nucleus-core-ts 0.10.151 → 0.10.153

package/dist/index.js

@@ -26,7 +26,7 @@ and limitations under the License.
 `):lines;for(let line of redacted.slice(context.length))this.addRaw(line,source);let carried=[...new Set(open)];context=carried.reduce((sum,line)=>sum+line.length+1,0)<limit/2?carried:[],run=[],runLength=context.reduce((sum,line)=>sum+line.length+1,0)};for(let line of stripAnsi(text).split(`
 `)){if(line.length>limit){flush(),this.addRaw(line,source);continue}if(run.length>0&&runLength+line.length+1>limit)flush();if(runLength+line.length+1>limit)context=[],runLength=0;run.push(line),runLength+=line.length+1,trackOpenLists(open,line)}flush()}matches(record,query,needle){if(query.levels&&query.levels.length>0&&!query.levels.includes(record.level))return!1;if(query.minLevel&&LOG_LEVEL_PRIORITY[record.level]<LOG_LEVEL_PRIORITY[query.minLevel])return!1;if(query.source&&record.source!==query.source)return!1;if(query.scope){let scope=record.scope??"";if(scope!==query.scope&&!scope.startsWith(`${query.scope}.`))return!1}if(needle){if(!fold([record.message,record.scope??"",record.service??"",record.error?.name??"",record.error?.message??"",record.correlationId??""].join(" ")).includes(needle))return!1}return!0}query(query={}){let limit=Math.min(Math.max(1,query.limit??200),1000),needle=query.search?.trim()?fold(query.search.trim()):null,filtered=this.records.filter((record)=>this.matches(record,query,needle)),window2,hasMore;if(query.after!==void 0){let fresh=filtered.filter((record)=>record.seq>query.after);hasMore=fresh.length>limit,window2=fresh.slice(0,limit)}else{let older=query.before!==void 0?filtered.filter((record)=>record.seq<query.before):filtered;hasMore=older.length>limit,window2=older.slice(Math.max(0,older.length-limit)).reverse()}return{records:window2,matched:filtered.length,buffered:this.records.length,capacity:this.capacity,evicted:this.evicted,latestSeq:this.seq,oldestSeq:this.records[0]?.seq??0,hasMore}}scopes(){let seen=new Set;for(let record of this.records)if(record.scope)seen.add(record.scope);return[...seen].sort()}levelCounts(){let counts={debug:0,info:0,warn:0,error:0,fatal:0};for(let record of this.records)counts[record.level]+=1;return counts}clear(){this.records=[]}subscribe(subscriber){return this.subscribers.add(subscriber),()=>{this.subscribers.delete(subscriber)}}subscriberCount(){return this.subscribers.size}}function getServerLogBuffer(options){if(!sharedBuffer)sharedBuffer=new ServerLogBuffer(options);else if(options?.capacity)sharedBuffer.setCapacity(options.capacity);return sharedBuffer}function attachStreamCapture(buffer){if(detachCapture)return detachCapture;let wire=(stream,source)=>{let original=stream.write.bind(stream),patched=(chunk,encoding,callback)=>{if(!isLoggerEmitting())try{let text=typeof chunk==="string"?chunk:chunk instanceof Uint8Array?new TextDecoder().decode(chunk):"";buffer.addRawChunk(text,source)}catch{}return original(chunk,encoding,callback)};return stream.write=patched,()=>{stream.write=original}},restoreOut=wire(process.stdout,"stdout"),restoreErr=wire(process.stderr,"stderr");return detachCapture=()=>{restoreOut(),restoreErr(),detachCapture=null},detachCapture}var DEFAULT_CAPACITY=2000,DEFAULT_MAX_LINE=8000,RAW_REDACT_WINDOW=57344,MAX_CARRIED_OPENERS=16,ANSI_PATTERN,loggerEmitDepth=0,sharedBuffer=null,detachCapture=null;var init_ServerLogBuffer=__esm(()=>{init_markers();init_redactSecrets();init_types();ANSI_PATTERN=/\x1B\[[0-9;]*[A-Za-z]/g});function redactSensitiveData(obj,redactKeys=DEFAULT_REDACT_KEYS,seen=new WeakSet){return redactWalk(obj,redactKeys,seen,!1)}function redactLogContext(obj,redactKeys=DEFAULT_REDACT_KEYS){return redactWalk(obj,redactKeys,new WeakSet,!0)}function redactErrorInfo(info,redactKeys=DEFAULT_REDACT_KEYS){let options={extraNames:redactKeys},out={...info,message:redactSecretsInText(info.message,options)};if(info.stack!==void 0)out.stack=redactSecretsInText(info.stack,options);if(info.cause)out.cause=redactErrorInfo(info.cause,redactKeys);return out}function redactWalk(obj,redactKeys,seen,scrubText){if(obj===null||obj===void 0)return obj;if(scrubText&&typeof obj==="string")return redactSecretsInText(obj,{extraNames:redactKeys});if(obj instanceof Error){let code=obj.code;return redactWalk({name:obj.name,message:obj.message,stack:obj.stack,...code!==void 0?{code}:{}},redactKeys,seen,scrubText)}if(typeof obj==="bigint")return obj.toString();if(typeof obj!=="object")return obj;if(scrubText){let options={extraNames:redactKeys};if(obj instanceof URL)return redactUrl(obj.href,options);if(obj instanceof URLSearchParams)return redactQueryString(obj.toString(),options);if(obj instanceof Headers)return redactHeaders(obj,options)}if(seen.has(obj))return"[Circular]";if(seen.add(obj),Array.isArray(obj))return obj.map((item)=>redactWalk(item,redactKeys,seen,scrubText));let proto=Object.getPrototypeOf(obj);if(proto!==Object.prototype&&proto!==null)return typeof obj.toISOString==="function"?obj.toISOString():obj;let result={};for(let[key,value]of Object.entries(obj))if(redactKeys.some((redactKey)=>key.toLowerCase().includes(redactKey.toLowerCase())))result[key]="[REDACTED]";else if(value instanceof Error||typeof value==="object"&&value!==null)result[key]=redactWalk(value,redactKeys,seen,scrubText);else if(scrubText&&typeof value==="string")result[key]=redactSecretsInText(value,{extraNames:redactKeys});else result[key]=value;return result}function getCallerInfo(){let stack=Error().stack;if(!stack)return{file:"unknown",line:0,function:"unknown"};let lines=stack.split(`
 `).slice(1);for(let line of lines){let match=line.match(/at\s+(?:(.+?)\s+)?\(?(.+?):(\d+):(\d+)\)?/);if(!match)continue;let[,fnName,filePath,lineNum]=match,fileName=filePath?filePath.split("/").pop()||filePath:"unknown";if(LOGGER_INTERNAL_FILES.includes(fileName))continue;return{file:fileName,line:parseInt(lineNum||"0",10),function:fnName?.replace(/^Object\./,"")||"anonymous"}}return{file:"unknown",line:0,function:"unknown"}}function formatCause(cause,depth,seen){if(cause===void 0||cause===null)return;if(depth>4||seen.has(cause))return;if(seen.add(cause),cause instanceof Error)return{name:cause.name,message:cause.message,code:cause.code,cause:formatCause(cause.cause,depth+1,seen)};return{name:"Error",message:typeof cause==="string"?cause:String(cause)}}function formatError(error){if(error instanceof Error)return{name:error.name,message:error.message,stack:error.stack,code:error.code,cause:formatCause(error.cause,1,new Set([error]))};if(typeof error==="string")return{name:"Error",message:error};return{name:"UnknownError",message:String(error)}}function mergeContext(base,additional){if(!base&&!additional)return;if(!base)return additional;if(!additional)return base;return{...base,...additional}}function formatDuration(ms){if(ms<1)return`${(ms*1000).toFixed(2)}\xB5s`;if(ms<1000)return`${ms.toFixed(2)}ms`;return`${(ms/1000).toFixed(2)}s`}function safeStringify(obj,indent){let seen=new WeakSet;return JSON.stringify(obj,(_,value)=>{if(typeof value==="object"&&value!==null){if(seen.has(value))return"[Circular]";seen.add(value)}if(typeof value==="bigint")return value.toString();if(value instanceof Error)return{name:value.name,message:value.message,stack:value.stack};return value},indent)}var DEFAULT_REDACT_KEYS,LOGGER_INTERNAL_FILES;var init_utils=__esm(()=>{init_redactSecrets();DEFAULT_REDACT_KEYS=["password","secret","token","apiKey","api_key","authorization","cookie","credit_card","creditCard","ssn","privateKey","private_key"];LOGGER_INTERNAL_FILES=["Logger.ts","transports.ts","utils.ts"]});class ConsoleTransport{name="console";colorize;prettyPrint;constructor(options={}){this.colorize=options.colorize??!0,this.prettyPrint=options.prettyPrint??!0}log(entry){beginLoggerEmit();try{if(this.prettyPrint)this.logPretty(entry);else this.logJson(entry)}finally{endLoggerEmit()}}logJson(entry){let output=safeStringify(entry);this.getConsoleMethod(entry.level)(output)}logPretty(entry){let method=this.getConsoleMethod(entry.level),color=this.colorize?LOG_LEVEL_COLORS[entry.level]:"",reset=this.colorize?RESET_COLOR:"",dim=this.colorize?DIM_COLOR:"",bold=this.colorize?BOLD_COLOR:"",time=new Date(entry.timestamp).toLocaleTimeString("en-US",{hour12:!1,hour:"2-digit",minute:"2-digit",second:"2-digit"}),levelStr=entry.level.toUpperCase().padEnd(5),serviceStr=entry.service?`[${entry.service}]`:"",correlationStr=entry.correlationId?`${dim}(${entry.correlationId.slice(0,8)})${reset}`:"",durationStr=entry.duration!==void 0?`${dim}${formatDuration(entry.duration)}${reset}`:"",line=`${dim}${time}${reset} ${color}${bold}${levelStr}${reset} ${serviceStr}${correlationStr} ${entry.message} ${durationStr}`;if(method(line.trim()),entry.caller)method(`  ${dim}at ${entry.caller.function} (${entry.caller.file}:${entry.caller.line})${reset}`);if(entry.context&&Object.keys(entry.context).length>0)method(`  ${dim}context:${reset}`,entry.context);if(entry.error){if(method(`  ${color}${entry.error.name}: ${entry.error.message}${reset}`),entry.error.stack){let stackLines=entry.error.stack.split(`
-`).slice(1,4);for(let stackLine of stackLines)method(`  ${dim}${stackLine.trim()}${reset}`)}let cause=entry.error.cause,indent="  ";while(cause){indent+="  ";let code=cause.code!==void 0?` [${cause.code}]`:"";method(`${indent}${color}caused by: ${cause.name}${code}: ${cause.message}${reset}`),cause=cause.cause}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);case"info":return console.info.bind(console);case"warn":return console.warn.bind(console);case"error":case"fatal":return console.error.bind(console);default:return console.log.bind(console)}}}class ServerLogTransport{name="server-log-buffer";buffer;constructor(buffer){this.buffer=buffer}log(entry){this.buffer.add(entry)}}class DatabaseAuditTransport{name="database";db;table;enabled;dedupEnabled;dedupWindowMs;dedupSlots=new Map;lastSweep=0;constructor(options){this.db=options.db,this.table=options.table,this.enabled=options.enabled??!0,this.dedupEnabled=options.dedup?.enabled??!1,this.dedupWindowMs=Math.max(1,options.dedup?.windowSeconds??60)*1000}setDb(db){this.db=db}setTable(table){this.table=table}setEnabled(enabled){this.enabled=enabled}setDedup(dedup){if(this.dedupEnabled=dedup.enabled??this.dedupEnabled,dedup.windowSeconds!=null)this.dedupWindowMs=Math.max(1,dedup.windowSeconds)*1000}isDedupable(entry){return this.dedupEnabled&&(entry.category==="auth"||entry.category==="authz"||entry.category==="security_anomaly")}sweep(now){if(now-this.lastSweep<this.dedupWindowMs)return;this.lastSweep=now;for(let[key,slot]of this.dedupSlots)if(slot.expiresAt<=now)this.dedupSlots.delete(key)}async write(entry){if(!this.enabled||!this.db||!this.table)return;try{let now=Date.now();if(this.isDedupable(entry)){this.sweep(now);let key=`${entry.ipAddress}|${entry.operation}|${entry.summary}|${entry.userId??""