates.name=ctx.body.name;if(ctx.body.description!==void 0)updates.description=ctx.body.description;if(ctx.body.expiresAt!==void 0)updates.expiresAt=ctx.body.expiresAt?new Date(ctx.body.expiresAt):null;if(ctx.body.metadata!==void 0)updates.metadata=ctx.body.metadata;if(ctx.body.isActive!==void 0)updates.isActive=ctx.body.isActive;let updated=await db.update(cohortsTable).set(updates).where(eq32(col7(cohortsTable,"id"),ctx.params.id)).returning();if(updated.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};return{success:!0,data:updated[0]}};init_esm3();var CohortBodySchema=Type.Object({name:Type.String({minLength:1,maxLength:255}),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.String()),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown()))}),CohortUpdateSchema=Type.Object({name:Type.Optional(Type.String({minLength:1,maxLength:255})),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.Union([Type.String(),Type.Null()])),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown())),isActive:Type.Optional(Type.Boolean())}),BulkCreateUserItem=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),profile:Type.Optional(Type.Object({firstName:Type.Optional(Type.String()),lastName:Type.Optional(Type.String())}))}),BulkCreateSchema=Type.Object({users:Type.Optional(Type.Array(BulkCreateUserItem)),emailPrefix:Type.Optional(Type.String()),emailDomain:Type.Optional(Type.String()),sharedPassword:Type.Optional(Type.String({minLength:8})),count:Type.Optional(Type.Integer({minimum:1,maximum:500})),roleIds:Type.Optional(Type.Array(Type.String()))});function createCohortRoutes(config){let{db,logger:logger2,cohortsTable,usersTable,userRolesTable,profilesTable,basePath}=config;if(!db||!cohortsTable||!usersTable)return logger2.warn("[Cohort] Skipped \u2014 missing tables",{hasDb:!!db,hasCohortsTable:!!cohortsTable,hasUsersTable:!!usersTable}),collectRoutes();let godmin={rolesTable:config.rolesTable??null,userRolesTable:userRolesTable??null,logger:logger2},declared=[defineRoute({method:"GET",path:"/",handler:handleListCohorts(db,usersTable,cohortsTable,godmin)}),defineRoute({method:"GET",path:"/:id",handler:handleGetCohort(db,usersTable,cohortsTable,godmin)}),defineRoute({method:"POST",path:"/",body:CohortBodySchema,handler:handleCreateCohort(db,usersTable,cohortsTable,logger2,godmin)}),defineRoute({method:"PATCH",path:"/:id",body:CohortUpdateSchema,handler:handleUpdateCohort(db,usersTable,cohortsTable,godmin)}),defineRoute({method:"DELETE",path:"/:id",handler:handleDeleteCohort(db,usersTable,cohortsTable,logger2,godmin)}),defineRoute({method:"POST",path:"/:id/bulk-create",body:BulkCreateSchema,handler:handleBulkCreateUsers(config,logger2,godmin)}),defineRoute({method:"POST",path:"/:id/deactivate-users",handler:handleDeactivateUsers(db,usersTable,logger2,config.sessionsTable??null,godmin)}),defineRoute({method:"POST",path:"/:id/activate-users",handler:handleActivateUsers(db,usersTable,logger2,godmin)}),defineRoute({method:"POST",path:"/:id/delete-users",handler:handleDeleteUsers(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2,godmin)}),defineRoute({method:"GET",path:"/:id/export",handler:handleExportUsers(db,usersTable,godmin)})];return collectRoutes([{prefix:basePath,routes:declared}])}init_deviceInfo();function shouldNotifyDevice(question){if(question.isImpersonationLogin)return!1;if(!question.emailAvailable)return!1;if(question.requiresApproval)return!0;if(question.trustScore<question.lowTrustThreshold)return!0;return question.notifyOnNewDevice&&question.isNewDevice}init_sessionPools();init_routeCollector();init_storage2();init_esm3();init_routeCollector();init_adminGuard();function getUserId(request){return request.headers.get("x-user-id")}function isChatModerator(request,moderatorRoles){if(hasGodminRole(request))return!0;let roles=decodeHeaderList(request.headers.get("x-user-roles"));if(moderatorRoles.length===0)return!1;let allowed=new Set(moderatorRoles.map((role)=>role.toLowerCase()));return roles.some((role)=>allowed.has(role.toLowerCase()))}function chatErrorStatus(code){switch(code){case"forbidden":return 403;case"not_found":return 404;case"validation":return 400;case"conflict":return 409;case"disabled":return 409;default:return 400}}async function guard3(set2,logger2,fn){try{return{success:!0,data:await fn()}}catch(err){if(err instanceof ChatError)return set2.status=chatErrorStatus(err.code),{success:!1,message:err.message};return logger2.error("[Chat] Unhandled route error",{error:err instanceof Error?err.message:String(err)}),set2.status=500,{success:!1,message:"Internal server error"}}}function unauthorized(set2){return set2.status=401,{success:!1,message:"Authentication required"}}function createConversationRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations",handler:({request,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.listConversations(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0}))},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"List my conversations"}}),defineRoute({method:"POST",path:"/conversations",handler:({request,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>{if(input.type==="group"){if(!input.title)throw new ChatError("validation","A group title is required");return service.createGroup({creatorId:userId,title:input.title,description:input.description,avatarFileId:input.avatarFileId,participantIds:input.participantIds??[]})}if(!input.targetUserId)throw new ChatError("validation","targetUserId is required for a direct conversation");return service.getOrCreateDirect(userId,input.targetUserId)})},body:Type.Object({type:Type.Optional(Type.Union([Type.Literal("direct"),Type.Literal("group")])),targetUserId:Type.Optional(Type.String()),title:Type.Optional(Type.String()),description:Type.Optional(Type.String()),avatarFileId:Type.Optional(Type.String()),participantIds:Type.Optional(Type.Array(Type.String()))}),detail:{tags:["Chat"],summary:"Create or open a conversation"}}),defineRoute({method:"GET",path:"/conversations/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getConversation(params.id,userId))},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Get a conversation"}}),defineRoute({method:"POST",path:"/conversations/:id/participants",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{userIds}=body;return guard3(set2,logger2,()=>service.addParticipants(params.id,userId,userIds))},params:Type.Object({id:Type.String()}),body:Type.Object({userIds:Type.Array(Type.String())}),detail:{tags:["Chat"],summary:"Add group participants"}}),defineRoute({method:"DELETE",path:"/conversations/:id/participants/:userId",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,async()=>{return await service.removeParticipant(params.id,userId,params.userId),{removed:params.userId}})},params:Type.Object({id:Type.String(),userId:Type.String()}),detail:{tags:["Chat"],summary:"Remove a participant / leave group"}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}init_esm3();init_esm3();function FileSchema(){return Type.Object({size:Type.Number(),type:Type.String()},{format:"binary",additionalProperties:!0})}function FilesSchema(){return Type.Union([FileSchema(),Type.Array(FileSchema())])}init_routeCollector();init_storage2();var CONTENT_TYPE_SCHEMA=Type.Optional(Type.Union([Type.Literal("text"),Type.Literal("image"),Type.Literal("file"),Type.Literal("video"),Type.Literal("audio")]));function createMessageRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations/:id/messages",handler:({request,params,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getMessages({conversationId:params.id,userId,limit:query.limit?Number(query.limit):void 0,before:query.before||void 0}))},params:Type.Object({id:Type.String()}),query:Type.Object({limit:Type.Optional(Type.String()),before:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Get conversation messages (newest first)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>service.sendMessage({conversationId:params.id,senderId:userId,content:input.content,contentType:input.contentType,replyToId:input.replyToId,clientMessageId:input.clientMessageId,attachments:input.attachmentIds?.map((fileId)=>({fileId})),metadata:input.metadata}))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.Optional(Type.String()),contentType:CONTENT_TYPE_SCHEMA,replyToId:Type.Optional(Type.String()),clientMessageId:Type.Optional(Type.String()),attachmentIds:Type.Optional(Type.Array(Type.String())),metadata:Type.Optional(Type.Any())}),detail:{tags:["Chat"],summary:"Send a message (link pre-uploaded attachments)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages/upload",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);if(!deps.attachmentsAvailable)return set2.status=409,{success:!1,message:"File attachments require storage and CDN to be enabled"};let{service,schemaTables}=getService(request);return guard3(set2,logger2,async()=>{let filesTable=resolveSchemaTable(schemaTables,"files",logger2);if(!filesTable)throw new ChatError("disabled","Files table unavailable in this schema");let{data,files}=parseFormDataBody(body,deps.storageConfig);if(files.length===0)throw new ChatError("validation","At least one file is required");let{records,failed}=await persistUploadedFiles({db:deps.db,filesTable,files,storageConfig:deps.storageConfig,subFolder:"chat",userId});if(records.length===0)throw new ChatError("validation",failed[0]?.error??"File upload failed");if(deps.cdnMedia)scheduleUploadMediaProcessing(records,{storagePath:deps.storageConfig.basePath,media:deps.cdnMedia,logger:logger2});let content=typeof data.content==="string"?data.content:void 0,replyToId=typeof data.replyToId==="string"?data.replyToId:void 0,clientMessageId=typeof data.clientMessageId==="string"?data.clientMessageId:void 0;return service.sendMessage({conversationId:params.id,senderId:userId,content,replyToId,clientMessageId,attachments:records.map((record3)=>({fileId:record3.id,originalName:record3.originalName,mimeType:record3.mimeType,size:record3.size}))})})},type:"formdata",params:Type.Object({id:Type.String()}),body:Type.Object({[deps.storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[deps.storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:["Chat"],summary:"Send a message with uploaded file attachments"}}),defineRoute({method:"POST",path:"/conversations/:id/read",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{messageId}=body;return guard3(set2,logger2,()=>service.markRead(params.id,userId,messageId))},params:Type.Object({id:Type.String()}),body:Type.Object({messageId:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Mark a conversation as read"}}),defineRoute({method:"POST",path:"/conversations/:id/typing",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{isTyping}=body;return guard3(set2,logger2,async()=>{return await service.setTyping(params.id,userId,isTyping??!0),{ok:!0}})},params:Type.Object({id:Type.String()}),body:Type.Object({isTyping:Type.Optional(Type.Boolean())}),detail:{tags:["Chat"],summary:"Broadcast a typing indicator"}}),defineRoute({method:"PATCH",path:"/messages/:id",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{content}=body;return guard3(set2,logger2,()=>service.editMessage(params.id,userId,content))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.String()}),detail:{tags:["Chat"],summary:"Edit a message"}}),defineRoute({method:"DELETE",path:"/messages/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),asModerator=isChatModerator(request,deps.config.moderatorRoles??[]);return guard3(set2,logger2,async()=>{if(await service.deleteMessage(params.id,userId,asModerator),asModerator)logger2.warn("[CHAT] Message deleted by a moderator",{actorId:userId,messageId:params.id});return{deleted:params.id}})},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Delete a message",description:"Sender-only, unless the caller is godmin or holds a role from chat.moderatorRoles \u2014 then any message, and `deletionEnabled` does not apply."}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}function createChatRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,broadcaster,tenantRegistry,storageConfig,attachmentsAvailable,cdnBasePath,cdnMedia}=routeConfig,buildService=(tables)=>new ChatService({db,schemaTables:tables,config,logger:logger2,broadcaster,cdnBasePath,attachmentsAvailable,deleteStoredFile:(file)=>deleteFile(file.path,file.name,storageConfig.basePath)}),defaultService=buildService(schemaTables),deps={db,config,logger:logger2,storageConfig,attachmentsAvailable,getService:(request)=>{if(!tenantRegistry)return{service:defaultService,schemaTables};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{service:defaultService,schemaTables};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{service:defaultService,schemaTables};return{service:buildService(ctx.schemaTables),schemaTables:ctx.schemaTables}},cdnMedia},routes=collectRoutes();return routes.use(createConversationRoutes(deps)),routes.use(createMessageRoutes(deps)),logger2.info(`[Chat] Routes registered at ${config.basePath}`,{attachmentsAvailable,groupsEnabled:config.groupsEnabled}),{routes,chatService:defaultService}}init_esm3();init_routeCollector();init_godminGuard();init_helpers4();function createConfigRoutes(routeConfig){let{logger:logger2,resolvedOptions,configFilePath,basePath,onConfigUpdate,db,schemaTables,getRedis}=routeConfig,guard4=createGodminGuard2({logger:logger2,db:db??null,schemaTables,area:"config management"});logger2.info(`[ConfigManagement] Routes enabled at ${basePath}`);let declared=[defineRoute({method:"GET",path:"/",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions));return{isSuccess:!0,message:"Current running configuration",data:{config:maskSensitiveFields(configCopy),configFilePath,sections:buildSectionsMeta(resolvedOptions)}}},detail:{tags:["Config Management"],summary:"Get full running configuration",description:"Returns the full running configuration with sensitive fields masked."}}),defineRoute({method:"GET",path:"/sections",handler:()=>({isSuccess:!0,message:"Config section metadata",data:{sections:buildSectionsMeta(resolvedOptions)}}),detail:{tags:["Config Management"],summary:"List all config sections with metadata",description:"Section list is derived at runtime from the config object \u2014 no hardcoding."}}),defineRoute({method:"GET",path:"/env",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions)),declared2=scanEnvVars(configCopy),declaredNames=new Set(declared2.map((e)=>e.envName)),undeclared=scanUndeclaredEnv(declaredNames),entries=[...declared2,...undeclared],resolvedCount=entries.filter((e)=>e.resolved).length,missingCount=entries.length-resolvedCount,unrecognizedCount=undeclared.length;return{isSuccess:!0,message:`Found ${entries.length} env vars (${resolvedCount} resolved, ${missingCount} missing, ${unrecognizedCount} unrecognized)`,data:{entries,totalCount:entries.length,resolvedCount,missingCount,unrecognizedCount}}},detail:{tags:["Config Management"],summary:"Get environment variables (declared + undeclared)",description:"Surfaces both (a) DECLARED env vars \u2014 UPPER_SNAKE_CASE references found in the config tree (recognized:true) \u2014 and (b) UNDECLARED env vars actually present in process.env but not declared (recognized:false), minus Kubernetes service-link and OS/interpreter infra noise, so orphaned / junk config surfaces for cleanup. Sensitive values are masked; AI-provider *_API_KEY vars are never surfaced."}}),defineRoute({method:"GET",path:"/overrides",handler:async()=>{let redis=getRedis();if(!redis)return{isSuccess:!0,message:"Redis not available \u2014 no overrides stored",data:{overrides:null,sectionCount:0,sections:[]}};let overrides=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),sections=overrides?Object.keys(overrides).filter((k)=>{let v=overrides[k];return v!==void 0&&v!==null&&(typeof v!=="object"||Object.keys(v).length>0)}):[];return{isSuccess:!0,message:sections.length>0?`${sections.length} section override(s) stored in Redis`:"No overrides in Redis",data:{overrides:overrides?maskSensitiveFields(overrides):null,sectionCount:sections.length,sections}}},detail:{tags:["Config Management"],summary:"View Redis config overrides",description:"Returns overrides stored in Redis that will be merged on next restart."}}),defineRoute({method:"DELETE",path:"/overrides",handler:async(ctx)=>{let redis=getRedis();if(!redis)return ctx.set.status=503,{isSuccess:!1,message:"Redis not available",data:null};let existing=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),clearedSections=existing?Object.keys(existing):[];return await clearOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),logger2.info("[ConfigManagement] Redis overrides cleared",{clearedSections}),{isSuccess:!0,message:clearedSections.length>0?`Cleared ${clearedSections.length} override(s) from Redis. Restart to revert to config.json defaults.`:"No overrides to clear.",data:{message:"Redis overrides cleared",clearedSections}}},detail:{tags:["Config Management"],summary:"Clear all Redis config overrides",description:"Removes all stored overrides from Redis. Restart to revert to config.json defaults."}}),defineRoute({method:"GET",path:"/:section",handler:({params,set:set2})=>{let{section}=params;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};let sectionValue=extractSection(resolvedOptions,section),restart=isRestartRequired(section),maskedValue=sectionValue;if(typeof sectionValue==="object"&&sectionValue!==null&&!Array.isArray(sectionValue))maskedValue=maskSensitiveFields({[section]:sectionValue})[section];return{isSuccess:!0,message:`Config section: ${section}`,data:{section,config:maskedValue??null,restartRequired:restart}}},params:Type.Object({section:Type.String()}),detail:{tags:["Config Management"],summary:"Get a specific config section",description:"Returns a specific config section with sensitive fields masked."}}),defineRoute({method:"PATCH",path:"/:section",handler:async({params,body,set:set2})=>{let{section}=params,payload=body;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};if(!payload.config||typeof payload.config!=="object")return set2.status=400,{isSuccess:!1,message:'Request body must contain a "config" object',data:null};let restart=isRestartRequired(section),currentValue=extractSection(resolvedOptions,section),submitted=Array.isArray(currentValue)||currentValue===void 0||typeof currentValue==="string"||typeof currentValue==="number"||typeof currentValue==="boolean"?payload.config.value!==void 0?payload.config.value:payload.config:payload.config,incoming=restoreMaskedEchoes(section,currentValue,submitted),newValue;if(typeof currentValue==="object"&&currentValue!==null&&!Array.isArray(currentValue))newValue=deepMerge(currentValue,incoming);else newValue=incoming;if(applySectionUpdate(resolvedOptions,section,newValue),!restart)onConfigUpdate(section,newValue);let persistMethod="memory-only",persistWarning=null;if(configFilePath)try{await persistConfigToDisk(configFilePath,resolvedOptions),persistMethod="disk",logger2.info(`[ConfigManagement] Section "${section}" persisted to disk`)}catch(diskErr){let diskMsg=diskErr instanceof Error?diskErr.message:String(diskErr);logger2.warn(`[ConfigManagement] Disk persist failed: ${diskMsg}`);let redis=getRedis();if(redis)try{await persistSectionToRedis(redis,resolvedOptions.appId||"nucleus",section,newValue),persistMethod="redis",logger2.info(`[ConfigManagement] Section "${section}" persisted to Redis (disk unavailable)`)}catch(redisErr){let redisMsg=redisErr instanceof Error?redisErr.message:String(redisErr);logger2.error(`[ConfigManagement] Redis persist also failed: ${redisMsg}`),persistWarning=`Disk: ${diskMsg}. Redis: ${redisMsg}. Changes are in-memory only and will be lost on restart.