}`,slot=this.dedupSlots.get(key);if(slot&&slot.expiresAt>now){slot.count+=1,await this.bumpOccurrence(slot.rowId,slot.count,now);return}this.dedupSlots.set(key,{rowId:entry.id,count:1,expiresAt:now+this.dedupWindowMs})}await this.db.insert(this.table).values({id:entry.id,entityId:entry.entityId,entityName:entry.entityName,operationType:entry.operation,userId:entry.userId,ipAddress:entry.ipAddress,userAgent:entry.userAgent,summary:entry.summary,severity:entry.severity,category:entry.category,occurrenceCount:1,oldValues:entry.oldValues,newValues:entry.newValues,path:entry.path,query:entry.query})}catch(error){console.error("Audit log write failed:",error)}}async bumpOccurrence(rowId,count,nowMs){try{let{eq}=await import("drizzle-orm"),idCol=this.table.id;await this.db.update(this.table).set({occurrenceCount:count,lastOccurrenceAt:new Date(nowMs)}).where(eq(idCol,rowId))}catch(error){console.error("Audit dedup update failed:",error)}}}class ConsoleAuditTransport{name="console-audit";enabled;constructor(options={}){this.enabled=options.enabled??!0}write(entry){if(!this.enabled)return;let reset=RESET_COLOR,dim=DIM_COLOR,color={info:"\x1B[35m",low:"\x1B[90m",medium:"\x1B[33m",high:"\x1B[31m",critical:"\x1B[1m\x1B[31m"}[entry.severity]??"\x1B[35m",sev=entry.severity.toUpperCase(),actor=entry.userId||"anonymous",cat=entry.category;console.log(`${dim}${entry.timestamp}${reset} ${color}AUDIT\xB7${sev}${reset} ${dim}(${cat})${reset} [${entry.operation}] ${entry.entityName}${entry.entityId?`:${entry.entityId}`:""} ${dim}by ${actor}${reset}${entry.summary?` ${dim}\u2014${reset} ${entry.summary}`:""}`)}}var init_transports=__esm(()=>{init_ServerLogBuffer();init_types();init_utils()});class Logger{config;transports;auditTransports;context;correlationId;static instance=null;constructor(config={},context={},correlationId){this.config={...DEFAULT_CONFIG,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||[]])],this.context=context,this.correlationId=correlationId,this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint})],this.auditTransports=[new ConsoleAuditTransport({enabled:this.config.prettyPrint})]}static getInstance(config){if(!Logger.instance)Logger.instance=new Logger(config);return Logger.instance}static resetInstance(){Logger.instance=null}configure(config){return this.config={...this.config,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||this.config.redactKeys||[]])],this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint}),...this.transports.filter((t)=>t.name!=="console")],this}child(context,correlationId){let childLogger=new Logger(this.config,mergeContext(this.context,context)||{},correlationId||this.correlationId);return childLogger.transports=this.transports,childLogger.auditTransports=this.auditTransports,childLogger}withCorrelationId(correlationId){return this.child({},correlationId)}addTransport(transport){this.transports.push(transport)}addAuditTransport(transport){this.auditTransports.push(transport)}setLevel(level){this.config.level=level}setAuditEnabled(enabled){this.config.auditEnabled=enabled}isAuditEnabled(){return this.config.auditEnabled}setAuditSuppressReasons(reasons){this.config.auditSuppressReasons=reasons}setAuditMinSeverity(severity){this.config.auditMinSeverity=severity}shouldLog(level){return LOG_LEVEL_PRIORITY[level]>=LOG_LEVEL_PRIORITY[this.config.level]}shouldLogScope(scope){if(!scope)return!0;return matchesScope(scope,this.config.enabledScopes)}setEnabledScopes(scopes){this.config.enabledScopes=scopes}getEnabledScopes(){return this.config.enabledScopes}scoped(scope){return new ScopedLogger(this,scope)}createEntry(level,message,context,error,startTime,scope){let entry={timestamp:new Date().toISOString(),level,message:redactSecretsInText(message,{extraNames:this.config.redactKeys}),scope,service:this.config.service,correlationId:this.correlationId},mergedContext=mergeContext(this.context,context);if(mergedContext&&Object.keys(mergedContext).length>0)entry.context=redactLogContext(mergedContext,this.config.redactKeys);if(this.config.includeCallerInfo)entry.caller=getCallerInfo();if(error)entry.error=redactErrorInfo(formatError(error),this.config.redactKeys);if(startTime!==void 0)entry.duration=performance.now()-startTime;return entry}log(level,message,context,error,startTime,scope){if(!this.shouldLog(level))return;if(!this.shouldLogScope(scope))return;let entry=this.createEntry(level,message,context,error,startTime,scope);for(let transport of this.transports)try{transport.log(entry)}catch(err){console.error(`Logger transport "${transport.name}" failed:`,err)}}debug(message,context){this.log("debug",message,context)}info(message,context){this.log("info",message,context)}warn(message,context){this.log("warn",message,context)}error(message,error,context){this.log("error",message,context,error)}fatal(message,error,context){this.log("fatal",message,context,error)}time(label){let start=performance.now();return()=>{this.log("debug",`${label} completed`,void 0,void 0,start)}}async timeAsync(label,fn,context){let start=performance.now();try{let result=await fn();return this.log("debug",`${label} completed`,context,void 0,start),result}catch(error){throw this.log("error",`${label} failed`,context,error,start),error}}request(options){let level=options.statusCode>=500?"error":options.statusCode>=400?"warn":"info";this.log(level,`${options.method} ${options.path} ${options.statusCode}`,{method:options.method,path:options.path,statusCode:options.statusCode,durationMs:options.duration,correlationId:options.correlationId,userId:options.userId,ip:options.ip,userAgent:options.userAgent})}db(options){let level=options.error?"error":"debug";this.log(level,`DB ${options.operation} on ${options.table}`,{operation:options.operation,table:options.table,durationMs:options.duration,rowCount:options.rowCount},options.error)}async flush(){for(let transport of this.transports)if(transport.flush)await transport.flush()}async audit(options){let summary=options.summary||`${options.operation} on ${options.entityName}`;if(this.config.auditSuppressReasons?.includes(summary))return;let derived=classifyAudit(options.operation,summary),severity=options.severity??derived.severity,category=options.category??derived.category;if(severityRank(severity)<severityRank(this.config.auditMinSeverity))return;let scrub={extraNames:this.config.redactKeys},entry={id:randomId(),timestamp:new Date().toISOString(),entityName:options.entityName,entityId:options.entityId??null,operation:options.operation,userId:options.userId??null,summary:redactSecretsInText(summary,scrub),severity,category,oldValues:redactSensitiveData(options.oldValues||{},this.config.redactKeys),newValues:redactSensitiveData(options.newValues||{},this.config.redactKeys),ipAddress:options.ipAddress||"unknown",userAgent:options.userAgent||"unknown",path:redactUrl(options.path||"",scrub),query:redactQueryString(options.query||"",scrub),correlationId:this.correlationId};for(let transport of this.auditTransports)try{await transport.write(entry)}catch(err){console.error(`Audit transport "${transport.name}" failed:`,err)}}auditOnly(options){this.audit(options)}async trace(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)await this.audit(options.audit)}traceSync(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)this.audit(options.audit)}}class ScopedLogger{parent;scope;constructor(parent,scope){this.parent=parent,this.scope=scope}debug(message,context){this.parent.log("debug",message,context,void 0,void 0,this.scope)}info(message,context){this.parent.log("info",message,context,void 0,void 0,this.scope)}warn(message,context){this.parent.log("warn",message,context,void 0,void 0,this.scope)}error(message,error,context){this.parent.log("error",message,context,error,void 0,this.scope)}}var DEFAULT_CONFIG,logger;var init_Logger=__esm(()=>{init_redactSecrets();init_auditTaxonomy();init_scopes();init_transports();init_types();init_utils();DEFAULT_CONFIG={level:"info",service:"nucleus",environment:"development",redactKeys:[],colorize:!0,prettyPrint:!0,includeCallerInfo:!0,asyncBufferSize:100,flushIntervalMs:1000,auditEnabled:!1,auditSuppressReasons:DEFAULT_AUDIT_SUPPRESS_REASONS,auditMinSeverity:"info",enabledScopes:["*"]};logger=Logger.getInstance()});var require_auto_promise=__commonJS((exports,module)=>{var slice=Array.prototype.slice;module.exports=function(fn,makeResult){return function(){var promise,args=arguments,n=args.length;if(n!==0&&typeof args[n-1]!=="function")args=slice.call(arguments),promise=new Promise(function(resolve,reject){args.push(function(err,result){if(err!=null)reject(err);else resolve(makeResult!==void 0?makeResult.apply(this,slice.call(arguments,1)):result)})});return fn.apply(this,args),promise}}});var require_smb2_message=__commonJS((exports,module)=>{var protocolId=Buffer.from([254,83,77,66]),headerTranslates={Command:{NEGOTIATE:0,SESSION_SETUP:1,LOGOFF:2,TREE_CONNECT:3,TREE_DISCONNECT:4,CREATE:5,CLOSE:6,FLUSH:7,READ:8,WRITE:9,LOCK:10,IOCTL:11,CANCEL:12,ECHO:13,QUERY_DIRECTORY:14,CHANGE_NOTIFY:15,QUERY_INFO:16,SET_INFO:17,OPLOCK_BREAK:18}},headerLength=64,headerSync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["ProcessId",4,processId],["TreeId",4,0],["SessionId",8,sessionId],["Signature",16,0]]},headerASync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["AsyncId",8],["SessionId",8,sessionId],["Signature",16,0]]},SMB2Message=module.exports=function(options){if(this.headers={},options&&options.headers)this.setHeaders(options.headers);if(this.request={},options&&options.request)this.setRequest(options.request);this.response={}},proto=SMB2Message.prototype={};proto.setHeaders=function(obj){for(var key in obj)this.headers[key]=obj[key];this.structure=__require("../structures/"+this.headers.Command.toLowerCase())};proto.getHeaders=function(){return this.headers};proto.setRequest=function(request){this.request=request};proto.getResponse=function(){return this.response};proto.getBuffer=function(connection){var buffer=Buffer.allocUnsafe(65535),length=0;if(!this.isMessageIdSetted)this.isMessageIdSetted=!0,this.headers.MessageId=connection.messageId++;length+=writeHeaders(this,buffer),length+=writeRequest(this,buffer,headerLength);var output=Buffer.allocUnsafe(length);return buffer.copy(output,0,0,length),output};proto.parseBuffer=function(buffer){readHeaders(this,buffer),readResponse(this,buffer,headerLength)};function dataToBuffer(data,length){if(Buffer.isBuffer(data))return data;if(typeof data==="string")return Buffer.from(data);var result=Buffer.allocUnsafe(length);for(var i=0;i<length;i++)result.writeUInt8(255&data>>i*8,i);return result}function bufferToData(buffer){if(!Buffer.isBuffer(buffer))return buffer;var result=0;for(var i=0;i<buffer.length;i++)result+=buffer.readUInt8(i)<<i*8;return result}function writeData(buffer,data,offset,length){dataToBuffer(data,length).copy(buffer,offset,0)}function readData(buffer,offset,length){return buffer.slice(offset,offset+length)}function translate(key,value){if(headerTranslates[key]&&typeof headerTranslates[key][value]<"u")return headerTranslates[key][value];return value}function unTranslate(key,value){if(headerTranslates[key]){for(var t in headerTranslates[key])if(headerTranslates[key][t]===value)return t}return null}function readHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1];if(message.headers[key]=readData(buffer,offset,length),length<=8)message.headers[key]=unTranslate(key,bufferToData(message.headers[key]))||message.headers[key];offset+=length}message.structure=__require("../structures/"+message.headers.Command.toLowerCase())}function writeHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1],defaultValue=header[i][2]||0;writeData(buffer,translate(key,message.headers[key]||defaultValue),offset,length),offset+=length}return offset}function readResponse(message,buffer,offset){for(var i in message.structure.response){var key=message.structure.response[i][0],length=message.structure.response[i][1]||1;if(typeof length==="string")length=bufferToData(message.response[length]);message.response[key]=readData(buffer,offset,length),offset+=length}}function writeRequest(message,buffer,offset){var initOffset=offset,needsRewrite=!1,tmpBuffer=Buffer.allocUnsafe(buffer.length);offset=0;for(var i in message.structure.request){var key=message.structure.request[i][0],length=message.structure.request[i][1]||1,defaultValue=message.structure.request[i][2]||0;if(typeof length==="string"){if(message.request[key]=message.request[key]||"",message.request[length]!