`}else persistWarning=`Disk: ${diskMsg}. Redis not available. Changes are in-memory only and will be lost on restart.`}logger2.info(`[ConfigManagement] Section "${section}" updated (persist: ${persistMethod}, restart-required: ${restart})`);let updatedValue=extractSection(resolvedOptions,section),maskedUpdated=updatedValue;if(typeof updatedValue==="object"&&updatedValue!==null&&!Array.isArray(updatedValue))maskedUpdated=maskSensitiveFields({[section]:updatedValue})[section];let baseMsg=restart?`Config section "${section}" saved (${persistMethod}). Restart required for changes to take effect.`:`Config section "${section}" updated and applied (${persistMethod}).`;return{isSuccess:!0,message:persistWarning?`${baseMsg} Warning: ${persistWarning}`:baseMsg,data:{section,applied:!restart,restartRequired:restart,config:maskedUpdated}}},params:Type.Object({section:Type.String()}),body:Type.Object({config:Type.Record(Type.String(),Type.Unknown())}),detail:{tags:["Config Management"],summary:"Update a config section",description:"Deep-merges the payload into the section. Hot-reloadable sections apply immediately. Restart-required sections are saved to disk only."}}),defineRoute({method:"POST",path:"/restart",handler:({body})=>{let delayMs=body.delayMs??1000;logger2.info(`[ConfigManagement] Restart scheduled in ${delayMs}ms`);let scheduledAt=new Date().toISOString();return setTimeout(()=>{logger2.info("[ConfigManagement] Restarting process..."),process.exit(0)},delayMs),{isSuccess:!0,message:`Server restart scheduled in ${delayMs}ms`,data:{message:`Process will exit in ${delayMs}ms. Orchestrator (K8s/PM2/systemd) will restart it.`,scheduledAt}}},body:Type.Optional(Type.Object({delayMs:Type.Optional(Type.Number())})),detail:{tags:["Config Management"],summary:"Restart the server process",description:"Triggers a graceful process exit after a configurable delay. The orchestrator (K8s, PM2, systemd) is expected to restart the process automatically."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}init_routeMount();init_esm3();init_routeCollector();init_adminGuard();var requireAuth=(ctx)=>ctx.request.headers.get("x-user-id"),fail=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin=(ctx)=>hasGodminRole(ctx.request),ownsHostname=(ctx,record3)=>{if(isGodmin(ctx))return!0;let caller=callerSchemaOf(ctx);return record3.schemaName!=null&&record3.schemaName===caller};function createHostnameRoutes(config){let base=config.basePath,declared=[defineRoute({method:"POST",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let body=ctx.body,callerSchema=callerSchemaOf(ctx),schemaName=body.schemaName??null,tenantId=body.tenantId??null;if(!hasGodminRole(ctx.request)){if(schemaName&&schemaName!==callerSchema)return fail(ctx,403,"Cannot bind a hostname to another tenant's schema");schemaName=callerSchema;let ownTenantId=config.resolveTenantIdForSchema?.(callerSchema)??null;if(tenantId&&tenantId!==ownTenantId)return fail(ctx,403,"Cannot bind a hostname to another tenant");tenantId=ownTenantId}try{let result=await service.createHostname({hostname:body.hostname,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,schemaName,isPrimary:body.isPrimary});return{success:!0,message:"Custom hostname created",data:{hostname:result.hostname,instructions:result.instructions}}}catch(err){return fail(ctx,400,err instanceof Error?err.message:"Failed to create hostname")}},body:Type.Object({hostname:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),schemaName:Type.Optional(Type.String()),isPrimary:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Create custom hostname"}}),defineRoute({method:"GET",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin(ctx))items=await service.listHostnames({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let ownTenantId=config.resolveTenantIdForSchema?.(callerSchemaOf(ctx))??null;items=ownTenantId?await service.listHostnames({tenantId:ownTenantId}):[]}return{success:!0,message:`Found ${items.length} hostnames`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let record3=await service.getHostname(ctx.params.id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"Hostname found",data:record3}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id/instructions`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"DNS instructions",data:{instructions:await service.getInstructions(id)}}}})],svc=(ctx)=>{let s=config.getDomainService();if(!s)return ctx.set.status=503,null;return s},lifecycle2=(suffix,run,summary)=>{declared.push(defineRoute({method:"POST",path:`${base}/hostnames/:id/${suffix}`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");try{let data=await run(service,id);if(!data)return fail(ctx,404,"Hostname not found");return{success:!0,message:summary,data}}catch(err){return fail(ctx,400,err instanceof Error?err.message:summary)}}}))};return lifecycle2("verify",(s,id)=>s.verifyHostname(id),"Verification processed"),lifecycle2("activate",(s,id)=>s.activateHostname(id),"Hostname activated"),lifecycle2("disable",(s,id)=>s.disableHostname(id),"Hostname disabled"),lifecycle2("make-primary",(s,id)=>s.makePrimary(id),"Primary hostname set"),lifecycle2("refresh-status",(s,id)=>s.refreshStatus(id),"Status refreshed"),collectRoutes([{routes:declared}])}init_esm3();init_routeCollector();init_adminGuard();var requireAuth2=(ctx)=>ctx.request.headers.get("x-user-id"),fail2=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf2=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin2=(ctx)=>hasGodminRole(ctx.request);function createRegistrationRoutes(config){let base=config.basePath,svc=(ctx)=>{let s=config.getRegistrationService();if(!s)return ctx.set.status=503,null;return s},ownTenantId=(ctx)=>config.resolveTenantIdForSchema?.(callerSchemaOf2(ctx))??null,ownsRegistration=(ctx,record3)=>{if(isGodmin2(ctx))return!0;let own=ownTenantId(ctx);return record3.tenantId!=null&&own!=null&&record3.tenantId===own},declared=[defineRoute({method:"POST",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let body=ctx.body,tenantId=body.tenantId??null,registrantOwnerType=body.registrantOwnerType;if(!isGodmin2(ctx)){let own=ownTenantId(ctx);if(tenantId&&tenantId!==own)return fail2(ctx,403,"Cannot register a domain for another tenant");if(tenantId=own,registrantOwnerType==="platform")return fail2(ctx,403,"Only a platform admin may register as 'platform'");registrantOwnerType="customer"}try{return{success:!0,message:"Registration requested",data:await service.createRequest({requestedDomain:body.requestedDomain,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,registrantOwnerType,termsVersion:body.termsVersion,termsAccepted:body.termsAccepted,autoRenew:body.autoRenew})}}catch(err){return fail2(ctx,400,err instanceof Error?err.message:"Failed to request registration")}},body:Type.Object({requestedDomain:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),registrantOwnerType:Type.Optional(Type.Union([Type.Literal("customer"),Type.Literal("platform")])),termsVersion:Type.String(),termsAccepted:Type.Boolean(),autoRenew:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Request managed domain registration"}}),defineRoute({method:"GET",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin2(ctx))items=await service.listRegistrations({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let own=ownTenantId(ctx);items=own?await service.listRegistrations({tenantId:own}):[]}return{success:!0,message:`Found ${items.length} registrations`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/registrations/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let record3=await service.getRegistration(ctx.params.id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration found",data:record3}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/cancel`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let cancelled=await service.cancel(id);if(!cancelled)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration cancelled",data:cancelled}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/transfer-out`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let out=await service.requestTransferOut(id);if(!out)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Transfer-out requested",data:out}}})];return collectRoutes([{routes:declared}])}init_routeCollector();function createResolveRoute(config){let base=config.basePath,declared=[defineRoute({method:"GET",path:`${base}/resolve`,isPublic:!0,handler:async(ctx)=>{let service=config.getDomainService();if(!service)return ctx.set.status=503,{success:!1,message:"Domains not available",data:null};let hostname=new URL(ctx.request.url).searchParams.get("hostname")||ctx.request.headers.get("host")||"";if(!hostname)return ctx.set.status=400,{success:!1,message:"hostname is required",data:null};let match=await service.resolveHostname(hostname);if(!match)return ctx.set.status=404,{success:!1,message:"No active hostname matched",data:null};return{success:!0,message:"Resolved",data:match}},detail:{tags:["Domains"],summary:"Resolve hostname to tenant",description:"Public."}})];return collectRoutes([{routes:declared}])}function createDomainRoutes(app,config){return useRoutes(app,createResolveRoute(config)),useRoutes(app,createHostnameRoutes(config)),useRoutes(app,createRegistrationRoutes(config)),app}init_esm3();import{and as and22,arrayContains,arrayOverlaps,asc as asc2,createTableRelationsHelpers,desc as desc5,eq as eq36,getTableName,gt,gte,ilike,inArray as inArray14,isNotNull as isNotNull2,isNull as isNull5,like,lt as lt2,lte,ne as ne4,notInArray,or as or5,sql as sql9}from"drizzle-orm";import{drizzle}from"drizzle-orm/node-postgres";init_AccountLink();init_Authorization();init_routeMount();init_utils5();init_revokeUserSessions();function decideRoleAssign(params){let{callerIsGod,callerRoleNames,allowRoles,targetRoleName,subjectIsGodmin,godminRoleName}=params,callerIsGodmin=callerIsGod||callerRoleNames.includes(godminRoleName);if(!(callerIsGodmin||callerRoleNames.some((name2)=>allowRoles.includes(name2))))return{allowed:!1,status:403,reason:"not_privileged"};if(targetRoleName===godminRoleName&&!callerIsGodmin)return{allowed:!1,status:403,reason:"godmin_assignment_forbidden"};if(subjectIsGodmin&&!callerIsGodmin)return{allowed:!1,status:403,reason:"target_is_godmin"};return{allowed:!0,callerIsGodmin}}var ROLE_ASSIGN_REFUSALS={not_privileged:"You are not allowed to assign roles.",godmin_assignment_forbidden:"Only a system administrator can grant this role.",target_is_godmin:"This person\u2019s roles can only be changed by a system administrator."};init_adminGuard();init_apiKeyCeiling();init_sensitiveColumns();var snakeToCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SENSITIVE_SYSTEM_TABLE_SNAKE=["domain_hostnames","domain_registrations","domain_provider_records","domain_verification_challenges","domain_events","payment_sub_merchants","payment_invoices","payment_subscriptions","payment_customers","payment_transactions","payment_methods","payment_products","payment_prices","payment_commission_splits","payment_splits","payment_reserves","payment_ledger_entries","payment_payout_requests","payment_settlement_policies","payment_disputes","payment_webhook_logs","verifications","verification_requirements","verification_instances","verification_flows","verification_steps","verification_edges","verification_verifier_configs","verification_notification_rules","verification_notification_recipients","verification_notification_channels","verification_step_verifiers","verification_actions","verification_action_recipients","verification_action_channels","verification_passes","verification_action_runs","api_keys","magic_link_tokens","user_sessions","trusted_devices","integration_sources","integration_endpoints","integration_mappings"],SENSITIVE_SYSTEM_TABLES=new Set(SENSITIVE_SYSTEM_TABLE_SNAKE.flatMap((name2)=>[name2,snakeToCamel2(name2)]));function isSensitiveSystemTable(tableName){return SENSITIVE_SYSTEM_TABLES.has(tableName)}init_sessionOnly();function delegatedWriteRoles(question){if(question.isRbacTable)return new Set;let roles=(question.featureSet??[]).flatMap((feature)=>question.featureAdminRoles?.[feature]??[]);return new Set(roles.map((role)=>role.toLowerCase()))}function isFeatureAdmin(question){let allowed=delegatedWriteRoles(question);if(allowed.size===0)return!1;return question.callerRoles.some((role)=>allowed.has(role.toLowerCase()))}init_storage2();import{and as and20,eq as eq34,inArray as inArray12}from"drizzle-orm";async function activeVerificationExists(db,schemaTables,entityName,entityId){let instancesTable=schemaTables.verificationInstances;if(!instancesTable)return!1;let cols=instancesTable;if(!cols.entityName||!cols.entityId||!cols.status)return!1;try{return(await db.select().from(instancesTable).where(and20(inArray12(cols.entityName,bothSpellings(entityName)),eq34(cols.entityId,entityId),eq34(cols.status,"active"))).limit(1)).length>0}catch{return!1}}async function verifierAwaitedByVerification(db,schemaTables,who){if(!who.role&&!who.userId)return!1;let{verificationRequirements:reqTable,verificationInstances:instTable}=schemaTables;if(!reqTable||!instTable)return!1;let r=reqTable,i=instTable;if(!r.status||!i.status||!i.id||!r.instanceId)return!1;try{let match=who.role?eq34(r.verifierRole,who.role):eq34(r.verifierUserId,who.userId);if(who.role&&!r.verifierRole)return!1;if(who.userId&&!r.verifierUserId)return!1;return(await db.select().from(reqTable).innerJoin(instTable,eq34(r.instanceId,i.id)).where(and20(eq34(r.status,"pending"),eq34(i.status,"active"),match)).limit(1)).length>0}catch{return!1}}async function assignmentAwaitedByVerification(db,schemaTables,assignment){let{verificationRequirements:reqTable,verificationInstances:instTable,userRoles:userRolesTable,roles:rolesTable}=schemaTables;if(!reqTable||!instTable)return!1;let r=reqTable,i=instTable;if(!r.status||!i.status||!i.id||!r.instanceId)return!1;if(!r.verifierRole)return!1;try{if(r.verifierUserId){if((await db.select().from(reqTable).innerJoin(instTable,eq34(r.instanceId,i.id)).where(and20(eq34(r.status,"pending"),eq34(i.status,"active"),eq34(r.verifierUserId,assignment.userId),eq34(r.verifierRole,assignment.roleName))).limit(1)).length>0)return!0}if((await db.select().from(reqTable).innerJoin(instTable,eq34(r.instanceId,i.id)).where(and20(eq34(r.status,"pending"),eq34(i.status,"active"),eq34(r.verifierRole,assignment.roleName))).limit(1)).length===0)return!1;if(!userRolesTable||!rolesTable)return!1;let ur=userRolesTable,ro=rolesTable,usersTable=schemaTables.users,us=usersTable,base=db.select({user_id:ur.userId}).from(userRolesTable).innerJoin(rolesTable,eq34(ur.roleId,ro.id));return(await((us?.id)?base.innerJoin(usersTable,eq34(ur.userId,us.id)).where(and20(eq34(ro.name,assignment.roleName),eq34(ur.isActive,!0),eq34(ro.isActive,!0),eq34(us.isActive,!0))):base.where(and20(eq34(ro.name,assignment.roleName),eq34(ur.isActive,!0)))).limit(50)).filter((m)=>m.user_id!==assignment.userId).length===0}catch{return!1}}function isAnonymousCreate(table,payload){let rule=table.anonymous_create;if(!rule)return!1;if(rule===!0)return!0;let column2=rule.column;if(!column2)return!1;let value2=payload[column2]??payload[toCamelCase3(column2)]??payload[toSnakeCase2(column2)];return isTruthy(value2)}function isTruthy(value2){if(typeof value2==="boolean")return value2;if(typeof value2==="number")return value2!==0;if(typeof value2==="string"){let normalized=value2.trim().toLowerCase();return normalized==="true"||normalized==="1"||normalized==="yes"||normalized==="on"}return!1}function createAuditIdentity(anonymous,userId,headers){if(anonymous)return{userId:void 0,ipAddress:"anonymous",userAgent:"anonymous"};return{userId:userId||void 0,ipAddress:headers.get("x-client-ip")?.trim()||headers.get("x-forwarded-for")?.split(",")[0]?.trim()||headers.get("x-real-ip")?.trim()||"unknown",userAgent:headers.get("user-agent")||"unknown"}}function toCamelCase3(value2){return value2.replace(/_([a-z0-9])/g,(_m,c)=>c.toUpperCase())}function toSnakeCase2(value2){return value2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`)}init_types3();var CLAIMS_CACHE_SOURCES=new Set([AUTHORIZATION_TABLE_KEYS.roles,AUTHORIZATION_TABLE_KEYS.roleClaims,AUTHORIZATION_TABLE_KEYS.claims]);function isClaimsCacheSource(tableName){return CLAIMS_CACHE_SOURCES.has(tableName)}function refreshClaimsCacheAfterWrite(deps){let{tableName,claimsCache,logger:logger2}=deps;if(!claimsCache||!isClaimsCacheSource(tableName))return;claimsCache.invalidate().catch((error3)=>{logger2.error("[Entity] Claims cache rebuild failed after a write; it serves the old map",error3,{tableName})})}var snakeToCamel3=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function forceCreateScope(payload,authResult,resolveColumn){let scopeFilters=authResult?.scopeFilters;if(!scopeFilters)return{ok:!0};for(let[field,value2]of Object.entries(scopeFilters)){if(!resolveColumn(field))return{ok:!1,field};payload[snakeToCamel3(field)]=value2}return{ok:!0}}init_Authorization();init_types3();init_adminGuard();import{eq as eq35,inArray as inArray13}from"drizzle-orm";var idText=(value2)=>{if(typeof value2==="string")return value2.length>0?value2:null;if(typeof value2==="number"&&Number.isFinite(value2))return String(value2);return null},godminHolder=(row,isGodminRoleId)=>{if(!row||row.isActive===!1||row.is_active===!1)return null;let roleId=idText(row.roleId??row.role_id);if(!roleId||!isGodminRoleId(roleId))return null;return idText(row.userId??row.user_id)};function planGodFlagSync(changes,isGodminRoleId){let grant=new Set,revoke=new Set;for(let{before,after}of changes){let was=godminHolder(before,isGodminRoleId),now=godminHolder(after,isGodminRoleId);if(was===now)continue;if(was)revoke.add(was);if(now)grant.add(now)}for(let userId of grant)revoke.delete(userId);return{grant:[...grant],revoke:[...revoke]}}var column2=(table,name2)=>table[name2];async function syncGodFlags(deps,changes){let{db,schemaTables,logger:logger2}=deps,roles=schemaTables[AUTHORIZATION_TABLE_KEYS.roles],users=schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!roles||!users)return;let roleIds=new Set;for(let{before,after}of changes)for(let row of[before,after]){let roleId=idText(row?.roleId??row?.role_id);if(roleId)roleIds.add(roleId)}if(roleIds.size===0)return;try{let roleRows=await db.select({id:column2(roles,"id"),name:column2(roles,"name")}).from(roles).where(inArray13(column2(roles,"id"),[...roleIds])),godminRoleIds=new Set(roleRows.filter((role)=>typeof role.name==="string"&&isGodminRole(role.name)).map((role)=>idText(role.id)).filter((id)=>id!==null));if(godminRoleIds.size===0)return;let plan=planGodFlagSync(changes,(id)=>godminRoleIds.has(id)),setIsGod=(userId,isGod)=>db.update(users).set({isGod}).where(eq35(column2(users,"id"),userId));for(let userId of plan.grant)await setIsGod(userId,!0);for(let userId of plan.revoke){if(await userHasGodminRoleInDb(db,schemaTables,userId,logger2))continue;await setIsGod(userId,!1)}}catch(error3){logger2.error("[Entity] users.is_god could not be synced after a user_roles write",error3)}}function decideRelationExpansion(params){let{authEnabled,targetTable,relAuth,isTargetPublicGet}=params;if(!authEnabled||!targetTable)return{expand:!0};if(relAuth===null)return isTargetPublicGet?{expand:!0}:{expand:!1};if(!relAuth.authorized)return{expand:!1};let scope=relAuth.scopeFilters;if(scope&&Object.keys(scope).length>0)return{expand:!0,scope};return{expand:!0}}function resolveRelationScopeColumn(fields,key2,toCamel5){if(Object.hasOwn(fields,key2))return fields[key2];let camel=toCamel5(key2);return Object.hasOwn(fields,camel)?fields[camel]:void 0}import{and as and21,or as or4,sql as sql8}from"drizzle-orm";var MAX_SEARCH_TOKENS=10,TURKISH_LETTERS="\u0130\u0131\u015E\u015F\u011E\u011F\xDC\xFC\xD6\xF6\xC7\xE7",ASCII_EQUIVALENTS="IiSsGgUuOoCc";function searchTokens(term){return term.split(/\s+/).filter(Boolean).slice(0,MAX_SEARCH_TOKENS)}function foldForSearch(value2){let folded="";for(let character of value2){let index=TURKISH_LETTERS.indexOf(character);folded+=index===-1?character:ASCII_EQUIVALENTS[index]}return folded.toLowerCase()}function asRegexLiteral(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,(character)=>`\\${character}`)}var WORD_START="(^|[^[:alnum:]])";function folded(column3){return sql8`lower(translate(cast(${column3} as text), ${TURKISH_LETTERS}, ${ASCII_EQUIVALENTS}))`}function buildSearchCondition(columns,term){let tokens=searchTokens(term);if(tokens.length===0||columns.length===0)return null;let perToken=tokens.map((token)=>{let pattern2=`${WORD_START}${asRegexLiteral(foldForSearch(token))}`;return or4(...columns.map((column3)=>sql8`${folded(column3)} ~ ${pattern2}`))}).filter((condition)=>condition!==void 0);if(perToken.length===0)return null;return and21(...perToken)??null}init_Authorization();init_types3();function targetFromBody(body){let record3=body??{},read2=(...keys)=>{for(let key2 of keys){let value2=record3[key2];if(typeof value2==="string"&&value2.length>0)return value2}return null};return{userId:read2("userId","user_id"),roleId:read2("roleId","role_id")}}async function readRow(db,userRolesTable,rowId,logger2){try{let{eq:eq36}=await import("drizzle-orm"),columns=userRolesTable,row=(await db.select().from(userRolesTable).where(eq36(columns.id,rowId)).limit(1))[0];if(!row)return{userId:null,roleId:null};let text2=(value2)=>typeof value2==="string"&&value2.length>0?value2:null;return{userId:text2(row.userId??row.user_id),roleId:text2(row.roleId??row.role_id)}}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the user_roles row",{error:err instanceof Error?err.message:String(err)}),{userId:null,roleId:null}}}async function roleNameOf(db,rolesTable,roleId,logger2){try{let{eq:eq36}=await import("drizzle-orm"),columns=rolesTable,name2=(await db.select({name:columns.name}).from(rolesTable).where(eq36(columns.id,roleId)).limit(1))[0]?.name;return typeof name2==="string"&&name2.length>0?name2:null}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the role name",{error:err instanceof Error?err.message:String(err)}),null}}async function isGodmin3(db,userRolesTable,rolesTable,userId,logger2){try{let{eq:eq36}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq36(ur.roleId,r.id)).where(eq36(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[UserRoleWrite] Failed to check whether the subject is a godmin",{error:err instanceof Error?err.message:String(err)}),!0}}async function resolveUserRoleSubject(deps,write){let{db,schemaTables,logger:logger2}=deps,userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!db||!userRolesTable||!rolesTable)return{targetRoleName:null,subjectIsGodmin:!0};let fromBody=targetFromBody(write.body),fromRow=write.rowId?await readRow(db,userRolesTable,write.rowId,logger2):{userId:null,roleId:null},roleIds=[fromRow.roleId,fromBody.roleId].filter((id)=>Boolean(id)),userIds=[fromRow.userId,fromBody.userId].filter((id)=>Boolean(id));if(roleIds.length===0||userIds.length===0)return{targetRoleName:null,subjectIsGodmin:!0};let names2=await Promise.all(roleIds.map((id)=>roleNameOf(db,rolesTable,id,logger2)));if(names2.some((name2)=>name2===null))return{targetRoleName:null,subjectIsGodmin:!0};let readable=names2.filter((name2)=>name2!==null),targetRoleName=readable.find((name2)=>isGodminRole(name2))??readable[0]??null,godminFlags=await Promise.all(userIds.map((id)=>isGodmin3(db,userRolesTable,rolesTable,id,logger2)));return{targetRoleName,subjectIsGodmin:godminFlags.some(Boolean)}}init_esm3();function buildBodySchemaFromEntityColumns(entityColumns){let properties={};if(!entityColumns||entityColumns.length===0)return Type.Object({},{additionalProperties:!0});for(let col8 of entityColumns)switch(col8.type?.toLowerCase()||"string"){case"integer":case"int":case"serial":case"bigserial":case"numeric":case"decimal":properties[col8.name]=col8.notNull?Type.Number():Type.Optional(Type.Number());break;case"boolean":properties[col8.name]=col8.notNull?Type.Boolean():Type.Optional(Type.Boolean());break;case"timestamp":case"timestamptz":case"date":properties[col8.name]=col8.notNull?Type.String({format:"date-time"}):Type.Optional(Type.String({format:"date-time"}));break;case"json":case"jsonb":properties[col8.name]=Type.Optional(Type.Unknown());break;case"uuid":properties[col8.name]=col8.notNull?Type.String({format:"uuid"}):Type.Optional(Type.String({format:"uuid"}));break;default:properties[col8.name]=col8.notNull?Type.String():Type.Optional(Type.String())}return Type.Object(properties,{additionalProperties:!0})}function createBulkUpdateSchema(entityColumns){return Type.Array(Type.Object({id:Type.String(),data:Type.Partial(buildBodySchemaFromEntityColumns(entityColumns))}))}var MAX_BULK_ITEMS=500;function collectFilterFields(filter,out=[]){if(filter.operator==="or"||filter.operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];for(let f of group)collectFilterFields(f,out)}else if(filter.field)out.push(String(filter.field));return out}function firstUnknownField(fields,resolveCol){for(let field of fields){let trimmed=field.trim();if(trimmed!==""&&!resolveCol(trimmed))return trimmed}return null}var FILTER_OPERATORS=new Set(["eq","neq","gt","gte","lt","lte","like","ilike","in","notIn","isNull","isNotNull","arrayOverlaps","arrayContains","arrayEmpty","or","and"]);function firstUnusableCondition(filter){let operator=filter.operator;if(typeof operator!=="string"||!FILTER_OPERATORS.has(operator))return`Unknown operator in filter: ${String(operator)}`;if(operator==="or"||operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];if(group.length===0)return`Empty "${operator}" group in filter`;for(let sub of group){let unusable=firstUnusableCondition(sub);if(unusable)return unusable}return null}if(typeof filter.field!=="string"||filter.field.trim()==="")return'A filter condition needs a "field"';return null}function buildFilterCondition(filter,resolveCol){if(filter.operator==="or"||filter.operator==="and"){let subs=(Array.isArray(filter.value)?filter.value:[]).map((f)=>buildFilterCondition(f,resolveCol)).filter((c)=>c!==null);if(subs.length===0)return null;return(filter.operator==="or"?or5(...subs):and22(...subs))??null}if(!filter.field)return null;let col8=resolveCol(filter.field);if(!col8)return null;let sqlCol=col8,dataType=col8.dataType,coerce2=(v)=>dataType==="date"&&(typeof v==="string"||typeof v==="number")?new Date(v):v,columnType=col8.columnType??"",isInt4=/^Pg(Integer|Serial|SmallInt|SmallSerial)$/.test(columnType),outOfInt4=(v)=>{if(!isInt4)return!1;let n=typeof v==="number"?v:typeof v==="string"&&v.trim()!==""?Number(v):NaN;return Number.isFinite(n)&&(n>2147483647||n<-2147483648)};if(["eq","neq","gt","gte","lt","lte"].includes(filter.operator)&&outOfInt4(filter.value))return sql9`false`;if((filter.operator==="in"||filter.operator==="notIn")&&Array.isArray(filter.value)){let inRange=filter.value.filter((v)=>!outOfInt4(v));if(inRange.length===0)return filter.operator==="in"?sql9`false`:null;filter={...filter,value:inRange}}switch(filter.operator){case"eq":return eq36(sqlCol,coerce2(filter.value));case"neq":return ne4(sqlCol,coerce2(filter.value));case"gt":return gt(sqlCol,coerce2(filter.value));case"gte":return gte(sqlCol,coerce2(filter.value));case"lt":return lt2(sqlCol,coerce2(filter.value));case"lte":return lte(sqlCol,coerce2(filter.value));case"like":return like(sqlCol,filter.value);case"ilike":return ilike(sqlCol,filter.value);case"in":return inArray14(sqlCol,filter.value);case"notIn":return notInArray(sqlCol,filter.value);case"arrayOverlaps":return arrayOverlaps(sqlCol,filter.value??[]);case"arrayContains":return arrayContains(sqlCol,filter.value??[]);case"arrayEmpty":return sql9`cardinality(${sqlCol}) = 0`;case"isNull":return isNull5(sqlCol);case"isNotNull":return isNotNull2(sqlCol);default:return null}}function describeIgnoredFields(fields){if(fields.length===0)return{};let unique=[...new Set(fields)];return{ignored_fields:unique,message:`Saved. These fields were ignored because they cannot be set this way: ${unique.join(", ")}.`}}async function discardUploads(uploaded,storageBase,log4){for(let f of uploaded?.success??[])try{await deleteFile(f.path,f.name,storageBase)}catch{log4.warn(`[Entity] Could not discard ${f.path}/${f.name} after a refused request`)}}function createEntityRoutes(app,config){let{db,schemaTables,schemaRelations,entities,logger:logger2,dbPool,storage,cdnMedia,authorization,authMode,idpUrl,featureAdminRoles}=config,getRegistry=()=>config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry??null,getReqSchema=(request)=>{let tenantRegistry=getRegistry();if(!tenantRegistry)return{tables:schemaTables,relations:schemaRelations};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{tables:schemaTables,relations:schemaRelations};let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?{tables:ctx.schemaTables,relations:ctx.schemaRelations}:{tables:schemaTables,relations:schemaRelations}},storageConfig=mergeStorageConfig(storage),warmUploadedMedia=(uploaded)=>{if(!cdnMedia||!uploaded||uploaded.success.length===0)return;scheduleUploadMediaProcessing(uploaded.success,{storagePath:storageConfig.basePath,media:cdnMedia,logger:logger2})},authEnabled=authorization?.enabled??!1,enforceFieldWrites=authEnabled&&authorization?.enforceFieldWriteClaims!==!1,isConsumerMode=authMode==="consumer",filterWritePayload=(payload,authResult)=>{if(!enforceFieldWrites||!authResult?.allowedFields)return payload;return filterResponseFields(payload,authResult.allowedFields)},auditPathContext=(request)=>{let url=new URL(request.url);return{path:url.pathname,query:url.search}},auditIdentityFor=(table,payload,userId,headers)=>createAuditIdentity(isAnonymousCreate(table,payload),userId,headers),UUID_RE=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,auditEntityId=(id)=>{let s=id==null?"":String(id);return UUID_RE.test(s)?s:null},projectWrittenRow=(row,authResult)=>{let scoped2=authEnabled&&authResult?.allowedFields?filterResponseFields(row,[...authResult.allowedFields,...authResult.allowedRelations??[]]):row;return stripUnclaimedSensitive(redactSensitiveOutput(scoped2),authResult?.allowedFields)};if(!db)return app;function snakeToCamel4(s){return s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}let{entities:mergedEntities}=resolveEntities(SYSTEM_TABLES,entities),extendedByName=new Map(mergedEntities.filter((t)=>entities.some((e)=>e.table_name===t.table_name&&e.extends===!0)).map((t)=>[t.table_name,t])),effectiveEntities=entities.map((e)=>extendedByName.get(e.table_name)??e),allTables=Object.keys(schemaTables),entityTableNames=effectiveEntities.map((e)=>snakeToCamel4(e.table_name)),systemTableNames=allTables.filter((tbl)=>!entityTableNames.includes(tbl)),systemTableDefMap=new Map(SYSTEM_TABLES.map((t)=>[snakeToCamel4(t.table_name),t])),asMeta=(def)=>def??void 0,hasUnmetRequirement=(def)=>{let requires=def?.requires;if(!requires||requires.length===0)return null;for(let req of requires)if(req==="email"&&!config.isEmailServiceAvailable?.())return"email";return null},deriveGroupName=(def,fallback)=>{if(def?.group_name)return def.group_name;let primaryFeature=def?.feature_set?.[0];if(!primaryFeature)return fallback;return primaryFeature.charAt(0).toUpperCase()+primaryFeature.slice(1)},systemTables2=systemTableNames.filter((name2)=>{let unmet=hasUnmetRequirement(asMeta(systemTableDefMap.get(name2)));if(unmet)return logger2.info(`Skipping ${name2} routes - missing required dependency: ${unmet}`),!1;return!0}).map((name2)=>{let def=systemTableDefMap.get(name2),meta=asMeta(def);return{table_name:def?.table_name??name2,group_name:deriveGroupName(meta,name2),is_form_data:def?.is_form_data===!0,bulk_endpoints_enabled:def?.bulk_endpoints_enabled??!1,excluded_methods:def?.excluded_methods?[...def.excluded_methods]:[],columns:def?.columns?[...def.columns]:void 0}}),allEntities=[...effectiveEntities,...systemTables2],publicGetEntities=new Set;for(let e of allEntities)if(e.is_public?.GET===!0)publicGetEntities.add(e.table_name),publicGetEntities.add(snakeToCamel4(e.table_name));logger2.info(`All entities: ${allEntities.map((e)=>e.table_name).join(", ")}`);for(let table of allEntities){let rawTableName=table.table_name,tableName=snakeToCamel4(rawTableName),swaggerTag=table.group_name||rawTableName,writeFields=enforceFieldWrites?table.columns?.map((c)=>c.name):void 0,defaultDrizzleTable=schemaTables[tableName];if(!defaultDrizzleTable)continue;let tableRelations=schemaRelations[`${tableName}Relations`];logger2.info(`Creating routes for table: ${tableName}`);let relationTargetTable={};{let rels=tableRelations;if(rels?.table&&typeof rels?.config==="function")try{let built=rels.config(createTableRelationsHelpers(rels.table));for(let[relName,rel]of Object.entries(built))if(rel?.referencedTable)relationTargetTable[relName]=getTableName(rel.referencedTable)}catch(err){logger2.warn(`[Authorization] Could not map relations for ${tableName}`,{error:err instanceof Error?err.message:String(err)})}}let defaultTableColumns=defaultDrizzleTable,defaultIdCol=defaultTableColumns.id,database=db,drizzleTable=defaultDrizzleTable,tableColumns=defaultTableColumns,idCol=defaultIdCol,resolveCol=(field)=>{if(Object.hasOwn(tableColumns,field))return tableColumns[field];let camel=snakeToCamel4(field);return Object.hasOwn(tableColumns,camel)?tableColumns[camel]:void 0},getTableForRequest=(request)=>{if(!getRegistry())return{drizzleTable,tableColumns,idCol,resolveCol,schemaTables,schemaRelations};let reqSchema=getReqSchema(request),reqTable=reqSchema.tables[tableName]||drizzleTable,reqCols=reqTable,reqIdCol=reqCols.id;return{drizzleTable:reqTable,tableColumns:reqCols,idCol:reqIdCol,resolveCol:(field)=>{if(Object.hasOwn(reqCols,field))return reqCols[field];let camel=snakeToCamel4(field);return Object.hasOwn(reqCols,camel)?reqCols[camel]:void 0},schemaTables:reqSchema.tables,schemaRelations:reqSchema.relations}},bulkUpdateSchema=createBulkUpdateSchema(table.columns),bulkDeleteSchema=Type.Array(Type.String()),authzLog=logger2.scoped("authorization.check"),performAuthCheck=async(request,method,reqFields,reqRelations)=>{let result=await runAuthCheck(request,method,reqFields,reqRelations);if(result){let userId=request.headers.get("x-user-id"),requestId=request.headers.get("x-request-id")||void 0;if(!result.authorized)authzLog.warn(`Denied ${method} ${table.table_name}`,{requestId,userId,entity:table.table_name,method,reason:result.reason||"no reason provided",mode:isConsumerMode?idpUrl?"idp":"jwt":"local"});else if(result.scopeFilters||result.allowedFields||result.allowedRelations)authzLog.debug(`Allowed ${method} ${table.table_name} (restricted)`,{requestId,userId,entity:table.table_name,method,scopeFilters:result.scopeFilters,allowedFieldCount:result.allowedFields?.length,allowedRelations:result.allowedRelations})}return result},scopeConditionsFor=(authResult,resolveColumn)=>{if(!authEnabled||!authResult?.scopeFilters)return[];let{conditions,unresolvedFields}=buildScopeConditions(authResult.scopeFilters,resolveColumn);if(unresolvedFields.length>0)authzLog.error(`Scope references unknown column(s) on ${table.table_name}; failing closed (0 rows)`,{entity:table.table_name,unresolvedFields});return conditions},runAuthCheck=async(request,method,reqFields,reqRelations,entityName=table.table_name)=>{let userId=request.headers.get("x-user-id");if(!authEnabled||!userId)return null;if(isConsumerMode){let userClaims=decodeHeaderList(request.headers.get("x-user-claims")),userRoles=decodeHeaderList(request.headers.get("x-user-roles")),userClaimScopes=decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes"));if(idpUrl&&authorization?.jwtClaimsMode==="resolve"){let accessToken=request.headers.get("x-access-token")||(request.headers.get("cookie")||"").match(/access_token=([^;]+)/)?.[1]||"";return checkAuthorizationViaIDP({idpUrl,accessToken,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2})}return checkAuthorizationFromJWT({userClaims,userRoles,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimScopes:userClaimScopes})}let reqCtx=getTableForRequest(request);return checkAuthorization({userId,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,db:database,schemaTables:reqCtx.schemaTables,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimCeiling:apiKeyClaimCeiling(request),getUserData:async()=>{if(!database)return;let usersTbl=reqCtx.schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!usersTbl)return;let idCol2=usersTbl.id;if(!idCol2)return;return(await database.select().from(usersTbl).where(eq36(idCol2,userId)).limit(1))[0]}})},endSessionsForDeactivated=async(request,changed)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.users)return;let userIds=changed.filter((one)=>one.after?.isActive===!1&&one.before?.isActive!==!1).map((one)=>String(one.after?.id??"").trim()).filter(Boolean);if(userIds.length===0)return;let authTables=resolveAuthTablesForRequest(request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry});await revokeUserSessions({db:database,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error("[Entity] users rows were deactivated but their open sessions were not cleared",{error:error3,userIds})},userIds)},renameStrandsVerification=async(id,payload)=>{if(!database)return null;if(tableName!==AUTHORIZATION_TABLE_KEYS.roles)return null;let newName=payload.name;if(typeof newName!=="string")return null;let oldName=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0]?.name;if(typeof oldName!=="string"||oldName===newName)return null;return await verifierAwaitedByVerification(database,schemaTables,{role:oldName})?oldName:null},deactivationStrandsVerification=async(id,payload)=>{if(!database)return null;let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return null;if(payload.isActive!==!1&&payload.is_active!==!1)return null;let row=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0];if(!row)return null;if(row.isActive===!1||row.is_active===!1)return null;let who=isRoles?{role:String(row.name??"")}:{userId:id};if(isRoles&&!who.role)return null;if(!await verifierAwaitedByVerification(database,schemaTables,who))return null;return isRoles?String(row.name):String(row.email??row.name??id)},assignmentWithdrawalStrands=async(id,payload)=>{if(!database)return null;if(tableName!==AUTHORIZATION_TABLE_KEYS.userRoles)return null;if(payload&&payload.isActive!==!1&&payload.is_active!