==message.request[key].length)message.request[length]=message.request[key].length,needsRewrite=!0;length=message.request[key].length}else message.request[key]=message.request[key]||defaultValue;writeData(tmpBuffer,message.request[key],offset,length),offset+=length}if(needsRewrite)writeRequest(message,tmpBuffer,0);return tmpBuffer.copy(buffer,initOffset,0,offset),offset}});var require_smb2_forge=__commonJS((exports,module)=>{var SMB2Message=require_smb2_message(),SMB2Forge=module.exports={};SMB2Forge.request=function(messageName,params,connection,cb){var msg=__require("../messages/"+messageName),smbMessage=msg.generate(connection,params);sendNetBiosMessage(connection,smbMessage);var error=Error();error.messageName=messageName,error.params=params,getResponse(connection,smbMessage.getHeaders().MessageId,msg.parse(connection,cb,error))};SMB2Forge.response=function(c){return c.responses={},c.responsesCB={},c.responseBuffer=Buffer.allocUnsafe(0),function(response){c.responseBuffer=Buffer.concat([c.responseBuffer,response]);var extract=!0;while(extract)if(extract=!1,c.responseBuffer.length>=4){var msgLength=(c.responseBuffer.readUInt8(1)<<16)+c.responseBuffer.readUInt16BE(2);if(c.responseBuffer.length>=msgLength+4){extract=!0;var r=c.responseBuffer.slice(4,msgLength+4),message=new SMB2Message;if(message.parseBuffer(r),c.debug)console.log("--response"),console.log(r.toString("hex"));var mId=message.getHeaders().MessageId.toString("hex");if(c.responsesCB[mId])c.responsesCB[mId](message),delete c.responsesCB[mId];else c.responses[mId]=message;c.responseBuffer=c.responseBuffer.slice(msgLength+4)}}}};function sendNetBiosMessage(connection,message){var smbRequest=message.getBuffer(connection);if(connection.debug)console.log("--request"),console.log(smbRequest.toString("hex"));var buffer=Buffer.allocUnsafe(smbRequest.length+4);return buffer.writeUInt8(0,0),buffer.writeUInt8((16711680&smbRequest.length)>>16,1),buffer.writeUInt16BE(65535&smbRequest.length,2),smbRequest.copy(buffer,4,0,smbRequest.length),connection.newResponse=!1,connection.socket.write(buffer),!0}function getResponse(c,mId,cb){var messageId=Buffer.allocUnsafe(4);if(messageId.writeUInt32LE(mId,0),messageId=messageId.toString("hex"),c.responses[messageId])cb(c.responses[messageId]),delete c.responses[messageId];else c.responsesCB[messageId]=cb}});var require_smb2_connection=__commonJS((exports,module)=>{var net=__require("net"),SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,SMB2Connection=module.exports={};SMB2Connection.close=function(connection){if(clearAutoCloseTimeout(connection),connection.connected)connection.connected=!1,connection.socket.end()};SMB2Connection.requireConnect=function(method){return function(){var connection=this,args=Array.prototype.slice.call(arguments);connect(connection,function(err){var cb=args.pop();if(typeof cb!=="function")args.push(cb),cb=function(err2){if(err2){if(!(err2 instanceof Error))err2=Error(String(err2));throw err2}};if(cb=scheduleAutoClose(connection,cb),args.push(cb),err)cb(err);else method.apply(connection,args)})}};SMB2Connection.init=function(connection){connection.connected=!1,connection.socket=new net.Socket({allowHalfOpen:!0}),connection.socket.on("data",SMB2Forge.response(connection)),connection.errorHandler=[],connection.socket.on("error",function(err){if(connection.errorHandler.length>0)connection.errorHandler[0].call(null,err);if(connection.debug)console.log("-- error"),console.log(arguments)})};function connect(connection,cb){if(connection.connected){cb&&cb(null);return}cb=scheduleAutoClose(connection,cb),connection.messageId=0,connection.SessionId=Math.floor(Math.random()*256)&255,connection.socket.connect(connection.port,connection.ip),SMB2Request("negotiate",{},connection,function(err){if(err)cb&&cb(err);else SMB2Request("session_setup_step1",{},connection,function(err2){if(err2)cb&&cb(err2);else SMB2Request("session_setup_step2",{},connection,function(err3){if(err3)cb&&cb(err3);else SMB2Request("tree_connect",{},connection,function(err4){if(err4)cb&&cb(err4);else connection.connected=!0,cb&&cb(null)})})})})}function clearAutoCloseTimeout(connection){if(connection.scheduledAutoClose)clearTimeout(connection.scheduledAutoClose),connection.scheduledAutoClose=null}function setAutoCloseTimeout(connection){if(clearAutoCloseTimeout(connection),connection.autoCloseTimeout!==0)connection.scheduledAutoClose=setTimeout(function(){SMB2Connection.close(connection)},connection.autoCloseTimeout)}function scheduleAutoClose(connection,cb){return addErrorListener(connection,cb),clearAutoCloseTimeout(connection),function(){removeErrorListener(connection),setAutoCloseTimeout(connection),cb.apply(null,arguments)}}function addErrorListener(connection,callback){connection.errorHandler.unshift(callback)}function removeErrorListener(connection){connection.errorHandler.shift()}});var require_disconnect=__commonJS((exports,module)=>{var SMB2Connection=require_smb2_connection();module.exports=function(){SMB2Connection.close(this)}});var require_exists=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,cb){var connection=this;SMB2Request("open",{path},connection,function(err,file){if(err!=null){if(err.code==="STATUS_OBJECT_NAME_NOT_FOUND"||err.code==="STATUS_OBJECT_PATH_NOT_FOUND")return cb&&cb(null,!1);return cb&&cb(err)}SMB2Request("close",file,connection,function(){cb&&cb(null,!0)})})}});var require_bigint=__commonJS((exports,module)=>{var BigInt2=module.exports=function(n,v){if(BigInt2.isBigInt(n))this.buffer=Buffer.allocUnsafe(n.buffer.length),n.buffer.copy(this.buffer,0),this.sign=n.sign;else if(this.buffer=Buffer.alloc(n),this.sign=1,v=v||0,v!==0){if(v<0)this.sign=-1,v=-v;v=v.toString(16);var size=Math.ceil(v.length/2),carry=size*2-v.length;for(var i=0;i<size;i++){var start=(size-i-1)*2-carry;this.buffer.writeUInt8(parseInt(start===-1?v.substr(0,1):v.substr(start,2),16),i)}}};BigInt2.isBigInt=function(v){return v&&v.buffer&&Buffer.isBuffer(v.buffer)};BigInt2.toBigInt=function(n,v){return new BigInt2(n,v)};BigInt2.fromBuffer=function(b,sign){sign=typeof sign>"u"?1:sign;var bi=new BigInt2(0);return bi.sign=sign,bi.buffer=b,bi};BigInt2.prototype.add=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.neg().sub(v);var carry=0,n=Math.max(v.buffer.length,this.buffer.length),result=new BigInt2(n);for(var i=0;i<n;i++){var r=(i<this.buffer.length?this.buffer.readUInt8(i):0)+(i<v.buffer.length?v.buffer.readUInt8(i):0)+carry;result.buffer.writeUInt8(r&255,i),carry=r>>8}return result.sign=this.sign,result};BigInt2.prototype.neg=function(){var result=new BigInt2(this);return result.sign*=-1,result};BigInt2.prototype.abs=function(){var result=new BigInt2(this);return result.sign=1,result};BigInt2.prototype.sub=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.add(v.neg());var carry=0,a=new BigInt2(this),b=new BigInt2(v),n=Math.max(a.buffer.length,b.buffer.length),result=new BigInt2(n),sign=this.sign;if(a.abs().lt(b.abs())){var t=a;a=b,b=t,sign*=-1}for(var i=0;i<n;i++){var va=i<a.buffer.length?a.buffer.readUInt8(i):0,vb=i<b.buffer.length?b.buffer.readUInt8(i):0,c=0,r=va-vb-carry;while(r<0)r+=255,c--;result.buffer.writeUInt8(r&255,i),carry=(r>>8)+c}return result.sign=sign,result};BigInt2.prototype.toBuffer=function(){return this.buffer};BigInt2.prototype.toNumber=function(){var b=Buffer.allocUnsafe(this.buffer.length);for(var i=0;i<this.buffer.length;i++)b.writeUInt8(this.buffer.readUInt8(this.buffer.length-i-1),i);return parseInt(b.toString("hex"),16)};BigInt2.prototype.compare=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);var n=Math.max(v.buffer.length,this.buffer.length);if(this.sign>v.sign)return 1;if(this.sign<v.sign)return-1;for(var i=n-1;i>=0;i--){var a=i<this.buffer.length?this.buffer.readUInt8(i):0,b=i<v.buffer.length?v.buffer.readUInt8(i):0;if(a!==b)return a>b?this.sign:-this.sign}return 0};BigInt2.prototype.lt=function(v){return this.compare(v)<0};BigInt2.prototype.le=function(v){return this.compare(v)<=0};BigInt2.prototype.gt=function(v){return this.compare(v)>0};BigInt2.prototype.ge=function(v){return this.compare(v)>=0}});var require_constants=__commonJS((exports,module)=>{module.exports={FILE_SUPERSEDE:0,FILE_OPEN:1,FILE_CREATE:2,FILE_OPEN_IF:3,FILE_OVERWRITE:4,FILE_OVERWRITE_IF:5,MAX_READ_LENGTH:65536,MAX_WRITE_LENGTH:65423,FILE_SHARE_NONE:0,FILE_SHARE_READ:1,FILE_SHARE_WRITE:2,FILE_SHARE_DELETE:4,DELETE:65536,FILE_APPEND_DATA:4,FILE_DELETE_CHILD:64,FILE_READ_ATTRIBUTES:128,FILE_READ_DATA:1,FILE_READ_EA:8,FILE_WRITE_ATTRIBUTES:256,FILE_WRITE_DATA:2,FILE_WRITE_EA:16,READ_CONTROL:131072,SYNCHRONIZE:1048576,WRITE_DAC:262144,DIRECTORY:16}});var require_rename=__commonJS((exports,module)=>{var BigInt2=require_bigint(),SMB2Request=require_smb2_forge().request,constants=require_constants();module.exports=function(oldPath,newPath,options,cb){if(typeof options==="function")cb=options,options={};var connection=this;SMB2Request("open_folder",{path:oldPath},connection,function(err,file){if(err)SMB2Request("create",{path:oldPath,createDisposition:constants.FILE_OPEN,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err2,file2){if(err2)cb&&cb(err2);else rename_(connection,file2,newPath,options,cb)});else rename_(connection,file,newPath,options,cb)})};function rename_(connection,file,newPath,options,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileRenameInformation",Buffer:renameBuffer(newPath,options)},connection,function(err){SMB2Request("close",file,connection,function(){if(err)cb&&cb(err);else cb&&cb(null)})})}function renameBuffer(newPath,options){var filename=Buffer.from(newPath,"ucs2");return Buffer.concat([new BigInt2(1,options.replace?1:0).toBuffer(),new BigInt2(7,0).toBuffer(),new BigInt2(8,0).toBuffer(),new BigInt2(4,filename.length).toBuffer(),filename])}});var require_readFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(filename,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};SMB2Request("open",{path:filename},connection,function(err,file){if(err)cb&&cb(err);else{var fileLength=0,offset=new BigInt2(8),stop=!1,nbRemainingPackets=0;for(var i=0;i<file.EndofFile.length;i++)fileLength+=file.EndofFile[i]*Math.pow(2,i*8);var result=Buffer.allocUnsafe(fileLength),callback=function(offset2){return function(err2,content){if(stop)return;if(err2)cb&&cb(err2),stop=!0;else content.copy(result,offset2.toNumber()),nbRemainingPackets--,checkDone()}},checkDone=function(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))SMB2Request("close",file,connection,function(){if(options.encoding)result=result.toString(options.encoding);cb&&cb(null,result)})},createPackets=function(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=offset.sub(fileLength).neg(),packetSize=rest.gt(MAX_READ_LENGTH)?MAX_READ_LENGTH:rest.toNumber();SMB2Request("read",{FileId:file.FileId,Length:packetSize,Offset:offset.toBuffer()},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}};checkDone()}})}});var require_createReadStream=__commonJS((exports,module)=>{var Readable=__require("stream").Readable,BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};else if(options==null)options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onOpen(err,file){if(err!=null)return cb(err);var offset=options.start||0,fileSize=BigInt2.fromBuffer(file.EndofFile).toNumber(),end=fileSize;if(options.end<end)end=options.end+1;var close=request.bind(void 0,"close",file,connection),stream=new Readable;if(stream.fileSize=fileSize,shouldClose)stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})};var running=!1;stream._read=function(size){if(running)return;if(offset>=end)return shouldClose?close(function(){stream.push(null)}):stream.push(null);running=!0,request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,size,end-offset),Offset:new BigInt2(8,offset).toBuffer()},connection,function(err2,content){if(running=!1,err2!=null)return process.nextTick(stream.emit.bind(stream,"error",err2));offset+=content.length,stream.push(content)})},cb(null,stream)}if(isFd)onOpen(null,fd);else request("open",{path},connection,onOpen)}});var require_parse_flags=__commonJS((exports,module)=>{var c=require_constants();module.exports=function(flags){var chars={__proto__:null};for(var i=0,n=flags.length;i<n;++i)chars[flags[i]]=!0;if("r"in chars)return c.FILE_OPEN;if("x"in chars)return c.FILE_CREATE;if("a"in chars)return c.FILE_OPEN_IF;if("w"in chars)return c.FILE_OVERWRITE_IF;throw Error("invalid flags")}});var require_createWriteStream=__commonJS((exports,module)=>{var Writable=__require("stream").Writable,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onCreate(err,file){if(err!=null)return cb(err);var offset=new BigInt2(8,options!=null&&options.start||0);function write(buffer,i,cb2){var j=i+constants.MAX_WRITE_LENGTH,chunk=buffer.slice(i,j);request("write",{Buffer:chunk,FileId:file.FileId,Offset:offset.toBuffer()},connection,function(err2){if(err2!=null)return cb2(err2);if(offset=offset.add(chunk.length),j<buffer.length)return write(buffer,j,cb2);cb2()})}var stream=new Writable;if(shouldClose){var close=request.bind(void 0,"close",file,connection);stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})},stream._final=close}stream._write=function(chunk,encoding,next){write(Buffer.isBuffer(chunk)?chunk:Buffer.from(chunk,encoding),0,next)},cb(null,stream)}if(isFd)onCreate(null,fd);else request("create",{createDisposition:parseFlags(options!=null&&options.flags||"wx"),path},connection,onCreate)}});var require_writeFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags();module.exports=function(filename,data,options,cb){if(typeof options==="function")cb=options,options={};options.encoding=options.encoding||"utf8";var connection=this,file,fileContent=Buffer.isBuffer(data)?data:Buffer.from(data,options.encoding),fileLength=new BigInt2(8,fileContent.length);function createFile(fileCreated){SMB2Request("create",{createDisposition:parseFlags(options!=null&&(options.flags||options.flag)||"wx"),path:filename},connection,function(err,f){if(err)cb&&cb(err);else file=f,fileCreated()})}function closeFile(fileClosed){SMB2Request("close",file,connection,function(err){if(err)cb&&cb(err);else file=null,fileClosed()})}function setFileSize(fileSizeSetted){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,function(err){if(err)cb&&cb(err);else fileSizeSetted()})}function writeFile(fileWritten){var offset=new BigInt2(8),stop=!1,nbRemainingPackets=0,maxPacketSize=new BigInt2(8,constants.MAX_WRITE_LENGTH);function callback(){return function(err){if(stop)return;if(err)cb&&cb(err),stop=!0;else nbRemainingPackets--,checkDone()}}function checkDone(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))fileWritten()}function createPackets(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=fileLength.sub(offset),packetSize=rest.gt(maxPacketSize)?maxPacketSize:rest;SMB2Request("write",{FileId:file.FileId,Offset:offset.toBuffer(),Buffer:fileContent.slice(offset.toNumber(),offset.add(packetSize).toNumber())},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}}checkDone()}createFile(function(){setFileSize(function(){writeFile(function(){closeFile(cb)})})})}});var require_unlink=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants();module.exports=function(path,cb){var connection=this;SMB2Request("create",{path,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)cb&&cb(err2);else cb&&cb(null,files)})})})}});var require_convert_time=__commonJS((exports,module)=>{var winTicks=1e7,uEpoch=11644473600;module.exports=function(time){var unixTime=time/winTicks-uEpoch;return new Date(unixTime*1000)}});var require_stats=__commonJS((exports,module)=>{var convert=require_convert_time(),BigInt2=require_bigint(),DIRECTORY=require_constants().DIRECTORY;module.exports=function(file){return{birthtime:convert(BigInt2.fromBuffer(file.CreationTime).toNumber()),atime:convert(BigInt2.fromBuffer(file.LastAccessTime).toNumber()),mtime:convert(BigInt2.fromBuffer(file.LastWriteTime).toNumber()),ctime:convert(BigInt2.fromBuffer(file.ChangeTime).toNumber()),size:BigInt2.fromBuffer(file.EndofFile).toNumber(),isDirectory:function(){var attr=file.FileAttributes;if(typeof attr!=="number")attr=BigInt2.fromBuffer(attr).toNumber();return(attr&DIRECTORY)==DIRECTORY}}}});var require_readdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,stats=require_stats();module.exports=function(path,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};var mapping=options.stats?function(v){var obj=stats(v);return obj.name=v.Filename,obj}:function(v){return v.Filename};function queryDirectory(filesBatch,file,connection2,cb2){SMB2Request("query_directory",file,connection2,function(err,files){if(err)if(err.code==="STATUS_NO_MORE_FILES")cb2(null,filesBatch);else cb2(err);else filesBatch.push(files.filter(function(v){return v.Filename!=="."&&v.Filename!==".."}).map(mapping)),queryDirectory(filesBatch,file,connection2,cb2)})}function openDirectory(path2,connection2,cb2){SMB2Request("open",{path:path2},connection2,function(err,file){if(err)cb2(err);else return cb2(null,file)})}function closeDirectory(file,connection2,cb2){SMB2Request("close",file,connection2,function(err,res){if(err){if(err.code!=="STATUS_FILE_CLOSED")cb2(err)}cb2(null,res)})}openDirectory(path,connection,function(err,file){var totalFiles=[],filesBatch=[];if(err)cb(err);else queryDirectory(filesBatch,file,connection,function(err2,file2){if(err2)cb(err2);else closeDirectory(file2,connection,function(err3,file3){if(err3)cb(err3);else totalFiles=[].concat(...filesBatch),cb(null,totalFiles)})})})}});var require_rmdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint();module.exports=function(path,cb){var connection=this;SMB2Request("open_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)return cb(err2);cb(null,files)})})})}});var require_mkdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,mode,cb){if(typeof mode==="function")cb=mode,mode="0777";var connection=this;SMB2Request("create_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("close",file,connection,function(){cb&&cb(null)})})}});var require_getSize=__commonJS((exports,module)=>{var BigInt2=require_bigint(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,BigInt2.fromBuffer(file.EndofFile).toNumber())})})}});var require_stat=__commonJS((exports,module)=>{var stats=require_stats(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,stats(file))})})}});var require_open=__commonJS((exports,module)=>{var parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,flags,cb){if(typeof flags==="function")cb=flags,flags=void 0;request("create",{createDisposition:parseFlags(flags||"r"),path},this,cb)}});var require_read=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){assert(start!==null,"null pos is not supported");var connection=this,end=Math.min(start+length,BigInt2.fromBuffer(file.EndofFile).toNumber()),pos=start;function onRead(err,chunk){if(err!=null)return cb(err,pos-start,buffer);chunk.copy(buffer,offset);var n=chunk.length;offset+=n,pos+=n,readChunk()}function readChunk(){if(pos>=end)return cb(null,pos-start,buffer);request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,end-pos),Offset:new BigInt2(8,pos).toBuffer()},connection,onRead)}process.nextTick(readChunk)}});var require_write=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_WRITE_LENGTH=require_constants().MAX_WRITE_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){if(assert(Buffer.isBuffer(buffer)),offset==null)offset=0;else assert.strictEqual(typeof offset,"number"),assert(offset>0),assert(offset<buffer.length);if(length==null)length=buffer.length-offset;else assert.strictEqual(typeof length,"number"),assert(length>0),length=Math.min(length,buffer.length-offset);assert.strictEqual(typeof start,"number");var connection=this,pos=start,chunkLength;function onWrite(err){if(err!=null)return cb(err,pos-start,buffer);length-=chunkLength,offset+=chunkLength,pos+=chunkLength,writeChunk()}function writeChunk(){if(length<=0)return cb(null,pos-start,buffer);chunkLength=Math.min(MAX_WRITE_LENGTH,length),request("write",{Buffer:buffer.slice(offset,offset+chunkLength),FileId:file.FileId,Offset:new BigInt2(8,pos).toBuffer()},connection,onWrite)}process.nextTick(writeChunk)}});var require_close=__commonJS((exports,module)=>{var request=require_smb2_forge().request;module.exports=function(file,cb){request("close",file,this,cb)}});var require_truncate=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),FILE_WRITE_DATA=require_constants().FILE_WRITE_DATA;function setFileSize(file,fileLength,connection,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,cb)}module.exports=function(path,length,cb){var connection=this;SMB2Request("open",{path,desiredAccess:FILE_WRITE_DATA},connection,function(err,file){if(err!=null)return cb(err);setFileSize(file,new BigInt2(8,length),connection,function(err2){SMB2Request("close",file,connection,function(){cb(err2)})})})}});var require_smb2=__commonJS((exports,module)=>{var shareRegExp=/\\\\([^\\]*)\\([^\\]*)\\?/,port=445,packetConcurrency=20,autoCloseTimeout=1e4,autoPromise=require_auto_promise(),SMB2Connection=require_smb2_connection(),SMB=module.exports=function(opt){opt=opt||{};var matches;if(!opt.share||!(matches=opt.share.match(shareRegExp)))throw Error("the share is not valid");if(this.ip=matches[1],this.port=opt.port||port,this.share=matches[2],this.fullPath=opt.share,this.packetConcurrency=opt.packetConcurrency||packetConcurrency,opt.autoCloseTimeout!==void 0)this.autoCloseTimeout=opt.autoCloseTimeout;else this.autoCloseTimeout=autoCloseTimeout;this.domain=opt.domain,this.username=opt.username,this.password=opt.password,this.ProcessId=Buffer.from([Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&254]),this.debug=opt.debug,SMB2Connection.init(this)},proto=SMB.prototype={};proto.disconnect=require_disconnect();proto.exists=autoPromise(SMB2Connection.requireConnect(require_exists()));proto.rename=autoPromise(SMB2Connection.requireConnect(require_rename()));proto.readFile=autoPromise(SMB2Connection.requireConnect(require_readFile()));proto.createReadStream=autoPromise(SMB2Connection.requireConnect(require_createReadStream()));proto.createWriteStream=autoPromise(SMB2Connection.requireConnect(require_createWriteStream()));proto.writeFile=autoPromise(SMB2Connection.requireConnect(require_writeFile()));proto.unlink=autoPromise(SMB2Connection.requireConnect(require_unlink()));proto.readdir=autoPromise(SMB2Connection.requireConnect(require_readdir()));proto.rmdir=autoPromise(SMB2Connection.requireConnect(require_rmdir()));proto.mkdir=autoPromise(SMB2Connection.requireConnect(require_mkdir()));proto.getSize=autoPromise(SMB2Connection.requireConnect(require_getSize()));proto.stat=autoPromise(SMB2Connection.requireConnect(require_stat()));proto.open=autoPromise(SMB2Connection.requireConnect(require_open()));proto.read=autoPromise(require_read(),function(bytesRead,buffer){return{bytesRead,buffer}});proto.write=autoPromise(require_write(),function(bytesWritten,buffer){return{bytesWritten,buffer}});proto.close=autoPromise(require_close());proto.truncate=autoPromise(SMB2Connection.requireConnect(require_truncate()))});import{createHash,randomBytes}from"crypto";var API_KEY_BYTE_LENGTH=32,HASH_ALGORITHM="sha256",generateApiKey=(prefix="nk_live")=>{let randomPart=randomBytes(API_KEY_BYTE_LENGTH).toString("hex"),rawKey=`${prefix}_${randomPart}`,keyHash=hashApiKey(rawKey),keyPreview=`${prefix}_...