==!1)return null;let row=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0];if(!row)return null;if(payload&&(row.isActive===!1||row.is_active===!1))return null;let userId=String(row.userId??row.user_id??""),roleId=String(row.roleId??row.role_id??"");if(!userId||!roleId)return null;let rolesTable=schemaTables.roles;if(!rolesTable)return null;let roleCols=rolesTable,roleName=(await database.select().from(rolesTable).where(eq36(roleCols.id,roleId)).limit(1))[0]?.name;if(!roleName)return null;return await assignmentAwaitedByVerification(database,schemaTables,{userId,roleName:String(roleName)})?String(roleName):null},strandsVerification=async(ids)=>{if(!database)return[];let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return[];let blocked=[];for(let id of ids){let who={userId:id};if(isRoles){let name2=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0]?.name;if(!name2)continue;who={role:String(name2)}}if(await verifierAwaitedByVerification(database,schemaTables,who))blocked.push(id)}return blocked},announceWrite=(request,operation,rows,writtenBy)=>{if(!config.onEntityWritten)return;for(let row of Array.isArray(rows)?rows:[rows]){let id=row?.id;if(!id)continue;config.onEntityWritten({entityName:tableName,entityId:String(id),operation,userId:writtenBy||void 0,request})}},refreshClaimsCache=()=>refreshClaimsCacheAfterWrite({tableName,claimsCache:config.claimsCache,logger:logger2}),syncGodFlagsAfterWrite=async(request,changes)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.userRoles||!database)return;await syncGodFlags({db:database,schemaTables:getReqSchema(request).tables,logger:logger2},changes)},declared=[],entityGuards=[],listLog=logger2.scoped("entity.list"),isRbacTable=tableName===AUTHORIZATION_TABLE_KEYS.roles||tableName===AUTHORIZATION_TABLE_KEYS.claims||tableName===AUTHORIZATION_TABLE_KEYS.roleClaims,isUserRoleTable=tableName===AUTHORIZATION_TABLE_KEYS.userRoles,roleAssignRoles=featureAdminRoles?.authorization??[];if(new Set(["verifications","verification_instances","verification_requirements","verification_passes","verification_action_runs","verificationInstances","verificationRequirements","verificationPasses","verificationActionRuns"]).has(tableName))entityGuards.push(async({request,set:set2})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;return set2.status=403,{success:!1,message:`Forbidden: '${tableName}' is written only by the verification engine. Decisions are recorded through the /verifications routes and are not editable afterwards.`}});if(tableName===AUTHORIZATION_TABLE_KEYS.users)entityGuards.push(async({request,set:set2})=>{if(request.method.toUpperCase()!=="POST")return;return set2.status=403,{success:!1,message:"Forbidden: users cannot be created through the generic entity API \u2014 it would create an account with no password. Use POST /auth/admin/create-user."}});if(isRbacTable||isUserRoleTable||isSensitiveSystemTable(tableName)){let denyMessage=isRbacTable?"Forbidden: managing roles and claims requires godmin privileges":isUserRoleTable?"Forbidden: assigning roles requires godmin privileges":`Forbidden: writing to '${tableName}' via the generic entity API requires godmin privileges \u2014 use the dedicated route`,callerIsGodminInDb=async(request)=>mayActAsGodmin(request)&&await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2);entityGuards.push(async({request,set:set2,body,params})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;if(isUserRoleTable&&isApiKeyRequest(request))return logger2.warn("[AUTH] API key refused a user_roles write",{method,keyId:request.headers.get("x-api-key-id"),userId:request.headers.get("x-user-id")}),set2.status=403,{success:!1,message:apiKeyRefusalMessage("assigning or removing roles")};if(hasGodminRole(request))return;if(isFeatureAdmin({isRbacTable:isRbacTable||isUserRoleTable,featureSet:table.feature_set,featureAdminRoles,callerRoles:decodeHeaderList(request.headers.get("x-user-roles"))}))return;if(isUserRoleTable&&roleAssignRoles.length>0){let subject=await resolveUserRoleSubject({db,schemaTables:getReqSchema(request).tables,logger:logger2},{rowId:typeof params?.id==="string"?params.id:null,body}),decision=decideRoleAssign({callerIsGod:!1,callerRoleNames:decodeHeaderList(request.headers.get("x-user-roles")),allowRoles:roleAssignRoles,targetRoleName:subject.targetRoleName??GODMIN_ROLE_NAME,subjectIsGodmin:subject.subjectIsGodmin,godminRoleName:GODMIN_ROLE_NAME});if(decision.allowed)return;if(await callerIsGodminInDb(request))return;return set2.status=403,{success:!1,reason:decision.reason,message:ROLE_ASSIGN_REFUSALS[decision.reason]}}if(await callerIsGodminInDb(request))return;return set2.status=403,{success:!1,message:denyMessage}})}if(!table.excluded_methods?.includes("GET"))declared.push(defineRoute({method:"GET",path:"/",detail:{tags:[swaggerTag],summary:`List ${tableName}`,description:`Get paginated list of ${tableName} records with filtering, sorting, and search`},handler:async(ctx)=>{if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let{drizzleTable:drizzleTable2,resolveCol:resolveCol2,schemaRelations:schemaRelations2}=getTableForRequest(ctx.request),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=Object.keys(schemaRelations2).filter((k)=>k.startsWith(`${tableName}Relations`)).map((k)=>k.replace("Relations","")),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};let fieldQueryable=(field)=>{if(isSensitiveOutputKey(field))return!1;if(!sensitiveFieldQueryable(field,{authEnabled,allowedFields:authResult?.allowedFields}))return!1;if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(field))return!1;return!0},q=parseQueryParams(ctx.query);if(q.malformed)return ctx.set.status=400,{success:!1,message:`Malformed query parameter: ${q.malformed.join(", ")} (expected a JSON array)`};let conditions=[];if(conditions.push(...scopeConditionsFor(authResult,resolveCol2)),q.search&&!q.searchFields)return ctx.set.status=400,{success:!1,message:"A 'search' needs 'searchFields' naming the columns to search, e.g. searchFields=name,email \u2014 without it the term would be ignored and every row returned."};if(q.search&&q.searchFields){for(let f of q.searchFields)if(!fieldQueryable(f.trim()))return ctx.set.status=403,{success:!1,message:`Cannot search on field: ${f.trim()}`};let unknown3=firstUnknownField(q.searchFields,resolveCol2);if(unknown3)return ctx.set.status=400,{success:!1,message:`Unknown field in search: ${unknown3}`};let searchColumns=q.searchFields.map((f)=>resolveCol2(f.trim())).filter((c)=>c!==null),searchCondition=buildSearchCondition(searchColumns,q.search);if(searchCondition)conditions.push(searchCondition)}if(Array.isArray(q.filters))for(let filter of q.filters){let referenced=collectFilterFields(filter);for(let f of referenced)if(!fieldQueryable(f))return ctx.set.status=403,{success:!1,message:`Cannot filter on field: ${f}`};let unknownFilterField=firstUnknownField(referenced,resolveCol2);if(unknownFilterField)return ctx.set.status=400,{success:!1,message:`Unknown field in filter: ${unknownFilterField}`};let unusable=firstUnusableCondition(filter);if(unusable)return ctx.set.status=400,{success:!1,message:unusable};let cond=buildFilterCondition(filter,resolveCol2);if(cond)conditions.push(cond)}let projection;if(q.select&&q.select.length>0){let requested=[...new Set(["id",...q.select.map((f)=>f.trim())])].filter(Boolean),columns={};for(let field of requested){if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot select field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in select: ${field}`};columns[field]=col8}if(Object.keys(columns).length>0)projection=columns}let unprojected=database.select().from(drizzleTable2),baseQuery=projection?database.select(projection).from(drizzleTable2):unprojected;if(conditions.length>0){let combined=and22(...conditions);if(combined)baseQuery=baseQuery.where(combined)}if(q.sort&&q.sort.length>0){let orderClauses=[];for(let s of q.sort){let field=typeof s?.field==="string"?s.field.trim():"";if(field==="")return ctx.set.status=400,{success:!1,message:'Malformed query parameter: sort (every entry needs a "field")'};if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot sort on field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in sort: ${field}`};orderClauses.push(s.direction==="desc"?desc5(col8):asc2(col8))}if(orderClauses.length>0)baseQuery=baseQuery.orderBy(...orderClauses)}let page=q.page??1,limit=q.limit??20,offset=q.offset??(page-1)*limit;if(q.groupBy){let field=q.groupBy.trim();if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot group by field: ${field}`};let groupCol=resolveCol2(field);if(!groupCol)return ctx.set.status=400,{success:!1,message:`Unknown field in groupBy: ${field}`};let where=conditions.length>0?and22(...conditions):void 0,col8=groupCol,distinctCount=await database.select({n:sql9`count(distinct ${col8})::int`}).from(drizzleTable2).where(where),totalGroups=Number(distinctCount[0]?.n??0);return{success:!0,data:{items:(await database.select({value:col8,count:sql9`count(*)::int`}).from(drizzleTable2).where(where).groupBy(col8).orderBy(sql9`count(*) desc`,col8).limit(limit).offset(offset)).map((g)=>({value:g.value,count:Number(g.count)})),meta:buildPaginationMeta(page,limit,offset,totalGroups)}}}let queryStart=performance.now(),combinedCount=conditions.length>0?and22(...conditions):void 0,countResult=await database.select({n:sql9`count(*)::int`}).from(drizzleTable2).where(combinedCount),totalItems=Number(countResult[0]?.n??0);baseQuery=baseQuery.limit(limit).offset(offset);let items=await baseQuery,meta=buildPaginationMeta(page,limit,offset,totalItems);if(listLog.debug(`List ${rawTableName}: ${items.length}/${totalItems} rows`,{requestId:ctx.request.headers.get("x-request-id")||void 0,table:rawTableName,page,limit,totalItems,returned:items.length,conditionCount:conditions.length,search:q.search||void 0,sort:Array.isArray(q.sort)?q.sort.map((s)=>`${s.field}:${s.direction}`):void 0,queryMs:Math.round(performance.now()-queryStart)}),authEnabled&&authResult?.allowedFields)items=filterResponseFields(items,authResult.allowedFields);return{success:!0,data:{items:items.map((r)=>stripUnclaimedSensitive(redactSensitiveOutput(r),authResult?.allowedFields)),meta}}}})),declared.push(defineRoute({method:"GET",path:"/:id",detail:{tags:[swaggerTag],summary:`Get ${tableName} by ID`,description:`Get a single ${tableName} record by its ID with optional relations`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,schemaRelations:schemaRelations2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,q=parseQueryParams(ctx.query),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=q.with?.map((w)=>w.name),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(q.malformed?.includes("with"))return ctx.set.status=400,{success:!1,message:"Malformed query parameter: with (expected a JSON array)"};let getScope=scopeConditionsFor(authResult,resolveCol2),getWhere=getScope.length>0?and22(eq36(idCol2,params.id),...getScope):eq36(idCol2,params.id);if(q.with&&q.with.length>0&&tableRelations&&dbPool){let allowedWith=authEnabled&&authResult?.allowedRelations?q.with.filter((w)=>authResult.allowedRelations?.includes(w.name)??!1):q.with,dbWithRelations=drizzle(dbPool,{schema:{...schemaTables2,...schemaRelations2}}),withClause={};for(let rel of allowedWith){let targetTable=relationTargetTable[rel.name],relAuth=authEnabled&&targetTable?await runAuthCheck(ctx.request,"GET",void 0,void 0,targetTable):null,decision=decideRelationExpansion({authEnabled,targetTable,relAuth,isTargetPublicGet:targetTable?publicGetEntities.has(targetTable):!1});if(!decision.expand)continue;let relScope=decision.scope;if(relScope&&Object.keys(relScope).length>0)withClause[rel.name]={...rel.limit?{limit:rel.limit}:{},where:(fields,ops)=>{let preds=[],unresolved=!1;for(let[k,v]of Object.entries(relScope)){let col8=resolveRelationScopeColumn(fields,k,snakeToCamel4);if(col8)preds.push(ops.eq(col8,v));else unresolved=!0}if(unresolved)return sql9`1 = 0`;return preds.length>0?ops.and(...preds):void 0}};else withClause[rel.name]=rel.limit?{limit:rel.limit}:!0}let result2=await dbWithRelations.query[tableName]?.findFirst({where:getWhere,with:withClause});if(!result2)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result2=filterResponseFields(result2,[...authResult.allowedFields,...authResult.allowedRelations??[]]);if(authEnabled&&authResult?.allowedRelations)result2=filterResponseRelations(result2,authResult.allowedRelations);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result2),authResult?.allowedFields)}}let result=(await database.select().from(drizzleTable2).where(getWhere))[0]||null;if(!result)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result=filterResponseFields(result,authResult.allowedFields);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result),authResult?.allowedFields)}}})),declared.push(defineRoute({method:"GET",path:"/distinct/:field",detail:{tags:[swaggerTag],summary:`Get distinct ${tableName} values`,description:`Get distinct values for a specific field in ${tableName}`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let params=ctx.params,authResult=await performAuthCheck(ctx.request,"GET",[params.field],[]);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(isSensitiveOutputKey(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(!sensitiveFieldQueryable(params.field,{authEnabled,allowedFields:authResult?.allowedFields}))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};let col8=resolveCol2(params.field);if(!col8)return ctx.set.status=404,{success:!1,message:"Field not found"};let distinctScope=scopeConditionsFor(authResult,resolveCol2),distinctQuery=database.selectDistinct({value:col8}).from(drizzleTable2);return{success:!0,data:distinctScope.length>0?await distinctQuery.where(and22(...distinctScope)):await distinctQuery}}}));if(!table.excluded_methods?.includes("POST"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"POST",path:"/",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Create ${tableName} with files`,description:`Create a new ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let userId=ctx.request.headers.get("x-user-id"),postFormAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postFormAuthResult&&!postFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postFormAuthResult.reason||"Forbidden"};let{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,uploadedFiles=null;if(files.length>0){if(uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),uploadedFiles.failed.length>0&&uploadedFiles.success.length===0){let allRefused=uploadedFiles.failed.every((one)=>one.rejected===!0),aboutType=allRefused&&uploadedFiles.failed.some((one)=>one.error.includes("File type"));return ctx.set.status=allRefused?aboutType?415:400:500,{success:!1,message:allRefused?"File refused":"File upload failed",errors:uploadedFiles.failed}}warmUploadedMedia(uploadedFiles)}let mergeUploadedMetadata=()=>{let firstFile=uploadedFiles?.success[0];if(firstFile)payload={...payload,...buildFileRecordPayload(firstFile,userId)}},ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postFormAuthResult),mergeUploadedMetadata();else mergeUploadedMetadata();let scopedForm=forceCreateScope(payload,postFormAuthResult,resolveCol2);if(!scopedForm.ok)return await discardUploads(uploadedFiles,storageConfig.basePath,logger2),ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedForm.field}' this entity does not have`};if(table.columns){let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return await discardUploads(uploadedFiles,storageConfig.basePath,logger2),ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;let result=await database.insert(drizzleTable2).values(payload).returning();announceWrite(ctx.request,"create",result,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postFormAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));else declared.push(defineRoute({method:"POST",path:"/",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Create ${tableName}`,description:`Create a new ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let payload=ctx.body,userId=ctx.request.headers.get("x-user-id"),postAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postAuthResult&&!postAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postAuthResult.reason||"Forbidden"};let ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postAuthResult);let scoped2=forceCreateScope(payload,postAuthResult,resolveCol2);if(!scoped2.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scoped2.field}' this entity does not have`};if(table.columns){let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.userId&&payload.roleId){let cols=drizzleTable2,existing=await database.select().from(drizzleTable2).where(and22(eq36(cols.userId,payload.userId),eq36(cols.roleId,payload.roleId))).limit(1);if(existing.length>0)return{success:!0,data:existing[0]}}let result=await database.insert(drizzleTable2).values(payload).returning();if(announceWrite(ctx.request,"create",result,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{after:result[0]}]),config.onRoleChanged&&tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.roleId&&payload.userId)try{let rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles];if(rolesTable){let roleName=(await database.select().from(rolesTable).where(eq36(rolesTable.id,payload.roleId)).limit(1))[0]?.name;if(roleName)config.onRoleChanged({userId:String(payload.userId),roleName,assigned:!0,actorId:userId??void 0})}}catch(error3){logger2.warn("[Entity] Could not read the assigned role to report it",{error:error3 instanceof Error?error3.message:String(error3)})}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PUT"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"PUT",path:"/:id",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Update ${tableName} with files`,description:`Full update of ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),putFormAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putFormAuthResult&&!putFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putFormAuthResult.reason||"Forbidden"};let putFormScope=scopeConditionsFor(putFormAuthResult,resolveCol2),putFormWhere=putFormScope.length>0?and22(eq36(idCol2,params.id),...putFormScope):eq36(idCol2,params.id),{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,oldRecord=await database.select().from(drizzleTable2).where(putFormWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putFormAuthResult);let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let uploadedFiles=null;if(files.length>0)uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),warmUploadedMedia(uploadedFiles);if(Object.keys(payload).length===0){ctx.set.status=400;let dropped=ignoredFields.length>0?ignoredFields:void 0,contentType=(ctx.request.headers.get("content-type")||"").toLowerCase();if(table.is_form_data&&!contentType.includes("multipart/form-data"))return{success:!1,message:`This endpoint reads multipart/form-data: send the fields as a 'data' JSON part (and the file, if any, as '${storageConfig.formData?.filesField??"files"}'). A ${contentType||"bodyless"} request carries nothing it can read.`};return{success:!1,message:dropped?`Nothing to update: every field sent is managed by the server and cannot be set this way (${[...new Set(dropped)].join(", ")}).`:"Nothing to update: no writable field was sent.",...dropped?