${randomPart.slice(-4)}`;return{rawKey,keyHash,keyPreview}},hashApiKey=(rawKey)=>{return createHash(HASH_ALGORITHM).update(rawKey).digest("hex")},validateApiKeyFormat=(rawKey)=>{return/^nk_(live|test)_[a-f0-9]{64}$/.test(rawKey)},extractApiKeyFromHeader=(headers)=>{let apiKeyHeader=headers.get("x-api-key");if(apiKeyHeader&&validateApiKeyFormat(apiKeyHeader))return apiKeyHeader;let authHeader=headers.get("authorization");if(authHeader){let bearerMatch=authHeader.match(/^Bearer\s+(nk_(?:live|test)_[a-f0-9]{64})$/);if(bearerMatch?.[1])return bearerMatch[1]}return null},validateApiKeyRecord=(record)=>{if(!record.isActive)return{valid:!1,reason:"API key is inactive"};if(record.revokedAt)return{valid:!1,reason:"API key has been revoked"};if(record.expiresAt&&new Date(record.expiresAt)<new Date)return{valid:!1,reason:"API key has expired"};return{valid:!0,record}},intersectPermissions=(userPermissions,keyPermissions)=>{let userSet=new Set(userPermissions);return keyPermissions.filter((p)=>userSet.has(p))};var init_ApiKey=()=>{};var normalize=(value)=>{return value?.trim().toLowerCase()||"unknown"},extractHeaderValue=(headers,key)=>{return headers[key.toLowerCase()]??headers[key]};import crypto2 from"crypto";var generateDeviceFingerprint=(input)=>{let payload=JSON.stringify({userAgent:normalize(input.userAgent),extra:input.extra??{}});return{hash:crypto2.createHash("sha256").update(payload).digest("base64url"),components:input}};var init_Generate=()=>{};var validateDeviceFingerprint=({savedFingerprint,requestIp,headers})=>{let userAgent=extractHeaderValue(headers,"user-agent"),forwardedFor=extractHeaderValue(headers,"x-forwarded-for")??requestIp??void 0,currentFingerprint=generateDeviceFingerprint({userAgent,ipAddress:forwardedFor}),componentMismatch=[{field:"userAgent",saved:savedFingerprint.components.userAgent,received:userAgent},{field:"ipAddress",saved:savedFingerprint.components.ipAddress,received:forwardedFor}].find(({saved,received})=>saved??(received??"")!=="");if(componentMismatch)return{isValid:!1,reason:`${componentMismatch.field} mismatch`,currentFingerprint};return{isValid:!0,currentFingerprint}};var init_Validate=__esm(()=>{init_Generate()});var init_Fingerprint=__esm(()=>{init_Generate();init_Validate()});import crypto3 from"crypto";var base64UrlEncode=(data)=>{return(Buffer.isBuffer(data)?data.toString("base64"):Buffer.from(data).toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},base64UrlDecode=(data)=>{let padding="=".repeat((4-data.length%4)%4),base64=data.replace(/-/g,"+").replace(/_/g,"/")+padding;return Buffer.from(base64,"base64").toString("utf-8")},createSignature=(data,secret,algorithm)=>{let hmacAlgorithm=algorithm.replace("HS","sha"),hmac=crypto3.createHmac(hmacAlgorithm,secret);return hmac.update(data),base64UrlEncode(hmac.digest())},verifySignature=(data,signature,secret,algorithm)=>{let expectedSignature=createSignature(data,secret,algorithm),sigBuf=Buffer.from(signature),expBuf=Buffer.from(expectedSignature);if(sigBuf.length!==expBuf.length)return!1;return crypto3.timingSafeEqual(sigBuf,expBuf)},encodeHeader=(header)=>{return base64UrlEncode(JSON.stringify(header))},encodePayload=(payload)=>{return base64UrlEncode(JSON.stringify(payload))},decodeHeader=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}},decodePayload=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}};var init_utils2=()=>{};var decodeJWT=(token)=>{let parts=token.split(".");if(parts.length!==3)return null;let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return null;let header=decodeHeader(encodedHeader),payload=decodePayload(encodedPayload);if(!header||!payload)return null;return{header,payload,signature}};var init_Decode=__esm(()=>{init_utils2()});import{randomUUID}from"crypto";var signJWT=(options,secret,algorithm="HS256")=>{let header={alg:algorithm,typ:"JWT"},now=Math.floor(Date.now()/1000),payload={sub:options.subject,iat:now,...options.expiresInSeconds===null?{}:{exp:now+options.expiresInSeconds},iss:options.issuer,aud:options.audience,jti:options.jwtId||randomUUID(),sessionId:options.sessionId,...options.customClaims},encodedHeader=encodeHeader(header),encodedPayload=encodePayload(payload),dataToSign=`${encodedHeader}.${encodedPayload}`,signature=createSignature(dataToSign,secret,algorithm);return`${dataToSign}.${signature}`};var init_Sign=__esm(()=>{init_utils2()});var audienceMatches=(aud,expected)=>{if(typeof aud==="string")return aud===expected;if(Array.isArray(aud))return aud.includes(expected);return!1},verifyJWT=(token,secret,expected)=>{let parts=token.split(".");if(parts.length!==3)return{valid:!1,error:"Invalid token format: expected 3 parts"};let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return{valid:!1,error:"Invalid token format: missing parts"};let header=decodeHeader(encodedHeader);if(!header)return{valid:!1,error:"Invalid header: failed to decode"};if(header.typ!=="JWT")return{valid:!1,error:"Invalid header: typ must be JWT"};if(!["HS256","HS384","HS512"].includes(header.alg))return{valid:!1,error:`Unsupported algorithm: ${header.alg}`};let dataToVerify=`${encodedHeader}.${encodedPayload}`;if(!verifySignature(dataToVerify,signature,secret,header.alg))return{valid:!1,error:"Invalid signature"};let payload=decodePayload(encodedPayload);if(!payload)return{valid:!1,error:"Invalid payload: failed to decode"};let now=Math.floor(Date.now()/1000);if(payload.exp&&payload.exp<now)return{valid:!1,error:"Token expired"};if(payload.iat&&payload.iat>now+60)return{valid:!1,error:"Token issued in the future"};if(expected?.issuer&&payload.iss!==expected.issuer)return{valid:!1,error:"Invalid issuer"};if(expected?.audience&&!audienceMatches(payload.aud,expected.audience))return{valid:!1,error:"Invalid audience"};return{valid:!0,payload}};var init_Verify=__esm(()=>{init_utils2()});var exports_JWT={};__export(exports_JWT,{verifyJWT:()=>verifyJWT,signJWT:()=>signJWT,decodeJWT:()=>decodeJWT});var init_JWT=__esm(()=>{init_Decode();init_Sign();init_Verify()});var init_Generate2=()=>{};var init_Password=__esm(()=>{init_Generate2()});var init_Logger2=__esm(()=>{init_auditTaxonomy();init_Logger();init_ServerLogBuffer();init_transports();init_utils();init_scopes()});var DEFAULT_DAPR_HOST="127.0.0.1",DEFAULT_DAPR_PORT="3500",DEFAULT_MAX_BODY_SIZE_MB=4,DEFAULT_STATE_STORE="statestore-redis",DEFAULT_PUBSUB_NAME="pubsub-rabbitmq",DEFAULT_SECRET_STORE="secretstore",DEFAULT_CONFIG_STORE="configstore-redis",ENV_DAPR_HOST="DAPR_HOST",ENV_DAPR_HTTP_PORT="DAPR_HTTP_PORT",ENV_DAPR_HTTP_ENDPOINT="DAPR_HTTP_ENDPOINT",ENV_DAPR_GRPC_ENDPOINT="DAPR_GRPC_ENDPOINT",ENV_DAPR_API_TOKEN="DAPR_API_TOKEN",DEFAULT_OPERATION_TIMEOUT_MS=30000,DEFAULT_CONNECTION_TIMEOUT_MS=1e4,DEFAULT_HEALTH_CHECK_TIMEOUT_MS=5000,CONNECTION_STATUS,HEALTH_STATUS,ERROR_CODES;var init_constants=__esm(()=>{CONNECTION_STATUS={CONNECTED:"connected",DISCONNECTED:"disconnected",CONNECTING:"connecting",ERROR:"error"},HEALTH_STATUS={HEALTHY:"healthy",UNHEALTHY:"unhealthy"},ERROR_CODES={CONNECTION_ERROR:"DAPR_CONNECTION_ERROR",TIMEOUT_ERROR:"DAPR_TIMEOUT_ERROR",STATE_ERROR:"DAPR_STATE_ERROR",PUBSUB_ERROR:"DAPR_PUBSUB_ERROR",BINDING_ERROR:"DAPR_BINDING_ERROR",SECRET_ERROR:"DAPR_SECRET_ERROR",CONFIG_ERROR:"DAPR_CONFIG_ERROR",INVOKE_ERROR:"DAPR_INVOKE_ERROR",CRYPTO_ERROR:"DAPR_CRYPTO_ERROR",LOCK_ERROR:"DAPR_LOCK_ERROR",WORKFLOW_ERROR:"DAPR_WORKFLOW_ERROR",VALIDATION_ERROR:"DAPR_VALIDATION_ERROR"}});var DaprManagerError,createConnectionError=(message,details)=>new DaprManagerError(ERROR_CODES.CONNECTION_ERROR,message,details),createTimeoutError=(message,details)=>new DaprManagerError(ERROR_CODES.TIMEOUT_ERROR,message,details),createStateError=(message,details)=>new DaprManagerError(ERROR_CODES.STATE_ERROR,message,details),createPubSubError=(message,details)=>new DaprManagerError(ERROR_CODES.PUBSUB_ERROR,message,details),createBindingError=(message,details)=>new DaprManagerError(ERROR_CODES.BINDING_ERROR,message,details),createSecretError=(message,details)=>new DaprManagerError(ERROR_CODES.SECRET_ERROR,message,details),createConfigError=(message,details)=>new DaprManagerError(ERROR_CODES.CONFIG_ERROR,message,details),createInvokeError=(message,details)=>new DaprManagerError(ERROR_CODES.INVOKE_ERROR,message,details),createCryptoError=(message,details)=>new DaprManagerError(ERROR_CODES.CRYPTO_ERROR,message,details),createLockError=(message,details)=>new DaprManagerError(ERROR_CODES.LOCK_ERROR,message,details),createWorkflowError=(message,details)=>new DaprManagerError(ERROR_CODES.WORKFLOW_ERROR,message,details),safeExecute=async(operation,errorCreator)=>{try{return await operation()}catch(error){let errorMessage=error instanceof Error?error.message:String(error);throw errorCreator(errorMessage,error)}};var init_error_handling=__esm(()=>{init_constants();DaprManagerError=class DaprManagerError extends Error{code;details;constructor(code,message,details){super(message);this.name="DaprManagerError",this.code=code,this.details=details}toJSON(){return{code:this.code,message:this.message,details:this.details}}}});var LOG_LEVEL_PRIORITY2,createDefaultLogger=(minLevel="info")=>{let minPriority=LOG_LEVEL_PRIORITY2[minLevel],scoped=logger.scoped("dapr.client"),logWithLevel=(level)=>(message,...meta)=>{if(LOG_LEVEL_PRIORITY2[level]<minPriority)return;let context=meta.length>0?