{ignored_fields:[...new Set(dropped)]}:{}}}let result=await database.update(drizzleTable2).set(payload).where(putFormWhere).returning();announceWrite(ctx.request,"update",result,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:{record:result[0],files:uploadedFiles?.success||[],fileErrors:uploadedFiles?.failed||[]}}}}));else declared.push(defineRoute({method:"PUT",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Update ${tableName}`,description:`Full update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),putAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putAuthResult&&!putAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putAuthResult.reason||"Forbidden"};let putScope=scopeConditionsFor(putAuthResult,resolveCol2),putWhere=putScope.length>0?and22(eq36(idCol2,params.id),...putScope):eq36(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(putWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putAuthResult);let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`};let strandedRole=await assignmentWithdrawalStrands(params.id,payload);if(strandedRole)return ctx.set.status=409,{success:!1,message:`Cannot withdraw the '${strandedRole}' role from this user: an approval chain is waiting on them to decide a step through it, and nobody else can take that step. Complete or reject that verification first, or unpublish the flow.`}}if(Object.keys(payload).length===0){ctx.set.status=400;let dropped=ignoredFields.length>0?ignoredFields:void 0,contentType=(ctx.request.headers.get("content-type")||"").toLowerCase();if(table.is_form_data&&!contentType.includes("multipart/form-data"))return{success:!1,message:`This endpoint reads multipart/form-data: send the fields as a 'data' JSON part (and the file, if any, as '${storageConfig.formData?.filesField??"files"}'). A ${contentType||"bodyless"} request carries nothing it can read.`};return{success:!1,message:dropped?`Nothing to update: every field sent is managed by the server and cannot be set this way (${[...new Set(dropped)].join(", ")}).`:"Nothing to update: no writable field was sent.",...dropped?{ignored_fields:[...new Set(dropped)]}:{}}}let result=await database.update(drizzleTable2).set(payload).where(putWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),putAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PATCH"))declared.push(defineRoute({method:"PATCH",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Patch ${tableName}`,description:`Partial update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),patchAuthResult=await performAuthCheck(ctx.request,"PATCH",writeFields);if(patchAuthResult&&!patchAuthResult.authorized)return ctx.set.status=403,{success:!1,message:patchAuthResult.reason||"Forbidden"};let patchScope=scopeConditionsFor(patchAuthResult,resolveCol2),patchWhere=patchScope.length>0?and22(eq36(idCol2,params.id),...patchScope):eq36(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(patchWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,patchAuthResult);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`};let strandedRole=await assignmentWithdrawalStrands(params.id,payload);if(strandedRole)return ctx.set.status=409,{success:!1,message:`Cannot withdraw the '${strandedRole}' role from this user: an approval chain is waiting on them to decide a step through it, and nobody else can take that step. Complete or reject that verification first, or unpublish the flow.`}}let result=await database.update(drizzleTable2).set(payload).where(patchWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"PATCH",userId:userId||void 0,summary:`Patched ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),patchAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/:id",detail:{tags:[swaggerTag],summary:`Delete ${tableName}`,description:`Delete a ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),deleteAuthResult=await performAuthCheck(ctx.request,"DELETE");if(deleteAuthResult&&!deleteAuthResult.authorized)return ctx.set.status=403,{success:!1,message:deleteAuthResult.reason||"Forbidden"};let deleteScope=scopeConditionsFor(deleteAuthResult,resolveCol2),deleteWhere=deleteScope.length>0?and22(eq36(idCol2,params.id),...deleteScope):eq36(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(deleteWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(await activeVerificationExists(database,schemaTables2,tableName,params.id))return ctx.set.status=409,{success:!1,message:`Cannot delete: this ${tableName} is in an active verification. Complete or reject it first.`};if((await strandsVerification([params.id])).length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on this ${tableName} to decide a step. Complete or reject that verification first, or reassign the step.`};{let strandedRole=await assignmentWithdrawalStrands(params.id);if(strandedRole)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on this user to decide a step through the '${strandedRole}' role, and nobody else can take it. Complete or reject that verification first, or unpublish the flow.`}}if(await database.delete(drizzleTable2).where(deleteWhere),table.is_form_data&&storageConfig.enabled&&oldRecord[0]){let rec=oldRecord[0],filePath=rec.path,fileName=rec.name;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${params.id})`)}}if(oldRecord[0]){let link=accountLinkFor(config.accountLinks,tableName),userIds=link?accountIdsIn([oldRecord[0]],link.userColumn):[];if(userIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables2[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables2.userSessions??schemaTables2.sessions,schemaTables:schemaTables2,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${tableName} ${params.id} was deleted but its account could not be closed`,{error:error3})},userIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] Account behind ${tableName} ${params.id} was deactivated but its open sessions were not cleared`)}}if(refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0]}]),config.onRoleChanged&&tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&oldRecord[0])try{let deletedUserRole=oldRecord[0],rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles];if(rolesTable&&deletedUserRole.roleId&&deletedUserRole.userId){let roleName=(await database.select().from(rolesTable).where(eq36(rolesTable.id,deletedUserRole.roleId)).limit(1))[0]?.name;if(roleName)config.onRoleChanged({userId:String(deletedUserRole.userId),roleName,assigned:!1,actorId:ctx.request.headers.get("x-user-id")??void 0})}}catch(error3){logger2.warn("[Entity] Could not read the withdrawn role to report it",{error:error3 instanceof Error?error3.message:String(error3)})}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"DELETE",userId:userId||void 0,summary:`Deleted ${table.table_name} (${params.id})`,oldValues:oldRecord[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:null}}}));if(table.bulk_endpoints_enabled){if(!table.excluded_methods?.includes("POST"))declared.push(defineRoute({method:"POST",path:"/bulk",body:Type.Array(Type.Object({},{additionalProperties:!0})),detail:{tags:[swaggerTag],summary:`Bulk create ${tableName}`,description:`Create multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPostAuth=await performAuthCheck(ctx.request,"POST",writeFields);if(bulkPostAuth&&!bulkPostAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPostAuth.reason||"Forbidden"};let sanitizedItems=[];for(let raw of items){let payload=raw,ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPostAuth);let scopedItem=forceCreateScope(payload,bulkPostAuth,resolveCol2);if(!scopedItem.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedItem.field}' this entity does not have`};if(table.columns){let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(userId&&!isAnonymousCreate(table,payload))payload.createdBy=userId;sanitizedItems.push(payload)}let txResult=await database.transaction(async(tx)=>{let results=[];for(let payload of sanitizedItems){let result=await tx.insert(drizzleTable2).values(payload).returning();results.push(result[0])}return results}),auditPath=auditPathContext(ctx.request);announceWrite(ctx.request,"create",txResult,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,txResult.map((row)=>({after:row})));for(let[i,row]of txResult.entries())await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"CREATE",summary:`Bulk created ${table.table_name} (${row.id})`,newValues:row,...auditIdentityFor(table,sanitizedItems[i]??{},userId,ctx.request.headers),...auditPath});return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPostAuth))}}}));if(!table.excluded_methods?.includes("PUT"))declared.push(defineRoute({method:"PUT",path:"/bulk",body:bulkUpdateSchema,detail:{tags:[swaggerTag],summary:`Bulk update ${tableName}`,description:`Update multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPutAuth=await performAuthCheck(ctx.request,"PUT",writeFields);if(bulkPutAuth&&!bulkPutAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPutAuth.reason||"Forbidden"};let bulkPutScope=scopeConditionsFor(bulkPutAuth,resolveCol2),prepared=[];for(let item of items){let payload=item.data,ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPutAuth);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;prepared.push({id:item.id,payload})}let beforeById=new Map,txResult=await database.transaction(async(tx)=>{if(prepared.length>0){let idFilter=inArray14(idCol2,prepared.map((p)=>p.id)),beforeRows=await tx.select().from(drizzleTable2).where(bulkPutScope.length>0?and22(idFilter,...bulkPutScope):idFilter);for(let row of beforeRows)if(row.id!=null)beforeById.set(String(row.id),row)}let results=[];for(let{id,payload}of prepared){let result=await tx.update(drizzleTable2).set(payload).where(bulkPutScope.length>0?and22(eq36(idCol2,id),...bulkPutScope):eq36(idCol2,id)).returning();if(result[0])results.push(result[0])}return results});await endSessionsForDeactivated(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row}))),announceWrite(ctx.request,"update",txResult,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row})));let auditPath=auditPathContext(ctx.request);for(let row of txResult){let rowId=String(row.id);await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"UPDATE",userId:userId||void 0,summary:`Bulk updated ${table.table_name} (${rowId})`,oldValues:beforeById.get(rowId),newValues:row,...auditPath})}return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPutAuth))}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/bulk",body:bulkDeleteSchema,detail:{tags:[swaggerTag],summary:`Bulk delete ${tableName}`,description:`Delete multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let ids=ctx.body;if(!Array.isArray(ids))return{success:!1,message:"Body must be an array of ids"};if(ids.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let bulkDeleteAuth=await performAuthCheck(ctx.request,"DELETE");if(bulkDeleteAuth&&!bulkDeleteAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkDeleteAuth.reason||"Forbidden"};let bulkDeleteScope=scopeConditionsFor(bulkDeleteAuth,resolveCol2),userId=ctx.request.headers.get("x-user-id"),blocked=[];for(let id of ids)if(await activeVerificationExists(database,schemaTables,tableName,id))blocked.push(id);if(blocked.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: ${blocked.length} of these ${tableName} are in an active verification. Complete or reject it first. Blocked ids: ${blocked.join(", ")}`};let stranding=await strandsVerification(ids);if(stranding.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on ${stranding.length} of these ${tableName} to decide a step. Complete or reject those verifications first. Blocked ids: ${stranding.join(", ")}`};{let strandedAssignments=[];for(let id of ids)if(await assignmentWithdrawalStrands(id))strandedAssignments.push(id);if(strandedAssignments.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on ${strandedAssignments.length} of these role assignments to decide a step, and nobody else can take it. Complete or reject those verifications first. Blocked ids: ${strandedAssignments.join(", ")}`}}let removed=[];if(await database.transaction(async(tx)=>{for(let id of ids){let r=await tx.delete(drizzleTable2).where(bulkDeleteScope.length>0?and22(eq36(idCol2,id),...bulkDeleteScope):eq36(idCol2,id)).returning();removed.push(...r)}}),table.is_form_data&&storageConfig.enabled&&removed.length>0)for(let rec of removed){let{path:filePath,name:fileName}=rec;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${String(rec.id)})`)}}{let link=accountLinkFor(config.accountLinks,tableName),bulkUserIds=link?accountIdsIn(removed,link.userColumn):[];if(bulkUserIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${removed.length} ${tableName} rows were deleted but their accounts could not be closed`,{error:error3})},bulkUserIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] ${result.closed} account(s) behind deleted ${tableName} rows were deactivated but their open sessions were not cleared`)}}if(removed.length>0)refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,removed.map((row)=>({before:row})));let auditPath=auditPathContext(ctx.request);for(let row of removed)await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"DELETE",userId:userId||void 0,summary:`Bulk deleted ${table.table_name} (${row.id})`,oldValues:row,...auditPath});return{success:!0,data:{deleted:removed.length}}}}))}mountRoutes(app,[{prefix:`/${tableName}`,guards:entityGuards,routes:declared}])}return app}init_esm3();init_AccountLink();import{randomUUID as randomUUID9}from"crypto";var LOCK_TTL_SECONDS2=60,RENEW_INTERVAL_MS=20000,lockKeyFor=(mappingId)=>`integrations:run:${mappingId}`;async function acquireRunLock(store,mappingId,deps={}){let key2=lockKeyFor(mappingId),now=deps.now??Date.now,ttl=deps.ttlSeconds??LOCK_TTL_SECONDS2,token=randomUUID9(),existing=await store.read(key2);if(!existing.success)return{ok:!1,reason:"unavailable",error:existing.error};if(existing.data)return{ok:!1,reason:"held",heldSince:existing.data.acquiredAt??null};let created=await store.create(key2,{token,acquiredAt:now()},ttl);if(!created.success)return{ok:!1,reason:"unavailable",error:created.error};let readBack=await store.read(key2);if(!readBack.success)return{ok:!1,reason:"unavailable",error:readBack.error};if(readBack.data?.token!==token)return{ok:!1,reason:"held",heldSince:readBack.data?.acquiredAt??null};let held=!0,timer=setInterval(()=>{(async()=>{let current=await store.read(key2);if(!current.success)return;if(current.data?.token!==token){held=!1,clearInterval(timer),deps.logger?.warn("[Integrations] Run lock was taken over",{mappingId});return}await store.create(key2,current.data,ttl)})()},RENEW_INTERVAL_MS);return timer.unref?.(),{ok:!0,handle:{token,isHeld:()=>held,release:async()=>{if(clearInterval(timer),!held)return;held=!1;let current=await store.read(key2);if(current.success&&current.data?.token===token)await store.remove(key2)}}}}import{createHash as createHash4}from"crypto";function buildUrl(baseUrl,path7,params){let base=baseUrl.trim().replace(/\/+$/,"");if(!base)return{ok:!1,error:"The source has no base address."};let raw=(path7??"").trim();if(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)||raw.startsWith("//"))return{ok:!1,error:`The endpoint path points at another host (${raw}). A path must be relative to the source address.`};let suffix=raw===""?"":raw.startsWith("/")?raw:`/${raw}`,url;try{url=new URL(`${base}${suffix}`)}catch{return{ok:!1,error:`The source address is not a valid URL: ${baseUrl}`}}for(let[key2,value2]of Object.entries(params??{})){if(value2==null)continue;url.searchParams.set(key2,String(value2))}return{ok:!0,url}}function applyAuth(source,url){let headers={accept:"application/json",...source.extraHeaders??{}},token=source.token?.trim();if(!token)return{headers};switch(source.authType){case"bearer":case"oauth2":headers[source.authHeaderName||"Authorization"]=`Bearer ${token}`;break;case"api_key":if(source.authQueryParam)url.searchParams.set(source.authQueryParam,token);else headers[source.authHeaderName||"X-API-Key"]=token;break;case"basic":headers.Authorization=`Basic ${token}`;break;default:break}return{headers}}function describeTransportError(error3){let message=error3 instanceof Error?error3.message:String(error3),cause=error3?.cause,code=cause?.code??"",blob=`${message} ${code} ${cause?.message??""}`;if(/UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED|self.signed|CERT_|unable to verify|ERR_TLS|altnames/i.test(blob))return`Certificate verification failed (${code||"incomplete chain"}). If this server's certificate is knowingly self-signed or incomplete, turn off certificate verification for this source and try again.`;if(/ENOTFOUND|EAI_AGAIN|getaddrinfo|Unable to resolve/i.test(blob))return`The address could not be resolved (DNS${code?`: ${code}`:""}). Check the source address.`;if(/ECONNREFUSED/i.test(blob))return`The connection was refused (${code||"ECONNREFUSED"}). The address and port are reachable but nothing is listening.`;if(/ETIMEDOUT|timeout|timed out|aborted|AbortError|UND_ERR/i.test(blob))return`The connection timed out (${code||"timeout"}). Check network and firewall access to this address.`;if(/ECONNRESET|EPIPE/i.test(blob))return`The connection was closed by the other side (${code||"ECONNRESET"}).`;return`Connection error: ${message}`}async function fetchOnce(source,request,deps={}){let impl=deps.fetchImpl??fetch,headers={...request.headers},method=request.method.toUpperCase(),hasBody=request.body!==void 0&&method!=="GET"&&method!=="HEAD";if(hasBody&&!headers["content-type"]&&!headers["Content-Type"])headers["content-type"]="application/json";let init={method,headers,cache:"no-store",signal:AbortSignal.timeout(source.timeoutMs??30000),tls:{rejectUnauthorized:source.tlsVerify!==!1},...hasBody?{body:typeof request.body==="string"?request.body:JSON.stringify(request.body)}:{}},response;try{response=await impl(request.url.toString(),init)}catch(error3){return deps.logger?.warn("[Integrations] Outbound request failed",{sourceId:source.id,url:request.url.origin+request.url.pathname,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,status:0,body:null,linkHeader:null,error:describeTransportError(error3)}}let text2=await response.text().catch(()=>""),body=null;if(text2)try{body=JSON.parse(text2)}catch{body=text2}let linkHeader=response.headers.get("link");if(!response.ok){let detail=typeof body==="string"?body:body==null?"":JSON.stringify(body);return{ok:!1,status:response.status,body,linkHeader,error:`The source returned HTTP ${response.status}${detail?` \u2014 ${detail.slice(0,300)}`:""}`}}return{ok:!0,status:response.status,body,linkHeader}}var EXPIRY_SKEW_MS=5000,DEFAULT_TTL_MS=300000,DEFAULT_REFRESH_TTL_MS=1800000,FIELD_SEPARATOR="\x00";function credentialFingerprint(config){let material=[config.tokenUrl,config.grantType,config.clientId??"",config.clientSecret??"",config.username??"",config.password??"",config.scope??"",config.clientAuth??"basic"].join(FIELD_SEPARATOR);return createHash4("sha256").update(material).digest("hex").slice(0,32)}class TokenCache{entries=new Map;get(sourceId,fingerprint){let entry=this.entries.get(sourceId);if(!entry)return null;if(entry.fingerprint!==fingerprint)return this.entries.delete(sourceId),null;return entry}set(sourceId,token){this.entries.set(sourceId,token)}invalidate(sourceId){this.entries.delete(sourceId)}clear(){this.entries.clear()}}var isUsable=(token,now)=>token.expiresAt>now+EXPIRY_SKEW_MS,canRefresh=(token,now)=>Boolean(token.refreshToken)&&(token.refreshExpiresAt??0)>now+EXPIRY_SKEW_MS;function buildTokenRequest(config,form){let headers={"content-type":"application/x-www-form-urlencoded",accept:"application/json"};if(config.scope&&!form.has("scope"))form.set("scope",config.scope);let clientId=config.clientId??"",clientSecret=config.clientSecret??"";if((config.clientAuth??"basic")==="basic")headers.authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;else{if(clientId)form.set("client_id",clientId);if(clientSecret)form.set("client_secret",clientSecret)}return{headers,body:form.toString()}}async function requestToken(config,form,now,fetchImpl){let{headers,body}=buildTokenRequest(config,form),response;try{response=await fetchImpl(config.tokenUrl,{method:"POST",headers,body,cache:"no-store",signal:AbortSignal.timeout(config.timeoutMs??30000),tls:{rejectUnauthorized:config.tlsVerify!