{meta}:void 0;if(level==="error")scoped.error(message,void 0,context);else scoped[level](message,context)};return{debug:logWithLevel("debug"),info:logWithLevel("info"),warn:logWithLevel("warn"),error:logWithLevel("error")}},withTimeout=async(fn,timeoutMs,errorMessage="Operation timed out")=>{return Promise.race([fn(),new Promise((_,reject)=>{setTimeout(()=>{reject(createTimeoutError(errorMessage))},timeoutMs)})])},validateRequired=(params,requiredKeys,entityName)=>{let missingKeys=requiredKeys.filter((key)=>params[key]===void 0);if(missingKeys.length>0)throw Error(`Missing required ${entityName} parameters: ${missingKeys.join(", ")}`)};var init_utils3=__esm(()=>{init_Logger2();init_constants();init_error_handling();LOG_LEVEL_PRIORITY2={debug:0,info:1,warn:2,error:3}});class DaprBindingClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(name,operation,data,options={}){return validateRequired({name,operation},["name","operation"],"binding invoke"),safeExecute(async()=>{this.logger.debug("Invoking binding",{name,operation});let response=await(await this.client()).binding.send(name,operation,data,options.metadata);return this.logger.debug("Binding invoked successfully",{name,operation}),response},(message,details)=>createBindingError(`Failed to invoke binding ${name}: ${message}`,details))}}var init_binding_client=__esm(()=>{init_error_handling();init_utils3()});class DaprConfigClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(keys,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"config get"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting configuration",{keys,storeName});let response=await(await this.client()).configuration.get(storeName,keys);return this.logger.debug("Configuration retrieved",{keys,storeName,itemCount:Object.keys(response.items||{}).length}),response.items||{}},(message,details)=>createConfigError(`Failed to get configuration: ${message}`,details))}async subscribeWithKeys(keys,callback,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,callback,storeName},["keys","callback","storeName"],"config subscribeWithKeys"),keys.length===0)throw createConfigError("At least one key must be provided for subscription");return safeExecute(async()=>{this.logger.debug("Subscribing to configuration updates",{keys,storeName});let stream=await(await this.client()).configuration.subscribeWithKeys(storeName,keys,async(data)=>{try{this.logger.debug("Received configuration update",{storeName,updatedKeys:Object.keys(data.items||{})}),await callback(data)}catch(error){this.logger.error("Error in configuration subscription callback",error)}});return this.logger.debug("Configuration subscription established",{keys,storeName}),{stop:()=>{this.logger.debug("Stopping configuration subscription",{keys,storeName}),stream.stop()}}},(message,details)=>createConfigError(`Failed to subscribe to configuration updates: ${message}`,details))}async getValue(key,storeName=DEFAULT_CONFIG_STORE){return(await this.get([key],storeName))[key]?.value}async getValues(keys,storeName=DEFAULT_CONFIG_STORE){let items=await this.get(keys,storeName),values={};for(let key in items)if(items[key]?.value!==void 0)values[key]=items[key].value;return values}}var init_config_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprCryptoClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async encrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto encrypt"),safeExecute(async()=>{this.logger.debug("Encrypting data",{componentName:options.componentName,keyName:options.keyName,keyWrapAlgorithm:options.keyWrapAlgorithm});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let encryptedData=await client.crypto.encrypt(inputData,cryptoOptions);return this.logger.debug("Data encrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:encryptedData.length}),encryptedData},(message,details)=>createCryptoError(`Failed to encrypt data: ${message}`,details))}async decrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto decrypt"),safeExecute(async()=>{this.logger.debug("Decrypting data",{componentName:options.componentName});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let decryptedData=await client.crypto.decrypt(inputData,cryptoOptions);return this.logger.debug("Data decrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:decryptedData.length}),decryptedData},(message,details)=>createCryptoError(`Failed to decrypt data: ${message}`,details))}async encryptString(plaintext,options){return(await this.encrypt(plaintext,options)).toString("base64")}async decryptString(ciphertext,options){let encryptedBuffer=Buffer.from(ciphertext,"base64");return(await this.decrypt(encryptedBuffer,options)).toString("utf-8")}}var init_crypto_client=__esm(()=>{init_error_handling();init_utils3()});function dapr(){if(!cachedDapr)cachedDapr=__require("@dapr/dapr");return cachedDapr}class DaprInvokeClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(appId,methodName,httpMethod,data,options={}){httpMethod??=dapr().HttpMethod.POST,validateRequired({appId,methodName,httpMethod},["appId","methodName","httpMethod"],"invoke service");let timeoutMs=options.timeout||DEFAULT_OPERATION_TIMEOUT_MS;return safeExecute(async()=>{this.logger.debug("Invoking service",{appId,methodName,httpMethod,hasData:data!==void 0});let fullMethodName=methodName;if(options.queryParams&&Object.keys(options.queryParams).length>0){let queryString=Object.entries(options.queryParams).map(([key,value])=>`${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");fullMethodName=`${methodName}?${queryString}`}let client=await this.client(),response=await withTimeout(()=>client.invoker.invoke(appId,fullMethodName,httpMethod,data,options.headers),timeoutMs,`Service invocation timed out after ${timeoutMs}ms`);if(this.logger.debug("Service invoked successfully",{appId,methodName,httpMethod,status:response?.status}),!response)return;if("data"in response)return response.data;return response},(message,details)=>createInvokeError(`Failed to invoke service ${appId}.${methodName}: ${message}`,details))}async get(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.GET,void 0,options)}async post(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.POST,data,options)}async put(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.PUT,data,options)}async delete(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.DELETE,void 0,options)}}var cachedDapr=null;var init_invoke_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprLockClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async lock(storeName,resourceId,lockOwner,options){return validateRequired({storeName,resourceId,lockOwner,expiryInSeconds:options.expiryInSeconds},["storeName","resourceId","lockOwner","expiryInSeconds"],"lock"),safeExecute(async()=>{this.logger.debug("Acquiring lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.lock(storeName,resourceId,lockOwner,options.expiryInSeconds);return this.logger.debug("Lock acquisition result",{storeName,resourceId,lockOwner,success:response.success}),{success:response.success}},(message,details)=>createLockError(`Failed to acquire lock for resource ${resourceId}: ${message}`,details))}async unlock(storeName,resourceId,lockOwner){return validateRequired({storeName,resourceId,lockOwner},["storeName","resourceId","lockOwner"],"unlock"),safeExecute(async()=>{this.logger.debug("Releasing lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.unlock(storeName,resourceId,lockOwner);return this.logger.debug("Lock release result",{storeName,resourceId,lockOwner,status:this.getLockStatusName(response.status)}),{status:response.status}},(message,details)=>createLockError(`Failed to release lock for resource ${resourceId}: ${message}`,details))}getLockStatusName(status){switch(status){case 0:return"Success";case 1:return"LockDoesNotExist";case 2:return"LockBelongsToOthers";default:return"InternalError"}}}var init_lock_client=__esm(()=>{init_error_handling();init_utils3()});class DaprPubSubClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async publish(topic,data,options={},pubsubName=DEFAULT_PUBSUB_NAME){return validateRequired({topic,data,pubsubName},["topic","data","pubsubName"],"pubsub publish"),safeExecute(async()=>{this.logger.debug("Publishing message to topic",{topic,pubsubName}),await(await this.client()).pubsub.publish(pubsubName,topic,data,{metadata:options.metadata,contentType:options.contentType}),this.logger.debug("Message published successfully",{topic,pubsubName})},(message,details)=>createPubSubError(`Failed to publish message to topic ${topic}: ${message}`,details))}async publishBulk(topic,messages,pubsubName=DEFAULT_PUBSUB_NAME){if(validateRequired({topic,messages,pubsubName},["topic","messages","pubsubName"],"pubsub publishBulk"),messages.length===0)return{failedEntries:[]};return safeExecute(async()=>{this.logger.debug("Publishing bulk messages to topic",{topic,pubsubName,messageCount:messages.length});let client=await this.client(),daprMessages=messages.map((msg)=>{if(typeof msg==="object"&&"event"in msg)return{entryID:msg.entryId,event:msg.event,contentType:msg.contentType,metadata:msg.metadata};return{event:msg}}),response=await client.pubsub.publishBulk(pubsubName,topic,daprMessages),failedCount=response.failedMessages?.length||0;if(failedCount>0)this.logger.warn("Some messages failed to publish",{topic,pubsubName,failedCount,totalCount:messages.length});else this.logger.debug("All bulk messages published successfully",{topic,pubsubName,messageCount:messages.length});return{failedEntries:(response.failedMessages||[]).map((failed)=>({entryId:failed.message.entryID||"",error:failed.error?.message||"Unknown error"}))}},(message,details)=>createPubSubError(`Failed to publish bulk messages to topic ${topic}: ${message}`,details))}createBulkPublishMessage(event,entryId,contentType,metadata){return{entryId,event,contentType,metadata}}}var init_pubsub_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprSecretClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(key,options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({key,storeName},["key","storeName"],"secret get"),safeExecute(async()=>{this.logger.debug("Getting secret",{key,storeName});let client=await this.client(),metadataStr=options.metadata?JSON.stringify(options.metadata):void 0,result=await client.secret.get(storeName,key,metadataStr);return this.logger.debug("Secret retrieved",{key,storeName}),result},(message,details)=>createSecretError(`Failed to get secret ${key}: ${message}`,details))}async getBulk(_options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({storeName},["storeName"],"secret getBulk"),safeExecute(async()=>{this.logger.debug("Getting all secrets",{storeName});let result=await(await this.client()).secret.getBulk(storeName);return this.logger.debug("All secrets retrieved",{storeName,secretCount:Object.keys(result).length}),result},(message,details)=>createSecretError(`Failed to get all secrets: ${message}`,details))}}var init_secret_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprStateClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async save(stateItems,options={},storeName=DEFAULT_STATE_STORE){if(validateRequired({stateItems,storeName},["stateItems","storeName"],"state save"),stateItems.length===0)return;return safeExecute(async()=>{this.logger.debug("Saving state items",{count:stateItems.length,storeName}),await(await this.client()).state.save(storeName,stateItems,options),this.logger.debug("State items saved successfully",{count:stateItems.length,storeName})},(message,details)=>createStateError(`Failed to save state items: ${message}`,details))}async get(key,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state get"),safeExecute(async()=>{this.logger.debug("Getting state item",{key,storeName});let result=await(await this.client()).state.get(storeName,key);if(this.logger.debug("State item retrieved",{key,storeName,found:result!==void 0}),result===void 0||result===null)return;if(typeof result==="string")try{return JSON.parse(result)}catch{return result}if(typeof result==="object")return result;return result},(message,details)=>createStateError(`Failed to get state item ${key}: ${message}`,details))}async getBulk(keys,storeName=DEFAULT_STATE_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"state getBulk"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting bulk state items",{count:keys.length,storeName});let results=await(await this.client()).state.getBulk(storeName,keys),resultMap={};return results.forEach((item)=>{if(item.data!==void 0)resultMap[item.key]=item.data}),this.logger.debug("Bulk state items retrieved",{count:keys.length,found:Object.keys(resultMap).length,storeName}),resultMap},(message,details)=>createStateError(`Failed to get bulk state items: ${message}`,details))}async delete(key,etag,metadata,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state delete"),safeExecute(async()=>{this.logger.debug("Deleting state item",{key,storeName});let client=await this.client(),options={};if(etag)options.etag=etag;if(metadata)options.metadata=metadata;await client.state.delete(storeName,key,options),this.logger.debug("State item deleted",{key,storeName})},(message,details)=>createStateError(`Failed to delete state item ${key}: ${message}`,details))}async transaction(operations,storeName=DEFAULT_STATE_STORE){if(validateRequired({operations,storeName},["operations","storeName"],"state transaction"),operations.length===0)return;return safeExecute(async()=>{this.logger.debug("Executing state transaction",{operationCount:operations.length,storeName});let client=await this.client(),daprOperations=operations.map((op)=>({operation:op.operation,request:{key:op.request.key,value:op.request.value,etag:op.request.etag?{value:op.request.etag}:void 0,metadata:op.request.metadata}}));await client.state.transaction(storeName,daprOperations),this.logger.debug("State transaction executed successfully",{operationCount:operations.length,storeName})},(message,details)=>createStateError(`Failed to execute state transaction: ${message}`,details))}async query(query,storeName=DEFAULT_STATE_STORE){return validateRequired({query,storeName},["query","storeName"],"state query"),safeExecute(async()=>{this.logger.debug("Querying state store",{storeName});let result=await(await this.client()).state.query(storeName,query);return this.logger.debug("State query executed",{storeName,resultCount:result.results?.length||0}),(result.results||[]).map((item)=>item.data)},(message,details)=>createStateError(`Failed to query state store: ${message}`,details))}async saveItem(key,value,options={},storeName=DEFAULT_STATE_STORE){let stateItem={key,value};return this.save([stateItem],options,storeName)}async upsert(key,value,options={},storeName=DEFAULT_STATE_STORE){return this.saveItem(key,value,options,storeName)}}var init_state_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprWorkflowClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async start(workflowName,input,options={}){return validateRequired({workflowName},["workflowName"],"workflow start"),safeExecute(async()=>{this.logger.debug("Starting workflow",{workflowName,instanceId:options.instanceId||"auto-generated",workflowComponent:options.workflowComponent});let instanceId=await(await this.client()).workflow.start(workflowName,input,options.instanceId);return this.logger.debug("Workflow started",{workflowName,instanceId}),instanceId},(message,details)=>createWorkflowError(`Failed to start workflow ${workflowName}: ${message}`,details))}async get(instanceId){return validateRequired({instanceId},["instanceId"],"workflow get"),safeExecute(async()=>{this.logger.debug("Getting workflow instance",{instanceId});let instance=await(await this.client()).workflow.get(instanceId);return this.logger.debug("Workflow instance retrieved",{instanceId,workflowName:instance.workflowName,runtimeStatus:instance.runtimeStatus}),{instanceId:instance.instanceID,workflowName:instance.workflowName,createdAt:new Date(instance.createdAt),lastUpdatedAt:new Date(instance.lastUpdatedAt),runtimeStatus:instance.runtimeStatus,properties:instance.properties||{}}},(message,details)=>createWorkflowError(`Failed to get workflow instance ${instanceId}: ${message}`,details))}async terminate(instanceId){return validateRequired({instanceId},["instanceId"],"workflow terminate"),safeExecute(async()=>{this.logger.debug("Terminating workflow instance",{instanceId}),await(await this.client()).workflow.terminate(instanceId),this.logger.debug("Workflow instance terminated",{instanceId})},(message,details)=>createWorkflowError(`Failed to terminate workflow instance ${instanceId}: ${message}`,details))}async pause(instanceId){return validateRequired({instanceId},["instanceId"],"workflow pause"),safeExecute(async()=>{this.logger.debug("Pausing workflow instance",{instanceId}),await(await this.client()).workflow.pause(instanceId),this.logger.debug("Workflow instance paused",{instanceId})},(message,details)=>createWorkflowError(`Failed to pause workflow instance ${instanceId}: ${message}`,details))}async resume(instanceId){return validateRequired({instanceId},["instanceId"],"workflow resume"),safeExecute(async()=>{this.logger.debug("Resuming workflow instance",{instanceId}),await(await this.client()).workflow.resume(instanceId),this.logger.debug("Workflow instance resumed",{instanceId})},(message,details)=>createWorkflowError(`Failed to resume workflow instance ${instanceId}: ${message}`,details))}async purge(instanceId){return validateRequired({instanceId},["instanceId"],"workflow purge"),safeExecute(async()=>{this.logger.debug("Purging workflow instance",{instanceId}),await(await this.client()).workflow.purge(instanceId),this.logger.debug("Workflow instance purged",{instanceId})},(message,details)=>createWorkflowError(`Failed to purge workflow instance ${instanceId}: ${message}`,details))}async raiseEvent(instanceId,eventName,eventData){return validateRequired({instanceId,eventName},["instanceId","eventName"],"workflow raiseEvent"),safeExecute(async()=>{this.logger.debug("Raising event for workflow instance",{instanceId,eventName}),await(await this.client()).workflow.raise(instanceId,eventName,eventData),this.logger.debug("Event raised for workflow instance",{instanceId,eventName})},(message,details)=>createWorkflowError(`Failed to raise event ${eventName} for workflow instance ${instanceId}: ${message}`,details))}}var init_workflow_client=__esm(()=>{init_error_handling();init_utils3()});function dapr2(){if(!cachedDapr2)cachedDapr2=__require("@dapr/dapr");return cachedDapr2}class DaprConnectionManager{client=null;daprHost;daprPort;communicationProtocolOption;maxBodySizeMb;daprApiToken;logger;connectionStatus=CONNECTION_STATUS.DISCONNECTED;connectionPromise=null;constructor(options={}){this.daprHost=options.daprHost||process.env[ENV_DAPR_HOST]||DEFAULT_DAPR_HOST,this.daprPort=options.daprPort||process.env[ENV_DAPR_HTTP_PORT]||DEFAULT_DAPR_PORT,this.communicationProtocolOption=options.communicationProtocol,this.maxBodySizeMb=options.maxBodySizeMb||DEFAULT_MAX_BODY_SIZE_MB,this.daprApiToken=options.daprApiToken||process.env[ENV_DAPR_API_TOKEN],this.logger=options.logger||createDefaultLogger(),this.logger.info("DaprConnectionManager initialized",{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocolOption??"default (HTTP)"})}get communicationProtocol(){return this.communicationProtocolOption??dapr2().CommunicationProtocolEnum.HTTP}async getClient(){if(!this.client||this.connectionStatus!==CONNECTION_STATUS.CONNECTED)await this.connect();if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");return this.client}async connect(){if(this.connectionPromise)return this.connectionPromise;if(this.client&&this.connectionStatus===CONNECTION_STATUS.CONNECTED)return Promise.resolve();this.connectionStatus=CONNECTION_STATUS.CONNECTING,this.connectionPromise=this.establishConnection();try{await this.connectionPromise,this.connectionStatus=CONNECTION_STATUS.CONNECTED}catch(error){throw this.connectionStatus=CONNECTION_STATUS.ERROR,error}finally{this.connectionPromise=null}}async establishConnection(){try{this.logger.info("Connecting to Dapr sidecar",{daprHost:this.daprHost,daprPort:this.daprPort,protocol:this.communicationProtocol});let protocols=dapr2().CommunicationProtocolEnum,useEndpointFromEnv=process.env[ENV_DAPR_HTTP_ENDPOINT]&&this.communicationProtocol===protocols.HTTP||process.env[ENV_DAPR_GRPC_ENDPOINT]&&this.communicationProtocol===protocols.GRPC,clientOptions={communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,logger:{level:dapr2().LogLevel.Warn}};if(!useEndpointFromEnv)clientOptions.daprHost=this.daprHost,clientOptions.daprPort=this.daprPort;if(this.daprApiToken)clientOptions.daprApiToken=this.daprApiToken;await withTimeout(async()=>{this.client=new(dapr2()).DaprClient(clientOptions)},DEFAULT_CONNECTION_TIMEOUT_MS,"Connection to Dapr sidecar timed out"),await this.healthCheck(),this.logger.info("Successfully connected to Dapr sidecar")}catch(error){throw this.logger.error("Failed to connect to Dapr sidecar",error),this.client=null,createConnectionError(`Failed to connect to Dapr sidecar at ${this.daprHost}:${this.daprPort}`,error)}}async disconnect(){if(!this.client)return;try{this.logger.info("Disconnecting from Dapr sidecar"),this.client=null,this.connectionStatus=CONNECTION_STATUS.DISCONNECTED,this.logger.info("Disconnected from Dapr sidecar")}catch(error){throw this.logger.error("Error during disconnect",error),createConnectionError("Failed to disconnect from Dapr sidecar",error)}}isConnected(){return this.client!==null&&this.connectionStatus===CONNECTION_STATUS.CONNECTED}getConnectionStatus(){return this.connectionStatus}async healthCheck(){if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");try{return await withTimeout(async()=>{if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");let response=await this.client.invoker.invoke("healthz","healthz",dapr2().HttpMethod.GET);return{status:response.status===204?HEALTH_STATUS.HEALTHY:HEALTH_STATUS.UNHEALTHY,version:response.headers?.["dapr-version"]||"unknown"}},DEFAULT_HEALTH_CHECK_TIMEOUT_MS,"Health check timed out")}catch(error){return this.logger.error("Health check failed",error),{status:HEALTH_STATUS.UNHEALTHY,version:"unknown"}}}getClientConfig(){return{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,hasApiToken:!!this.daprApiToken,connectionStatus:this.connectionStatus}}}var cachedDapr2=null;var init_connection_manager=__esm(()=>{init_constants();init_error_handling();init_utils3()});var init_types2=()=>{};class DaprManager{connectionManager;logger;_state;_pubsub;_binding;_secret;_config;_invoke;_lock;_crypto;_workflow;constructor(options={}){this.logger=options.logger||createDefaultLogger(),this.connectionManager=new DaprConnectionManager(options);let clientProvider=async()=>{return this.connectionManager.getClient()};this._state=new DaprStateClient(clientProvider,this.logger),this._pubsub=new DaprPubSubClient(clientProvider,this.logger),this._binding=new DaprBindingClient(clientProvider,this.logger),this._secret=new DaprSecretClient(clientProvider,this.logger),this._config=new DaprConfigClient(clientProvider,this.logger),this._invoke=new DaprInvokeClient(clientProvider,this.logger),this._lock=new DaprLockClient(clientProvider,this.logger),this._crypto=new DaprCryptoClient(clientProvider,this.logger),this._workflow=new DaprWorkflowClient(clientProvider,this.logger)}async connect(){await this.connectionManager.connect()}async disconnect(){await this.connectionManager.disconnect()}isConnected(){return this.connectionManager.isConnected()}getConnectionStatus(){return this.connectionManager.getConnectionStatus()}async healthCheck(){return this.connectionManager.healthCheck()}getClientConfig(){return this.connectionManager.getClientConfig()}get state(){return this._state}get pubsub(){return this._pubsub}get binding(){return this._binding}get secret(){return this._secret}get config(){return this._config}get invoke(){return this._invoke}get lock(){return this._lock}get crypto(){return this._crypto}get workflow(){return this._workflow}}function getDaprManager(){if(!daprManagerInstance)daprManagerInstance=new DaprManager;return daprManagerInstance}var