==!1}})}catch(error3){return{ok:!1,error:`Token request failed \u2014 ${describeTransportError(error3)}`}}let text2=await response.text().catch(()=>""),json={};try{json=text2?JSON.parse(text2):{}}catch{}if(!response.ok||!json.access_token){let detail=json.error_description||json.error||text2.slice(0,200);return{ok:!1,error:`Could not obtain an OAuth2 token (HTTP ${response.status})${detail?`: ${detail}`:""}`}}return{ok:!0,token:{accessToken:json.access_token,expiresAt:now+(json.expires_in?json.expires_in*1000:DEFAULT_TTL_MS),refreshToken:json.refresh_token,refreshExpiresAt:json.refresh_token?now+(json.refresh_expires_in?json.refresh_expires_in*1000:DEFAULT_REFRESH_TTL_MS):void 0,fingerprint:credentialFingerprint(config)}}}async function getAccessToken(config,cache,deps={}){let fetchImpl=deps.fetchImpl??fetch,now=deps.now?.()??Date.now();if(!config.tokenUrl?.trim())return{ok:!1,error:"No token URL is configured for this source."};let fingerprint=credentialFingerprint(config),cached=cache.get(config.sourceId,fingerprint);if(cached&&isUsable(cached,now))return{ok:!0,accessToken:cached.accessToken,fromCache:!0};if(cached&&canRefresh(cached,now)){let refreshed=await requestToken(config,new URLSearchParams({grant_type:"refresh_token",refresh_token:cached.refreshToken}),now,fetchImpl);if(refreshed.ok)return cache.set(config.sourceId,refreshed.token),{ok:!0,accessToken:refreshed.token.accessToken,fromCache:!1}}let form=new URLSearchParams({grant_type:config.grantType});if(config.grantType==="password")form.set("username",config.username??""),form.set("password",config.password??"");let minted=await requestToken(config,form,now,fetchImpl);if(!minted.ok)return{ok:!1,error:minted.error};return cache.set(config.sourceId,minted.token),{ok:!0,accessToken:minted.token.accessToken,fromCache:!1}}import{and as and23,eq as eq37,inArray as inArray15}from"drizzle-orm";var DEFAULT_IGNORED=["updatedAt","updated_at","updatedBy","updated_by"];function planRevert(input){let ignored=new Set([...DEFAULT_IGNORED,...input.ignoreColumns??[]]),ops={deletes:[],restores:[],reinserts:[],conflicts:[]};for(let image of input.preImages)switch(image.action){case"create":{if(!image.rowId)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; deleting it would discard that edit."});break}ops.deletes.push(image.rowId);break}case"update":case"deactivate":{if(!image.rowId||!image.before)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; restoring it would discard that edit."});break}ops.restores.push({id:image.rowId,row:image.before});break}case"delete":{if(!image.before)break;if(image.rowId&&input.current.has(image.rowId)){ops.conflicts.push({id:image.rowId,reason:"A record with this identifier exists again; it was not replaced."});break}ops.reinserts.push(image.before);break}default:break}return ops}function changedSince(after,now,ignored){if(!after)return!1;for(let[key2,value2]of Object.entries(after)){if(ignored.has(key2))continue;if(!sameValue(value2,now[key2]))return!0}return!1}function sameValue(a,b){if(a===b)return!0;if(a==null&&b==null)return!0;if(a instanceof Date&&b instanceof Date)return a.getTime()===b.getTime();if(a instanceof Date||b instanceof Date){let da=a instanceof Date?a:new Date(String(a)),db=b instanceof Date?b:new Date(String(b));return!Number.isNaN(da.getTime())&&!Number.isNaN(db.getTime())?da.getTime()===db.getTime():!1}if(typeof a==="object"||typeof b==="object")try{return JSON.stringify(a)===JSON.stringify(b)}catch{return!1}return String(a)===String(b)}var CHUNK=500;async function applyRevert(deps,ops,meta){let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,conflicts:ops.conflicts.length,error:`"${meta.targetEntity}" has no id column; its rows cannot be addressed.`};let now=new Date;try{let work=async(tx)=>{let deleted=0,restored=0,reinserted=0;for(let i=0;i<ops.deletes.length;i+=CHUNK){let chunk=ops.deletes.slice(i,i+CHUNK),removed=await tx.delete(deps.drizzleTable).where(inArray15(idCol,chunk)).returning();deleted+=removed.length}for(let restore of ops.restores){let{id:_id,createdAt:_c,createdBy:_cb,...rest3}=restore.row,written=await tx.update(deps.drizzleTable).set({...rest3,updatedAt:now,updatedBy:meta.userId}).where(and23(eq37(idCol,restore.id))).returning();restored+=written.length}if(ops.reinserts.length>0)for(let i=0;i<ops.reinserts.length;i+=CHUNK){let chunk=ops.reinserts.slice(i,i+CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();reinserted+=written.length}return{deleted,restored,reinserted}};return{ok:!0,...meta.tx?await work(meta.tx):await deps.db.transaction(work),conflicts:ops.conflicts.length}}catch(error3){return deps.logger.error("[Integrations] Revert transaction failed",{targetEntity:meta.targetEntity,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,conflicts:ops.conflicts.length,error:"The database rejected this undo; it was rolled back and nothing changed."}}}function groupPreImagesByEntity(preImages){let byEntity=new Map;for(let image of preImages){let list2=byEntity.get(image.targetEntity);if(list2)list2.push(image);else byEntity.set(image.targetEntity,[image])}return[...byEntity.entries()].map(([targetEntity,images])=>({targetEntity,preImages:images}))}function touchedRowIds(preImages){let ids=new Set;for(let image of preImages)if(image.rowId)ids.add(image.rowId);return[...ids]}var TREE_PARENT_KEY="__treeParent";function flattenTree(records,childrenPath){let out=[],truncated=!1,visit=(node,parent,depth)=>{if(!node||typeof node!=="object")return;if(depth>64){truncated=!0;return}let source=node,children=source[childrenPath],{[childrenPath]:_nested,...own}=source;if(out.push({...own,["__depth"]:depth,["__treeParent"]:parent??null}),!Array.isArray(children))return;for(let child of children)visit(child,own,depth+1)};for(let root of records)visit(root,null,0);return{records:out,truncated}}function treeChildrenPath(value2){let trimmed=(value2??"").trim();return trimmed.length>0?trimmed:null}function getByPath(obj,path7){if(!path7)return;let cur=obj;for(let part of path7.split(".")){if(cur==null||typeof cur!=="object")return;cur=cur[part]}return cur}function readSourceValue(external,parent,path7){return readOne(external,parent,path7)}function readOne(external,parent,path7){return path7.startsWith("__parent.")?getByPath(parent,path7.slice(9)):getByPath(external,path7)}var TEMPLATE_TOKEN=/\{([^{}]+)\}/g;function isTemplateSource(source){return TEMPLATE_TOKEN.lastIndex=0,TEMPLATE_TOKEN.test(source)}function renderTemplate(template,external,parent){let treeParentAbsent=external!=null&&typeof external==="object"&&TREE_PARENT_KEY in external&&external[TREE_PARENT_KEY]==null,readsTreeParent=(text2)=>text2.includes(`{${TREE_PARENT_KEY}.`),readToken=(token)=>{let[path7="",transform3]=token.split("|"),value2=readOne(external,parent,path7.trim());if(transform3===void 0)return value2;let result=applyTransform(value2,transform3.trim());return result.ok?result.value:value2};for(let alternative of template.split("||")){let candidate=alternative.trim();if(candidate==="")continue;if(treeParentAbsent&&readsTreeParent(candidate))continue;let complete=!0,rendered=candidate.replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(complete&&rendered.trim()!=="")return rendered}let last=template.split("||").pop()??template;if(treeParentAbsent&&readsTreeParent(last))return"";return last.trim().replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);return value2==null?"":String(value2)})}function extractRecords(body,rootPath){if(rootPath){let at=getByPath(body,rootPath);if(Array.isArray(at))return at;return at&&typeof at==="object"?[at]:[]}let candidate=firstArrayLike(body)??deepFirstArrayOfObjects(body);return Array.isArray(candidate)?candidate:[]}var ENVELOPE_KEYS=["content","items","data","results","records","rows","list","value","responseObject"];function firstArrayLike(body){if(Array.isArray(body))return body;if(!body||typeof body!=="object")return;let b=body;for(let key2 of ENVELOPE_KEYS){let v=b[key2];if(Array.isArray(v))return v;if(v&&typeof v==="object"){let nested=v.items;if(Array.isArray(nested))return nested}}return}function deepFirstArrayOfObjects(body,depth=0){if(depth>5||body==null||typeof body!=="object"||body instanceof Date)return;if(Array.isArray(body))return body.length>0&&typeof body[0]==="object"&&body[0]!==null?body:void 0;let entries=Object.values(body);for(let v of entries)if(Array.isArray(v)&&v.length>0&&typeof v[0]==="object"&&v[0]!==null)return v;for(let v of entries)if(v&&typeof v==="object"&&!Array.isArray(v)){let found=deepFirstArrayOfObjects(v,depth+1);if(found)return found}for(let v of entries)if(Array.isArray(v))return v;return}var FOLD={\u{131}:"i",\u{130}:"I",\u{15f}:"s",\u{15e}:"S",\u{11f}:"g",\u{11e}:"G",\u{f8}:"o",\u{d8}:"O",\u{e6}:"ae",\u{c6}:"AE",\u{df}:"ss",\u{111}:"d",\u{110}:"D",\u{142}:"l",\u{141}:"L"};function foldToAscii(value2){return value2.replace(/[\u0131\u0130\u015F\u015E\u011F\u011E\u00F8\u00D8\u00E6\u00C6\u00DF\u0111\u0110\u0142\u0141]/g,(ch)=>FOLD[ch]??ch).normalize("NFD").replace(/[\u0300-\u036f]/g,"")}var TRUTHY=new Set(["true","1","yes","y","evet","e","on"]),FALSY=new Set(["false","0","no","n","hayir","hay\u0131r","h","off"]);function applyTransform(value2,transform3,locale){if(value2==null)return{ok:!0,value:value2};switch(transform3){case"trim":return{ok:!0,value:String(value2).trim()};case"upper":return{ok:!0,value:String(value2).trim().toLocaleUpperCase(locale)};case"lower":return{ok:!0,value:String(value2).trim().toLocaleLowerCase(locale)};case"toString":return{ok:!0,value:String(value2)};case"toNumber":{if(typeof value2==="boolean")return{ok:!1,reason:"not a number",raw:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let n=Number(s);return Number.isFinite(n)?{ok:!0,value:n}:{ok:!1,reason:"not a number",raw:value2}}case"toBoolean":{if(typeof value2==="boolean")return{ok:!0,value:value2};let s=String(value2).trim().toLocaleLowerCase("tr-TR");if(s==="")return{ok:!0,value:null};if(TRUTHY.has(s))return{ok:!0,value:!0};if(FALSY.has(s))return{ok:!0,value:!1};return{ok:!1,reason:"not a yes/no value",raw:value2}}case"emailSafe":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"")};case"slug":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/-{2,}/g,"-").replace(/^-+|-+$/g,"")};case"pathLeaf":{let parts=String(value2).split(/[/\\>\u203A\u00BB]|->/).map((part)=>part.trim()).filter((part)=>part!=="");return{ok:!0,value:parts.length>0?parts[parts.length-1]:""}}case"toList":{if(Array.isArray(value2))return{ok:!0,value:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:[]};return{ok:!0,value:s.split(",").map((part)=>part.trim()).filter((part)=>part!=="")}}case"dateOnly":{let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let leading=s.match(/^\d{4}-\d{2}-\d{2}/);if(leading)return{ok:!0,value:leading[0]};let d=new Date(s);return Number.isNaN(d.getTime())?{ok:!1,reason:"not a date",raw:value2}:{ok:!0,value:d.toISOString().slice(0,10)}}default:return{ok:!0,value:value2}}}function isEmpty(v){return v==null||typeof v==="string"&&v.trim()===""}function mapRecord(external,mappings,parent){let row={},problems=[];for(let fm of mappings){if(!fm.target)continue;let value2;if(fm.constant!=null&&fm.constant!=="")value2=fm.constant;else{let raw=isTemplateSource(fm.source)?renderTemplate(fm.source,external,parent):readOne(external,parent,fm.source),result=applyTransform(raw,fm.transform);if(!result.ok)problems.push(`${fm.source} \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null;else value2=result.value}if(isEmpty(value2)&&fm.fallback!=null&&fm.fallback!==""){let raw=isTemplateSource(fm.fallback)?renderTemplate(fm.fallback,external,parent):fm.fallback,result=applyTransform(raw,fm.transform);if(result.ok)value2=result.value;else problems.push(`fallback \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null}if(value2!==void 0)row[fm.target]=value2}return{row,problems}}function buildMappedRecords(externalRecords,mappings,dedupTargetField,parents){let records=[],issues=[];return externalRecords.forEach((ext,i)=>{let{row,problems}=mapRecord(ext,mappings,parents?.[i]);for(let message of problems)issues.push({sourceIndex:i,kind:"invalid_value",message});let dedupKey=dedupTargetField&&!isEmpty(row[dedupTargetField])?String(row[dedupTargetField]).trim():null;records.push({data:row,dedupKey,sourceIndex:i,external:ext,parent:parents?.[i]})}),{records,issues}}function flattenKeys(obj,prefix="",out=[],depth=0){if(out.length>200||depth>4||obj==null||typeof obj!=="object")return out;if(Array.isArray(obj)){if(prefix)out.push(prefix);return out}for(let[k,v]of Object.entries(obj)){let path7=prefix?`${prefix}.${k}`:k;if(v!=null&&typeof v==="object"&&!Array.isArray(v))flattenKeys(v,path7,out,depth+1);else out.push(path7)}return out}var MAX_FANOUT_COMBINATIONS=5000;function resolvePath2(rawPath,values){let missing=new Set,used=new Set;return{path:rawPath.replace(/\{([a-zA-Z_][\w-]*)\}|:([a-zA-Z_]\w*)/g,(_full,brace,colon)=>{let key2=brace??colon,v=values[key2];if(v==null||v==="")return missing.add(key2),brace?`{${key2}}`:`:${key2}`;return used.add(key2),encodeURIComponent(String(v))}),missing:[...missing],used}}function planFetchOrder(endpoints,roots){let byId=new Map(endpoints.map((e)=>[e.id,e])),order=[],settled=new Set,onPath=[],onPathSet=new Set,visit=(id,requiredBy)=>{if(settled.has(id))return null;if(onPathSet.has(id))return{ok:!1,reason:"cycle",chain:[...onPath.slice(onPath.indexOf(id)),id]};let node=byId.get(id);if(!node)return{ok:!1,reason:"unknown_endpoint",missing:id,requiredBy:requiredBy??id};onPath.push(id),onPathSet.add(id);for(let binding of node.paramBindings??[]){if(binding.from!=="endpoint")continue;let failure=visit(binding.endpointId,id);if(failure)return failure}return onPath.pop(),onPathSet.delete(id),settled.add(id),order.push(id),null};for(let id of roots??endpoints.map((e)=>e.id)){let failure=visit(id,null);if(failure)return failure}return{ok:!0,order}}function expandBindings(bindings,sources,limit=MAX_FANOUT_COMBINATIONS){if(!bindings||bindings.length===0)return{ok:!0,calls:[{values:{}}]};let axes=[];for(let binding of bindings){if(binding.from==="static"){axes.push({param:binding.param,options:[{value:binding.value}]});continue}if(binding.from==="endpoint"){let options=(sources.parents?.[binding.endpointId]??[]).map((record3)=>({value:getByPath(record3,binding.field),parent:record3})).filter((o)=>o.value!=null&&o.value!=="");axes.push({param:binding.param,options});continue}let values=sources.entityValues?.[`${binding.entity}.${binding.field}`]??[];axes.push({param:binding.param,options:values.filter((v)=>v!=null&&v!=="").map((value2)=>({value:value2}))})}if(axes.some((a)=>a.options.length===0))return{ok:!0,calls:[]};let combinations=axes.reduce((n,a)=>n*a.options.length,1);if(combinations>limit)return{ok:!1,reason:"too_many",combinations,limit};let calls=[{values:{}}];for(let axis of axes){let next=[];for(let call of calls)for(let option of axis.options)next.push({values:{...call.values,[axis.param]:option.value},parent:option.parent??call.parent});calls=next}return{ok:!0,calls}}function parentEndpointIds(bindings){let ids=new Set;for(let b of bindings??[])if(b.from==="endpoint")ids.add(b.endpointId);return[...ids]}function entityValueKeys(bindings){let keys=new Set;for(let b of bindings??[])if(b.from==="entity")keys.add(`${b.entity}.${b.field}`);return[...keys]}var MAX_PAGES=1000,DEFAULT_PAGE_SIZE=200,initialState2=()=>({pagesFetched:0,recordsFetched:0,cursor:null});function firstPageParams(profile){switch(profile.kind){case"page_number":{let params={[profile.pageParam]:String(profile.firstPage??0)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"offset":return{[profile.offsetParam]:"0",[profile.limitParam]:String(pageSize(profile))};case"cursor":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"link_header":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}default:return{}}}function reportedTotal(profile,body){let path7=profile.kind==="page_number"||profile.kind==="offset"?profile.totalPath:void 0;if(!path7)return null;let raw=getByPath(body,path7);if(typeof raw==="number"&&Number.isFinite(raw)&&raw>=0)return Math.floor(raw);if(typeof raw==="string"&&raw.trim()!==""){let n=Number(raw);if(Number.isFinite(n)&&n>=0)return Math.floor(n)}return null}function nextPage(profile,state,observed){if(profile.kind==="none")return{kind:"done",reason:"single request"};if(state.pagesFetched>=MAX_PAGES)return{kind:"failed",reason:`Paging stopped after ${MAX_PAGES} requests without reaching the end. The source may not be honouring the paging parameters; importing this would be a partial read.`};if(observed.recordCount===0)return{kind:"done",reason:"empty page"};switch(profile.kind){case"page_number":{if(isLastPage(profile.lastPagePath,observed.body))return{kind:"done",reason:"source reported the last page"};let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};let next=(profile.firstPage??0)+state.pagesFetched,params={[profile.pageParam]:String(next)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"offset":{let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};return{kind:"params",params:{[profile.offsetParam]:String(state.recordsFetched),[profile.limitParam]:String(pageSize(profile))}}}case"cursor":{let raw=getByPath(observed.body,profile.nextCursorPath),next=raw==null?"":String(raw).trim();if(next==="")return{kind:"done",reason:"no further cursor"};if(state.cursor!=null&&next===state.cursor)return{kind:"failed",reason:`The source returned the same cursor twice (${next}); paging would not advance.`};let params={[profile.cursorParam]:next};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"link_header":{let url=parseNextLink(observed.linkHeader);if(!url)return{kind:"done",reason:"no rel=next link"};return{kind:"url",url}}default:return{kind:"done",reason:"single request"}}}function pageSize(profile){let declared="pageSize"in profile?profile.pageSize:void 0;return declared&&declared>0?declared:DEFAULT_PAGE_SIZE}function isLastPage(path7,body){if(!path7)return!1;let raw=getByPath(body,path7);if(typeof raw==="boolean")return raw;if(typeof raw==="string")return raw.trim().toLowerCase()==="true";return!1}function parseNextLink(header){if(!header)return null;for(let part of splitLinks(header)){let match=part.match(/<([^>]*)>(.*)/);if(!match)continue;let url=(match[1]??"").trim(),attrs=match[2]??"";if(!url)continue;if(/;\s*rel\s*=\s*["']?\s*next\s*["']?(\s*;|\s*$)/i.test(attrs))return url}return null}function splitLinks(header){let parts=[],depth=0,current="";for(let ch of header){if(ch==="<")depth++;else if(ch===">")depth--;if(ch===","&&depth===0){parts.push(current),current="";continue}current+=ch}if(current.trim()!=="")parts.push(current);return parts}var DEFAULT_MAX_CONCURRENT=4,DEFAULT_MAX_RECORDS=50000;async function collectOne(source,endpoint,params,deps,counters){let profile=endpoint.pagination??{kind:"none"},maxRecords=deps.maxRecords??DEFAULT_MAX_RECORDS,values={...endpoint.queryParams??{},...params.values},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return{ok:!1,error:`This endpoint needs path parameter(s) ${resolved.missing.map((m)=>`{${m}}`).join(", ")} and nothing supplies them. Add a parameter binding, or a static value.`};let baseQuery={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;baseQuery[key2]=value2}let records=[],total=null,state=initialState2(),pageParams=firstPageParams(profile),absoluteUrl=null;for(;;){if(deps.isCancelled?.())return{ok:!1,error:"Cancelled."};let url;if(absoluteUrl)try{url=new URL(absoluteUrl)}catch{return{ok:!1,error:`The source returned an unusable next-page link: ${absoluteUrl}`}}else{let built=buildUrl(source.baseUrl,resolved.path,{...baseQuery,...pageParams});if(!built.ok)return{ok:!1,error:built.error};url=built.url}let headers={accept:"application/json"};if(deps.bearerToken)headers.Authorization=`Bearer ${deps.bearerToken}`;counters.calls++;let outcome=await fetchOnce({...source,token:deps.bearerToken??source.token},{method:endpoint.method,url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl:deps.fetchImpl});if(!outcome.ok)return{ok:!1,error:outcome.error??`HTTP ${outcome.status}`};let raw=extractRecords(outcome.body,endpoint.responseRootPath),childrenPath=treeChildrenPath(endpoint.treeChildrenPath),flattened=childrenPath?flattenTree(raw,childrenPath):null;if(flattened?.truncated)return{ok:!1,error:"This source answered with a structure that nests into itself. Nothing was imported \u2014 a company that contains itself has no order to write it in."};let page=flattened?flattened.records:raw;if(records.push(...page),counters.records+=page.length,total===null)total=reportedTotal(profile,outcome.body);if(counters.records>maxRecords)return{ok:!1,error:`This run would hold more than ${maxRecords} records at once. Narrow the source with a filter, or raise maxRecordsPerRun.`};deps.onProgress?.(counters.records),state={pagesFetched:state.pagesFetched+1,recordsFetched:records.length,cursor:pageParams[cursorParamOf(profile)??""]??state.cursor};let next=nextPage(profile,state,{recordCount:page.length,body:outcome.body,linkHeader:outcome.linkHeader});if(next.kind==="done")break;if(next.kind==="failed")return{ok:!1,error:next.reason};if(next.kind==="url"){absoluteUrl=next.url,pageParams={};continue}absoluteUrl=null,pageParams=next.params}return{ok:!0,records,total}}function cursorParamOf(profile){return profile.kind==="cursor"?profile.cursorParam:null}function describeCallFailure(call,error3){let params=call.values??{},named=Object.entries(params).map(([key2,value2])=>`${key2}=${String(value2)}`).join(", ");return named?`${named}: ${error3}`:error3}async function collectEndpoint(source,endpoint,sources,deps={}){let counters={calls:0,records:0},expansion=expandBindings(endpoint.paramBindings??void 0,sources);if(!expansion.ok)return{ok:!1,callCount:0,error:`This endpoint would be called ${expansion.combinations} times (the ceiling is ${expansion.limit}). Narrow the parent list, or remove one of the parameter bindings.`};if(expansion.calls.length===0)return{ok:!0,records:[],reportedTotal:null,callCount:0};let limit=Math.max(1,deps.maxConcurrent??DEFAULT_MAX_CONCURRENT),collected=[],total=null,failure=null,partial3=[],cursor=0,worker=async()=>{for(;;){if(failure||deps.isCancelled?.())return;let index=cursor++,call=expansion.calls[index];if(!call)return;let result=await collectOne(source,endpoint,call,deps,counters);if(!result.ok){if(expansion.calls.length>1){partial3.push(describeCallFailure(call,result.error));continue}failure??=result.error;return}for(let record3 of result.records)collected.push({record:record3,parent:call.parent});if(expansion.calls.length===1)total=result.total}};if(await Promise.all(Array.from({length:Math.min(limit,expansion.calls.length)},worker)),failure)return{ok:!1,error:failure,callCount:counters.calls};if(deps.isCancelled?.())return{ok:!1,error:"Cancelled.",callCount:counters.calls};if(partial3.length>0&&collected.length===0&&partial3.length===expansion.calls.length)return{ok:!1,error:`Every call to this endpoint failed. First: ${partial3[0]}`,callCount:counters.calls};return{ok:!0,records:collected,reportedTotal:total,callCount:counters.calls,...partial3.length>0?{partialFailures:partial3}:{}}}function isDestructive(writeMode,missingPolicy){return writeMode==="replace"||missingPolicy==="delete"||missingPolicy==="deactivate"}function destructiveGate(input){if(!isDestructive(input.writeMode,input.missingPolicy))return{allowed:!0};if(input.partialFailures>0&&!input.scopedRemoval)return{allowed:!1,kind:"incomplete_source",message:`${input.partialFailures} call(s) in this source never answered, so part of it was not read. This run removes records the source does not send, and those unread records would be removed as if the source had dropped them. Fix the failing call, or switch this mapping to leave missing records alone.`};if(input.fetched===0)return{allowed:!1,kind:"incomplete_source",message:"The source returned no records at all. This run removes what the source does not send, so it would empty the target table. A source that is genuinely empty and one that could "+"not be read look the same from here, so this will not proceed on its own \u2014 preview it, "+"and if the source really is empty, remove the rows deliberately."};if(input.reported!==null&&input.fetched<input.reported)return{allowed:!1,kind:"incomplete_source",message:`The source reports ${input.reported} records but only ${input.fetched} were read. This run deletes what the source does not send, so it will not proceed on a partial read. Check the paging settings for this endpoint.`};return{allowed:!0}}function checkPlanVolume(input){if(input.maxShare<=0)return{allowed:!0};if(input.removing===0||input.existing===0)return{allowed:!0};let share=input.removing/input.existing;if(share<=input.maxShare)return{allowed:!0};let asPercent=(value2)=>`${Math.round(value2*100)}%`;return{allowed:!1,kind:"incomplete_source",message:`This run would remove ${input.removing} of ${input.existing} rows (${asPercent(share)}), which is above the ${asPercent(input.maxShare)} this mapping allows unattended. `+"A source can return perfectly good records and still produce a removal this large \u2014 a "+"changed dedup column, a repointed endpoint, a filter added upstream. Preview the run; if the removal is right, apply it deliberately."}}function orphanLinkNote(input){let{made,unresolved}=input;if(unresolved<=0)return null;let total=made+unresolved,share=total>0?unresolved/total:1,column3=input.column?` (${input.column})`:"",consequence=`${unresolved} record${unresolved===1?"":"s"} could not find the parent to attach to${column3} \u2014 `+"they are drawn at the TOP of the tree, at the same level as the chief executive.";if(share>=0.2)return`${consequence} Next to the ${made} that did attach, that is a large share: either the source is not sending a parent for these people, or one of the matching fields is written differently in the two places. Look at the source before trusting the chart.`;return`${consequence} ${made} link${made===1?" was":"s were"} made.`}function looksLikeKeyDrift(input){if(input.existing<=0)return!1;if(input.creating<=0||input.unmatched<=0)return!1;return input.creating/input.existing>=0.1&&input.unmatched/input.existing>=0.1}function keyDriftWarning(input){if(!looksLikeKeyDrift(input))return null;return`This run will add ${input.creating} rows, and the source no longer sends ${input.unmatched} of the rows already here. Both being this large points at the matching values in the `+"source having changed \u2014 so these are not new records, they are the same records under "+"new names. Run it with \u201Cmissing rows: leave alone\u201D and both generations survive: the "+`table grows to ${input.existing+input.creating} rows, and where records point at each other (an organisation tree, for instance) the new rows cannot find their old parents and the structure breaks. Either switch the policy to delete/deactivate and clean up `+"once, or correct the matching column to the source\u2019s new value."}var referenceKey=(check)=>`${check.entity}.${check.entityColumn}`,pointsAtOwnTable=(check,targetEntity)=>check.entity===targetEntity;function referenceValuesOf(raw){if(Array.isArray(raw))return{values:raw.map((item)=>String(item??"").trim()).filter((item)=>item!==""),wasList:!0};if(raw===null||raw===void 0)return{values:[],wasList:!1};let single=String(raw).trim();return{values:single===""?[]:[single],wasList:!1}}var isEmptyReference=(raw)=>referenceValuesOf(raw).values.length===0;function resolveReference(raw,ids){let{values,wasList}=referenceValuesOf(raw),found=[],unmatched=[];for(let value2 of values){let id=ids?.[value2];if(id===void 0)unmatched.push(value2);else if(!found.includes(id))found.push(id)}return{ids:found,unmatched,wasList}}function resolvedColumnValue(resolution){return resolution.wasList?resolution.ids:resolution.ids[0]??null}function applyReferenceIds(row,references,ids,targetEntity){let next={...row},deferred=[];for(let check of references){if(!check.writeIdTo)continue;let raw=row[check.column];if(pointsAtOwnTable(check,targetEntity)){if(next[check.writeIdTo]=Array.isArray(raw)?[]:null,!isEmptyReference(raw))deferred.push({check,raw});continue}next[check.writeIdTo]=resolvedColumnValue(resolveReference(raw,ids[referenceKey(check)]))}return{row:next,deferred}}function unambiguousIds(rows){let seen=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;seen.set(key2,seen.has(key2)?null:String(row.id))}let ids={};for(let[key2,id]of seen)if(id!==null)ids[key2]=id;return ids}function ambiguousValues(rows){let counts=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;counts.set(key2,(counts.get(key2)??0)+1)}return[...counts.entries()].filter(([,n])=>n>1).map(([key2])=>key2)}var UNRESOLVED_TEMPLATE=/^\s*(\$\{[^}]*\}|\{\{[^}]*\}\})\s*$/,isEmpty2=(v)=>v==null||typeof v==="string"&&(v.trim()===""||UNRESOLVED_TEMPLATE.test(v));function displayValue(value2){if(value2!==null&&typeof value2==="object")try{return JSON.stringify(value2)}catch{return"(a value that cannot be shown)"}return String(value2)}function buildFallbackIdentifier(format2,data){let complete=!0,rendered=format2.replace(/\{([^{}]+)\}/g,(_match,path7)=>{let value2=data[path7.trim()];if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(!complete)return null;let cleaned=foldToAscii(rendered).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"");return cleaned===""?null:cleaned}function missingReferences(row,references,known){let broken=[];for(let check of references){let raw=row[check.column];if(isEmpty2(raw))continue;let value2=displayValue(raw).trim(),present=known[`${check.entity}.${check.entityColumn}`];if(!present)continue;if(!present.has(value2))broken.push({check,value:value2,raw})}return broken}async function loadReferenceValues(references,read2){let values={};for(let check of references){let key2=`${check.entity}.${check.entityColumn}`;if(values[key2])continue;let rows=await read2(check.entity,check.entityColumn);values[key2]=new Set(rows.filter((v)=>!isEmpty2(v)).map((v)=>String(v).trim()))}return values}async function loadReferenceIds(references,targetEntity,read2){let ids={},ambiguous={};for(let check of references){if(!check.writeIdTo)continue;if(pointsAtOwnTable(check,targetEntity))continue;let key2=referenceKey(check);if(ids[key2])continue;let pairs=await read2(check.entity,check.entityColumn);ids[key2]=unambiguousIds(pairs);let shared=ambiguousValues(pairs);if(shared.length>0)ambiguous[key2]=shared}return{ids,ambiguous}}function ambiguityWarnings(ambiguous){return Object.entries(ambiguous).map(([key2,values])=>{let shown=values.slice(0,5).join(", "),rest3=values.length>5?` and ${values.length-5} more`:"";return`${values.length} value(s) in ${key2} belong to more than one row \u2014 ${shown}${rest3}. Records pointing at them are left unlinked rather than linked to whichever row came first.`})}function planWrites(input){let{records,existing,dedupTargetField,writeMode,missingPolicy,missingColumn,missingValue,removalScope=null,originColumn,originValue,requiredFields=[],uniqueFields=[],createDefaults={},accountRule=null,existingAccounts={},references=[],referenceValues={},referenceIds={},targetEntity=""}=input,issues=[],warnings=[],creates=[],referenceInserts=[],accountInserts=[],accountJoinInserts=[],plannedAccounts=new Set,plannedRefs=new Set,updates=[],deletes=[],deactivates=[],departures=[],deferredLinks=[],dedupConfigured=Boolean(dedupTargetField),accountClaims=new Map,accountIdIsUnique=accountRule?uniqueFields.includes(accountRule.idColumn):!1,fillIdentifier=(data)=>{let format2=accountRule?.emailFormat?.trim();if(!accountRule||!format2)return data;if(!isEmpty2(data[accountRule.matchFrom]))return data;let built=buildFallbackIdentifier(format2,data);return built===null?data:{...data,[accountRule.matchFrom]:built}},withAccount=(record3,input2)=>{if(!accountRule)return input2;let data=fillIdentifier(input2),raw=data[accountRule.matchFrom];if(isEmpty2(raw))return issues.push({sourceIndex:record3.sourceIndex,kind:"account_unmatched",field:accountRule.matchFrom,message:`${accountRule.matchFrom} is empty, so this record gets no account \u2014 it is imported without one.`,dedupKey:record3.dedupKey,row:data}),data;let value2=String(raw).trim(),claimedBy=accountClaims.get(value2);if(claimedBy&&accountIdIsUnique)return issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field:accountRule.matchFrom,value:String(value2),message:`${accountRule.matchFrom} is \u201C${value2}\u201D, which another record in this import already uses \u2014 and ${accountRule.idColumn} allows one record per account. This one is left out.`,dedupKey:record3.dedupKey,row:data,keptRow:claimedBy.data}),null;accountClaims.set(value2,record3);let existingId=existingAccounts[value2];if(existingId)return{...data,[accountRule.idColumn]:existingId};if(!plannedAccounts.has(value2)){plannedAccounts.add(value2);let accountData={[accountRule.matchColumn]:value2};for(let pair of accountRule.values??[]){let from=data[pair.from];if(!isEmpty2(from))accountData[pair.column]=from}accountInserts.push({entity:accountRule.entity,matchColumn:accountRule.matchColumn,matchValue:value2,data:accountData});for(let join7 of accountRule.joins??[])accountJoinInserts.push({entity:join7.entity,accountColumn:join7.accountColumn,values:join7.values,matchValue:value2})}return data},hasDefaults=Object.keys(createDefaults).length>0,stamp2=originColumn?{[originColumn]:originValue}:{},newRecord=(data)=>hasDefaults?{...createDefaults,...data,...stamp2}:{...data,...stamp2},existingByKey=new Map;if(dedupTargetField)for(let row of existing){let value2=row.row[dedupTargetField];if(!isEmpty2(value2))existingByKey.set(String(value2).trim(),row)}let claimedUnique=new Map;for(let field of uniqueFields){let taken=new Map;for(let existingRow of existing){let value2=existingRow.row[field];if(!isEmpty2(value2))taken.set(String(value2).trim(),existingRow.id)}claimedUnique.set(field,taken)}let ownsRow=(row)=>{if(!originColumn)return!0;let value2=row.row[originColumn];return String(value2??"")===String(originValue??"")},matchedIds=new Set,seenIds=new Set,seenInBatch=new Map;for(let sourceRecord of records){let broken=missingReferences(sourceRecord.data,references,referenceValues),resolvedRow=applyReferenceIds(sourceRecord.data,references,referenceIds,targetEntity),record3={...sourceRecord,data:fillIdentifier(resolvedRow.row)};if(record3.dedupKey!=null){let carried=existingByKey.get(record3.dedupKey);if(carried)seenIds.add(carried.id)}for(let link of resolvedRow.deferred){if(!dedupTargetField)continue;let matchValue=record3.data[dedupTargetField];if(isEmpty2(matchValue))continue;deferredLinks.push({matchColumn:dedupTargetField,matchValue:String(matchValue).trim(),writeIdTo:link.check.writeIdTo,lookupColumn:link.check.entityColumn,raw:link.raw,isList:Array.isArray(link.raw)})}let blocking=broken.find((b)=>b.check.onMissing==="skipRecord");if(blocking){let{check,value:value2}=blocking;issues.push({sourceIndex:record3.sourceIndex,kind:"missing_reference",message:typeof blocking.raw==="object"&&blocking.raw!==null?`${check.column} is not a single value but a whole object \u2014 ${value2}. Point the mapping at one field of it, e.g. \`${check.column}.code\`, and it will have something to match against ${check.entity}.${check.entityColumn}.`:`${check.column} is \u201C${value2}\u201D, which does not exist in ${check.entity}.${check.entityColumn} \u2014 this record is left out.`,dedupKey:record3.dedupKey,row:record3.data,reference:{column:check.column,value:value2,entity:check.entity,entityColumn:check.entityColumn}});continue}let keepReferences=()=>{for(let{check,value:value2}of broken){if(check.onMissing!=="create")continue;let token=`${check.entity}.${check.entityColumn}::${value2}`;if(plannedRefs.has(token))continue;plannedRefs.add(token);let data={};for(let pair of check.createValues??[]){let fromSource=isTemplateSource(pair.from)?renderTemplate(pair.from,record3.external,record3.parent):readSourceValue(record3.external,record3.parent,pair.from),value3=isEmpty2(fromSource)?record3.data[pair.from]:fromSource;if(!isEmpty2(value3))data[pair.column]=value3}referenceInserts.push({entity:check.entity,column:check.entityColumn,value:value2,...Object.keys(data).length>0?{data}:{}})}},uniqueCollision=(data,ownRowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;let value2=String(raw).trim(),holder3=claimedUnique.get(field)?.get(value2);if(holder3===void 0)continue;if(holder3!==null&&holder3===ownRowId)continue;return{field,value:value2}}return null},claimUnique=(data,rowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;claimedUnique.get(field)?.set(String(raw).trim(),rowId)}},collide=(field,value2)=>{issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field,value:String(value2),message:`${field} is \u201C${value2}\u201D, which something else already has \u2014 ${field} has to be unique, so this record is left out.`,dedupKey:record3.dedupKey,row:record3.data})},missingRequired=requiredFields.filter((f)=>isEmpty2(record3.data[f])&&isEmpty2(createDefaults[f]));if(missingRequired.length>0){issues.push({sourceIndex:record3.sourceIndex,kind:"missing_required",field:missingRequired.join(", "),message:`Required field(s) empty: ${missingRequired.join(", ")}`,dedupKey:record3.dedupKey,row:record3.data});continue}if(!dedupConfigured){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}if(record3.dedupKey==null){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}issues.push({sourceIndex:record3.sourceIndex,kind:"missing_dedup_key",message:"Deduplication field is empty on this record \u2014 it will be added as new."}),keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let claimedBy=seenInBatch.get(record3.dedupKey);if(claimedBy){issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_in_batch",value:String(record3.dedupKey??""),message:`The source carries this key more than once: ${record3.dedupKey} \u2014 this occurrence is skipped.`,dedupKey:record3.dedupKey,row:record3.data,keptRow:claimedBy});continue}if(seenInBatch.set(record3.dedupKey,record3.data),writeMode==="replace"||writeMode==="append"){let clash2=uniqueCollision(record3.data,null);if(clash2&&!(writeMode==="replace"&&claimedUnique.get(clash2.field)?.get(clash2.value))){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let match=existingByKey.get(record3.dedupKey),clash=uniqueCollision(record3.data,match?.id??null);if(clash){collide(clash.field,clash.value);continue}if(keepReferences(),claimUnique(record3.data,match?.id??null),match)matchedIds.add(match.id),updates.push({id:match.id,data:{...record3.data,...stamp2},before:match.row,sourceIndex:record3.sourceIndex});else{let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex})}}if(writeMode==="replace")deletes.push(...existing);else if(writeMode==="upsert"&&missingPolicy!=="ignore"){let wasRead=(row)=>{if(!removalScope)return!0;let value2=row.row[removalScope.column];if(isEmpty2(value2))return!1;return removalScope.readValues.includes(String(value2).trim())},gone=existing.filter((row)=>!seenIds.has(row.id)).filter((row)=>ownsRow(row)).filter(wasRead);if(missingPolicy==="delete")deletes.push(...gone);else deactivates.push(...gone);departures.push(...gone)}if(writeMode==="upsert"&&missingPolicy==="ignore"){let owned=existing.filter((row)=>ownsRow(row)),unmatched=owned.filter((row)=>!seenIds.has(row.id)).length,drift=keyDriftWarning({creating:creates.length,unmatched,existing:owned.length});if(drift)warnings.push(drift)}if(!dedupConfigured&&writeMode==="upsert")warnings.push("No deduplication field is set. Nothing can be matched against what is already here, so every record is added as new and each run will duplicate the last.");if(dedupConfigured&&records.length>0&&records.every((r)=>r.dedupKey==null))warnings.push(`The deduplication field is empty on every record \u2014 it is probably not among the mapped fields. As it stands nothing can ever match: all ${records.length} records will be re-added on every run.`);if(writeMode==="append"&&dedupConfigured)warnings.push("Append mode ignores the deduplication field: records already here will be added again.");if(writeMode==="replace"){if(warnings.push(`Replace mode: all ${existing.length} rows currently in the table are deleted and rebuilt from the source. Row identifiers change, so anything referring to them by id breaks.`),dedupConfigured)warnings.push('A deduplication field is set, so "update existing" would keep the current rows and their identifiers. Replace mode is only necessary when records cannot be matched at all.')}if(deactivates.length>0&&(!missingColumn||isEmpty2(missingValue)))warnings.push('The policy for records missing from the source is "deactivate", but no column and value are configured \u2014 those rows will be left untouched.'),deactivates.length=0;return{creates,updates,deletes,deactivates,departures,deferredLinks,issues,warnings,referenceInserts,accountInserts,accountJoinInserts}}var SKIPPING_ISSUE_KINDS=new Set(["missing_required","duplicate_in_batch","duplicate_value","invalid_value","missing_reference"]);function skippedRecordCount(issues){let records=new Set;for(let issue of issues){if(!SKIPPING_ISSUE_KINDS.has(issue.kind))continue;if(issue.sourceIndex<0)continue;records.add(issue.sourceIndex)}return records.size}function summarize(ops,meta){let sampleSize=meta.sampleSize??8,sample=[...ops.creates.map((c)=>c.data),...ops.updates.map((u)=>u.data)].slice(0,sampleSize);return{targetEntity:meta.targetEntity,writeMode:meta.writeMode,totalFetched:meta.totalFetched,reportedTotal:meta.reportedTotal,toCreate:ops.creates.length,toUpdate:ops.updates.length,toSkip:skippedRecordCount(ops.issues),missing:ops.deletes.length+ops.deactivates.length,missingPolicy:meta.missingPolicy,existingCount:meta.existingCount,dedupConfigured:meta.dedupConfigured,issues:ops.issues,warnings:ops.warnings,referenceInserts:ops.referenceInserts,accountsToCreate:ops.accountInserts.length,sample}}function removalScopeFor(column3,records){if(!column3)return null;let readValues=new Set;for(let record3 of records){let value2=record3.data[column3];if(!isEmpty2(value2))readValues.add(String(value2).trim())}return{column:column3,readValues:[...readValues]}}init_AccountLink();import{and as and24,eq as eq38,inArray as inArray16}from"drizzle-orm";var INSERT_CHUNK=500,DELETE_CHUNK=1000;function validateAll(ops,columns,validatePayload2){let issues=[];for(let op of ops.creates){let result=validatePayload2(op.data,columns,!1);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}for(let op of ops.updates){let result=validatePayload2(op.data,columns,!0);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}return issues}function referenceRow(columns,column3,value2,extra){let row={...extra,[column3]:value2},unfillable=[];for(let col8 of columns){let name2=camel(col8.name);if(name2===column3)continue;if(SYSTEM_COLUMNS.has(name2))continue;if(row[name2]!==void 0)continue;if(!(col8.notNull===!0&&col8.default===void 0&&!col8.defaultRaw&&!col8.nullable))continue;if(TEXTUAL_TYPES.has(String(col8.type)))row[name2]=value2;else unfillable.push(name2)}return unfillable.length>0?{ok:!1,unfillable}:{ok:!0,row}}var SYSTEM_COLUMNS=new Set(["id","createdAt","updatedAt","createdBy","updatedBy"]),TEXTUAL_TYPES=new Set(["text","varchar","char"]),camel=(s)=>s.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase());function linkAccount(data,rule,idByValue){let value2=data[rule.matchFrom];if(value2==null)return{};let id=idByValue.get(String(value2).trim());return id?{[rule.idColumn]:id}:{}}function groupDeferred(links){let groups=new Map;for(let link of links){let key2=`${link.writeIdTo}|${link.lookupColumn}|${link.matchColumn}`,group=groups.get(key2)??{writeIdTo:link.writeIdTo,lookupColumn:link.lookupColumn,matchColumn:link.matchColumn,links:[]};group.links.push(link),groups.set(key2,group)}return[...groups.values()]}async function applyWrites(deps,input){let{ops,targetEntity,userId}=input,scope=input.scopeConditions??[],writeIssues=[],cancelled=()=>input.isCancelled?.()===!0,invalid=validateAll(ops,deps.columns,deps.validatePayload);if(invalid.length>0)return{ok:!1,failure:{kind:"validation_failed",message:`${invalid.length} record(s) did not pass validation; nothing was written.`,issues:invalid}};let refGroups=new Map;for(let insert of ops.referenceInserts){let resolved=deps.resolveEntity?.(insert.entity);if(!resolved)return{ok:!1,failure:{kind:"write_failed",message:`This mapping would add \u201C${insert.value}\u201D to "${insert.entity}", which does not exist.`}};let built=referenceRow(resolved.columns,insert.column,insert.value,insert.data);if(!built.ok)return{ok:!1,failure:{kind:"write_failed",message:`\u201C${insert.value}\u201D cannot be added to "${insert.entity}" automatically: ${built.unfillable.join(", ")} is required and cannot be filled from a ${insert.column}. Add the missing ${insert.entity} by hand, or set this reference to leave those records out.`}};let group=refGroups.get(insert.entity)??{table:resolved.table,rows:[]};group.rows.push(built.row),refGroups.set(insert.entity,group)}let accountRule=input.account??null,accountEntity=ops.accountInserts[0]?.entity,accountTable=accountEntity?deps.resolveEntity?.(accountEntity):null;if(ops.accountInserts.length>0&&(!accountRule||!accountTable))return{ok:!1,failure:{kind:"write_failed",message:accountRule?`This import creates accounts in "${accountEntity}", which does not exist.`:"This import creates accounts but no password was supplied, so nothing was written."}};if(cancelled())return{ok:!1,failure:{kind:"cancelled",message:"Cancelled before writing."}};let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,failure:{kind:"write_failed",message:`Target "${targetEntity}" has no id column; the engine cannot address its rows.`}};let preImages=[],now=new Date,deactivating=ops.deactivates.length>0&&input.missingColumn&&input.missingValue!=null?{column:input.missingColumn,value:input.missingValue}:null;try{let linksMade=0,linksUnresolved=0;return{ok:!0,...await deps.db.transaction(async(tx)=>{let created=0,accountsCreated=0,referencesCreated=0,updated=0,deleted=0,deactivated=0,accountsClosed=0;if(ops.deletes.length>0){let ids=ops.deletes.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and24(inArray16(idCol,chunk),...scope):inArray16(idCol,chunk),removed=await tx.delete(deps.drizzleTable).where(where).returning();deleted+=removed.length;for(let row of removed)preImages.push({targetEntity,rowId:String(row.id),action:"delete",before:row,after:null})}}for(let op of ops.updates){if(cancelled())throw new CancelledError;let where=scope.length?and24(eq38(idCol,op.id),...scope):eq38(idCol,op.id),written=await tx.update(deps.drizzleTable).set({...op.data,updatedAt:now,updatedBy:userId}).where(where).returning();if(written.length===0)throw new ScopeError(op.id);updated+=written.length,preImages.push({targetEntity,rowId:op.id,action:"update",before:op.before,after:written[0]??null})}if(deactivating){let ids=ops.deactivates.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and24(inArray16(idCol,chunk),...scope):inArray16(idCol,chunk),written=await tx.update(deps.drizzleTable).set({[deactivating.column]:deactivating.value,updatedAt:now,updatedBy:userId}).where(where).returning();deactivated+=written.length;let beforeById=new Map(ops.deactivates.map((r)=>[r.id,r.row]));for(let row of written){let id=String(row.id);preImages.push({targetEntity,rowId:id,action:"deactivate",before:beforeById.get(id)??null,after:row})}}}if(deps.accountClosure){let written=new Set(preImages.filter((image)=>image.action==="delete"||image.action==="deactivate").map((image)=>image.rowId)),removedRows=ops.departures.filter((row)=>written.has(row.id)).map((row)=>row.row),leaverIds=accountIdsIn(removedRows,deps.accountClosure.userColumn);if(leaverIds.length>0){let closed=await closeAccounts({db:tx,usersTable:deps.accountClosure.usersTable,sessionsTable:deps.accountClosure.sessionsTable,atomic:!0,onError:(error3)=>{deps.logger.error("[Integrations] A departure\u2019s account stayed open",{error:error3})}},leaverIds);accountsClosed=closed.closed;for(let userId2 of closed.closedIds)preImages.push({targetEntity:deps.accountClosure.accountEntity,rowId:userId2,action:"update",before:{isActive:!0},after:{isActive:!1}});if(closed.closed>0&&!closed.signedOut)writeIssues.push({sourceIndex:-1,kind:"account_sessions_not_cleared",value:String(closed.closed),message:`${closed.closed} account(s) behind removed records were deactivated, but their open sessions could not be cleared \u2014 those people stay signed in until the session expires.`})}}for(let[entity,group]of refGroups){let rows=group.rows.map((r)=>({...r,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(group.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();referencesCreated+=written.length;for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}let accountIdByValue=new Map;if(accountRule&&accountTable&&ops.accountInserts.length>0){let rows=ops.accountInserts.map((account)=>({...account.data,[accountRule.passwordColumn]:accountRule.passwordHash,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(accountTable.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();accountsCreated+=written.length;for(let row of written){let value2=row[accountRule.matchColumn];if(row.id!=null&&value2!=null)accountIdByValue.set(String(value2).trim(),String(row.id));preImages.push({targetEntity:ops.accountInserts[0]?.entity??"",rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(accountRule&&ops.accountJoinInserts.length>0){let byEntity=new Map;for(let join7 of ops.accountJoinInserts){let accountId=accountIdByValue.get(join7.matchValue);if(!accountId){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`No account was found for \u201C${join7.matchValue}\u201D, so its ${join7.entity} row was not written \u2014 that person can sign in and do nothing.`});continue}let rows=byEntity.get(join7.entity)??[];rows.push({...join7.values,[join7.accountColumn]:accountId,createdAt:now,updatedAt:now,createdBy:userId}),byEntity.set(join7.entity,rows)}for(let[entity,rows]of byEntity){let resolved=deps.resolveEntity?.(entity);if(!resolved){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`The \u201C${entity}\u201D table is not available here, so ${rows.length} role membership(s) were not written. The accounts exist but hold no role.`});continue}for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(resolved.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(ops.creates.length>0){let rows=ops.creates.map((c)=>({...c.data,...accountRule&&c.data[accountRule.idColumn]==null?linkAccount(c.data,accountRule,accountIdByValue):{},createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let chunk=rows.slice(i,i+INSERT_CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();created+=written.length;for(let row of written)preImages.push({targetEntity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}if(ops.deferredLinks.length>0)for(let group of groupDeferred(ops.deferredLinks)){if(cancelled())throw new CancelledError;let lookupCol=deps.resolveCol(group.lookupColumn),matchCol=deps.resolveCol(group.matchColumn),targetCol=deps.resolveCol(group.writeIdTo);if(!lookupCol||!matchCol||!targetCol){deps.logger.error(`[Integrations] Cannot fill "${group.writeIdTo}": ${[!lookupCol?group.lookupColumn:null,!matchCol?group.matchColumn:null,!targetCol?group.writeIdTo:null].filter(Boolean).join(", ")} is not a column of "${targetEntity}".`);continue}let rows=await tx.select({v:lookupCol,id:idCol}).from(deps.drizzleTable),idByValue={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!idByValue[key2])idByValue[key2]=String(row.id)}let imageByMatch=new Map;for(let image of preImages){let value2=image.after?.[group.matchColumn];if(value2!=null)imageByMatch.set(String(value2).trim(),image)}for(let link of group.links){let resolution=resolveReference(link.raw,idByValue);if(resolution.ids.length===0){linksUnresolved+=1;continue}let value2=link.isList?resolution.ids:resolution.ids[0],where=scope.length?and24(eq38(matchCol,link.matchValue),...scope):eq38(matchCol,link.matchValue);if((await tx.update(deps.drizzleTable).set({[group.writeIdTo]:value2}).where(where).returning()).length===0){linksUnresolved+=1;continue}linksMade+=1;let image=imageByMatch.get(String(link.matchValue).trim());if(image?.after)image.after={...image.after,[group.writeIdTo]:value2}}}return{created,accountsCreated,referencesCreated,updated,deleted,deactivated,accountsClosed,linksMade,linksUnresolved}}),preImages,issues:writeIssues}}catch(error3){if(error3 instanceof CancelledError)return{ok:!1,failure:{kind:"cancelled",message:"Cancelled while writing; the transaction was rolled back and nothing changed."}};if(error3 instanceof ScopeError)return{ok:!1,failure:{kind:"write_failed",message:`Row ${error3.rowId} is outside what this account may write. Nothing was written.`}};return deps.logger.error(`[Integrations] Write transaction failed for "${targetEntity}": ${reasonOf2(error3)}`),{ok:!1,failure:{kind:"write_failed",message:"The database rejected this import; it was rolled back and nothing changed."}}}}function reasonOf2(error3){if(!(error3 instanceof Error))return String(error3);let extra=error3;return[error3.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.constraint?`constraint: ${String(extra.constraint)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}class CancelledError extends Error{constructor(){super("cancelled");this.name="CancelledError"}}class ScopeError extends Error{rowId;constructor(rowId){super(`row ${rowId} outside scope`);this.rowId=rowId;this.name="ScopeError"}}var DAY_MS=86400000;async function executeRun(context,deps,lock){let{mapping,source}=context,empty={runId:null,status:"failed",failure:null,plan:null,created:0,accountsCreated:0,referencesCreated:0,updated:0,deleted:0,deactivated:0,externalCalls:0,issues:[]},opened=await deps.repo.openRun({mappingId:mapping.id,targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,trigger:context.trigger,userId:context.userId});if(!opened.ok)return{...empty,failure:{kind:"write_failed",message:`Could not open a run record: ${opened.error}`}};let runId=opened.runId;deps.onRunOpened?.(runId);let cancelChecked=0,cancelSeen=!1,isCancelled=()=>{if(cancelSeen)return!0;if(deps.abortSignal?.aborted)return cancelSeen=!0,!0;if(!lock.isHeld())return cancelSeen=!0,!0;return!1},refreshCancelFlag=async()=>{if(cancelChecked++,await deps.repo.isCancelRequested(runId))cancelSeen=!0},progress=(p)=>deps.publishProgress?.({runId,...p}),preImagesStored=!0,finish=async(outcome)=>{let revertible=outcome.status==="succeeded"&&preImagesStored;return await deps.repo.closeRun(runId,{status:outcome.status,totalFetched:outcome.plan?.totalFetched??0,sourceReportedTotal:outcome.plan?.reportedTotal??null,createdCount:outcome.created,accountsCreatedCount:outcome.accountsCreated,referencesCreatedCount:outcome.referencesCreated,updatedCount:outcome.updated,skippedCount:outcome.plan?.toSkip??0,deletedCount:outcome.deleted,deactivatedCount:outcome.deactivated,errorCount:outcome.failure?1:0,externalCallCount:outcome.externalCalls,issues:outcome.issues,errors:outcome.failure?[outcome.failure.message]:[],finishedAt:new Date,preImagesExpireAt:revertible?new Date(Date.now()+(deps.retainPreImagesMs??30*DAY_MS)):null}),progress({phase:"done",message:outcome.failure?.message}),{runId,...outcome}};progress({phase:"fetching"});let nodes=context.endpoints.map((e)=>({id:e.id,paramBindings:e.paramBindings??void 0})),order=planFetchOrder(nodes,[context.rootEndpointId]);if(!order.ok){let failure=order.reason==="cycle"?{kind:"cycle_detected",message:`These endpoints depend on each other in a loop (${order.chain.join(" \u2192 ")}), so there is no correct place to start.`,chain:order.chain}:{kind:"fetch_failed",message:`"${order.requiredBy}" takes a parameter from an endpoint that no longer exists (${order.missing}).`};return finish({...empty,failure,status:"failed"})}let bearerToken=null;if(context.oauth){let token=await getAccessToken(context.oauth,deps.tokenCache,{fetchImpl:deps.fetchImpl});if(!token.ok)return finish({...empty,failure:{kind:"fetch_failed",message:token.error}});bearerToken=token.accessToken}let byId=new Map(context.endpoints.map((e)=>[e.id,e])),parents={},entityValues={},externalCalls=0,rootRecords=[],fetchWarnings=[],reportedTotal2=null;for(let endpointId of order.order){let endpoint=byId.get(endpointId);if(!endpoint)continue;if(await refreshCancelFlag(),isCancelled())return finish({...empty,status:"cancelled",externalCalls,failure:{kind:"cancelled",message:"Cancelled before anything was written."}});for(let key2 of entityValueKeys(endpoint.paramBindings??void 0)){if(entityValues[key2])continue;let[entity,field]=key2.split(".");entityValues[key2]=await deps.repo.readEntityColumn(entity,field)}let collected=await collectEndpoint(source,endpoint,{parents,entityValues},{fetchImpl:deps.fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrentFanout,maxRecords:deps.maxRecordsPerRun,isCancelled,onProgress:(n)=>progress({phase:"fetching",processed:n})});if(externalCalls+=collected.callCount,!collected.ok){let cancelled=isCancelled();return finish({...empty,externalCalls,status:cancelled?"cancelled":"failed",failure:cancelled?{kind:"cancelled",message:"Cancelled before anything was written."}:{kind:"fetch_failed",message:collected.error}})}if(collected.partialFailures?.length)fetchWarnings.push(...collected.partialFailures.map((failure)=>`Could not read part of this source \u2014 ${failure}`));if(parents[endpointId]=collected.records.map((r)=>r.record),endpointId===context.rootEndpointId)rootRecords=collected.records,reportedTotal2=collected.reportedTotal}for(let id of Object.keys(parents))if(!(id===context.rootEndpointId||context.endpoints.some((e)=>parentEndpointIds(e.paramBindings??void 0).includes(id))))delete parents[id];let verdict=destructiveGate({writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,fetched:rootRecords.length,reported:reportedTotal2,partialFailures:fetchWarnings.length,scopedRemoval:Boolean(mapping.removalScopeColumn)});if(!verdict.allowed)return finish({...empty,externalCalls,failure:{kind:verdict.kind,message:fetchWarnings.length?`${verdict.message}
 
 ${fetchWarnings.join(`