daprManagerInstance=null,daprManager;var init_Dapr=__esm(()=>{init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_connection_manager();init_utils3();init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_constants();init_error_handling();init_types2();daprManager=new Proxy({},{get(_target,property,receiver){let value=Reflect.get(getDaprManager(),property,receiver);return typeof value==="function"?value.bind(getDaprManager()):value},has(_target,property){return property in getDaprManager()}})});import Redis from"ioredis";class DirectRedisStore{client;constructor(client){this.client=client}async create(key,value,ttlSeconds){try{return{success:!0,data:ttlSeconds?await this.client.set(key,JSON.stringify(value),"EX",ttlSeconds):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async read(key){try{let raw=await this.client.get(key);return{success:!0,data:raw?JSON.parse(raw):null}}catch(error){return{success:!1,error:error.message}}}async update(key,value,preserveTtl=!0){try{return{success:!0,data:preserveTtl?await this.client.set(key,JSON.stringify(value),"KEEPTTL"):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return{success:!0,data:await this.client.del(key)}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.client.exists(key)===1}}catch(error){return{success:!1,error:error.message}}}getClient(){return this.client}}class DaprRedisStore{storeName;keyPrefix;dapr;constructor(storeName,keyPrefix=""){this.storeName=storeName;this.keyPrefix=keyPrefix;this.dapr=new DaprManager}k(key){return this.keyPrefix+key}async get(key){let data=await this.dapr.state.get(this.k(key),this.storeName);return data===void 0||data===null||data===""?null:data}async create(key,value,ttlSeconds){try{let metadata=ttlSeconds?{ttlInSeconds:String(ttlSeconds)}:void 0;return await this.dapr.state.save([{key:this.k(key),value,metadata}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async read(key){try{return{success:!0,data:await this.get(key)}}catch(error){return{success:!1,error:error.message}}}async update(key,value,_preserveTtl=!0){try{return await this.dapr.state.save([{key:this.k(key),value}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return await this.dapr.state.delete(this.k(key),void 0,void 0,this.storeName),{success:!0,data:1}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.get(key)!==null}}catch(error){return{success:!1,error:error.message}}}}class RedisManager{static instance=null;store;directClient=null;useDapr;constructor(config){if(RedisManager.instance){this.store=RedisManager.instance.store,this.directClient=RedisManager.instance.directClient,this.useDapr=RedisManager.instance.useDapr;return}if(!config)throw Error("Redis config must be provided for first initialization.");assertRedisConfig(config),this.useDapr=config.withDapr??!1;let keyPrefix=config.keyPrefix||"";if(config.withDapr)this.store=new DaprRedisStore(config.stateStoreName??"statestore",keyPrefix);else{let client=config.url?new Redis(config.url,keyPrefix?{keyPrefix}:{}):new Redis({host:config.host,port:config.port,...config.password?{password:config.password}:{},...config.username?{username:config.username}:{},...config.tls?{tls:{}}:{},...keyPrefix?{keyPrefix}:{}});this.directClient=client,this.store=new DirectRedisStore(client)}RedisManager.instance=this}static async reset(){let current=RedisManager.instance;if(RedisManager.instance=null,!current?.directClient)return;try{await current.directClient.quit()}catch{}}async create(key,value,ttlSeconds){return this.store.create(key,value,ttlSeconds)}async read(key){return this.store.read(key)}async update(key,value,preserveTtl=!0){return this.store.update(key,value,preserveTtl)}async remove(key){return this.store.remove(key)}async exists(key){return this.store.exists(key)}async readCounters(keys){return(await Promise.all(keys.map((k)=>this.read(k)))).map((r)=>{let v=r.success?r.data:null,n=typeof v==="number"?v:Number.parseFloat(String(v??""));return Number.isFinite(n)?n:0})}async incrementCounter(key,delta,ttlSeconds){if(!this.useDapr&&this.directClient){let v=await this.directClient.incrbyfloat(key,delta);if(ttlSeconds&&ttlSeconds>0)try{await this.directClient.expire(key,ttlSeconds)}catch{}return Number(v)}let cur=await this.read(key),raw=cur.success?cur.data:null,base=typeof raw==="number"?raw:Number.parseFloat(String(raw??"")),next=(Number.isFinite(base)?base:0)+delta;return await this.create(key,next,ttlSeconds),next}getDirectClient(){return this.directClient}async reauthenticate(username,password){if(this.directClient)await this.directClient.auth(username,password)}async keys(pattern){if(this.useDapr||!this.directClient)return logger.scoped("database.redis").warn("keys() not supported in Dapr mode",{pattern}),[];try{return await this.directClient.keys(pattern)}catch(error){return logger.scoped("database.redis").error("keys() failed",error,{pattern}),[]}}async acquireLock(lockKey,ttlSeconds=10){if(this.useDapr||!this.directClient){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(existsResult.data)return{success:!0,data:!1};if((await this.create(lockKey,"1",ttlSeconds)).success)return{success:!0,data:!0};return{success:!1,error:"Failed to acquire lock"}}try{return{success:!0,data:await this.directClient.set(lockKey,"1","EX",ttlSeconds,"NX")==="OK"}}catch(error){return{success:!1,error:error.message}}}async releaseLock(lockKey){return this.remove(lockKey)}async waitForLock(lockKey,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(!existsResult.data)return{success:!0,data:!0};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:!1}}async getOrWait(key,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let readResult=await this.read(key);if(!readResult.success)return{success:!1,error:readResult.error};if(readResult.data!==null)return{success:!0,data:readResult.data};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:null}}}var assertRedisConfig=(config)=>{if(!config)throw Error("Redis config must be provided.");if(config.withDapr){if(!config.stateStoreName)throw Error("Dapr mode requires stateStoreName.");return}let hasUrl=Boolean(config.url),hasHostPort=Boolean(config.host)&&typeof config.port==="number";if(!hasUrl&&!hasHostPort)throw Error("Redis config requires either url or host and port.")};var init_Redis=__esm(()=>{init_Logger2();init_Dapr()});var init_Delete=__esm(()=>{init_Redis()});var init_Generate3=__esm(()=>{init_Redis();init_JWT()});var init_Read=__esm(()=>{init_Redis();init_JWT();init_Delete()});var init_Validate2=__esm(()=>{init_Read()});var init_RefreshToken=__esm(()=>{init_Delete();init_Generate3();init_Read();init_Validate2()});var DEFAULT_EXPIRY_SECONDS=86400,buildSessionKey=(sessionId)=>`session:${sessionId}`,buildRefreshChainKey=(sessionId)=>`refresh-chain:${sessionId}`,serializeSession=(record)=>JSON.stringify(record),deserializeSession=(data)=>{if(!data)return null;if(typeof data==="object")return data;try{return JSON.parse(data)}catch{return null}};var deleteSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),removeResult=await manager.remove(key);return await manager.remove(buildRefreshChainKey(options.sessionId)).catch(()=>{return}),removeResult.success&&removeResult.data>0},forgetSessionsInRedis=async(sessionIds)=>{for(let id of sessionIds){if(!id)continue;try{await deleteSession({sessionId:String(id)})}catch{}}};var init_Delete2=__esm(()=>{init_Redis()});import crypto4 from"crypto";var generateSession=async(options)=>{let manager=new RedisManager,sessionId=options.sessionId??crypto4.randomUUID(),now=Date.now(),nowIso=new Date(now).toISOString(),never=options.expiresInSeconds===null,ttlSeconds=never?void 0:options.expiresInSeconds??DEFAULT_EXPIRY_SECONDS,record={id:sessionId,userId:options.userId,createdAt:nowIso,expiresAt:never?null:new Date(now+ttlSeconds*1000).toISOString(),lastActiveAt:nowIso,clientMeta:options.clientMeta,fingerprintHash:options.fingerprintHash,deviceInfo:options.deviceInfo,refreshTokenHash:options.refreshTokenHash,loginMethod:options.loginMethod,rememberMe:options.rememberMe},writeResult=await manager.create(buildSessionKey(sessionId),serializeSession(record),ttlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:record}};var init_Generate4=__esm(()=>{init_Redis()});var init_Issue=__esm(()=>{init_JWT();init_Generate3();init_Delete2();init_Generate4()});var init_Session=__esm(()=>{init_Issue()});var lookupSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),readResult=await manager.read(key);if(!readResult.success)return{state:"unavailable",error:readResult.error??"session store read failed"};if(!readResult.data)return{state:"missing"};let record=deserializeSession(readResult.data);if(!record)return{state:"missing"};if(record.expiresAt&&new Date(record.expiresAt).getTime()<=Date.now())return await deleteSession({sessionId:options.sessionId}),{state:"missing"};return{state:"found",record}},readSession=async(options)=>{let lookup=await lookupSession(options);return lookup.state==="found"?lookup.record:null};var init_Read2=__esm(()=>{init_Redis();init_Delete2()});var updateSession=async(options)=>{let existing=await readSession({sessionId:options.sessionId});if(!existing)return{success:!1,error:"Session not found"};let updated={...existing,...options.updates,lastActiveAt:options.updates.lastActiveAt??new Date().toISOString()},manager=new RedisManager,remainingTtlSeconds=updated.expiresAt?Math.max(60,Math.ceil((new Date(updated.expiresAt).getTime()-Date.now())/1000)):void 0,writeResult=await manager.create(buildSessionKey(options.sessionId),serializeSession(updated),remainingTtlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:updated}},updateLastActiveAt=async(sessionId)=>{return updateSession({sessionId,updates:{lastActiveAt:new Date().toISOString()}})};var init_Update=__esm(()=>{init_Redis();init_Read2()});var validateSession=async(options)=>{let jwtResult=verifyJWT(options.jwtToken,options.jwtSecret);if(!jwtResult.valid)return{isValid:!1,reason:jwtResult.error};let session=await readSession({sessionId:options.sessionId});if(!session)return{isValid:!1,reason:"Session not found"};let fingerprintValid;if(options.savedFingerprint&&options.headers&&options.requestIp){let sanitizedHeaders={};for(let[key,value]of Object.entries(options.headers))if(value!==void 0)sanitizedHeaders[key]=value;let fingerprintResult=validateDeviceFingerprint({savedFingerprint:options.savedFingerprint,headers:sanitizedHeaders,requestIp:options.requestIp});if(fingerprintValid=fingerprintResult.isValid,!fingerprintResult.isValid)return{isValid:!1,reason:fingerprintResult.reason??"Fingerprint mismatch"}}return{isValid:!0,context:{userId:session.userId,sessionId:session.id,fingerprintValid}}};var init_Validate3=__esm(()=>{init_Validate();init_JWT();init_Read2()});var exports_SessionStore={};__export(exports_SessionStore,{validateSession:()=>validateSession,updateSession:()=>updateSession,updateLastActiveAt:()=>updateLastActiveAt,readSession:()=>readSession,lookupSession:()=>lookupSession,generateSession:()=>generateSession,forgetSessionsInRedis:()=>forgetSessionsInRedis,deleteSession:()=>deleteSession});var init_SessionStore=__esm(()=>{init_Delete2();init_Generate4();init_Read2();init_Update();init_Validate3()});var init_Auth=__esm(()=>{init_Fingerprint();init_JWT();init_Password();init_RefreshToken();init_Session();init_SessionStore()});import{eq}from"drizzle-orm";function buildClaimAction(method,entity,field,relation,relationField,isBulk){let parts=[method.toLowerCase()];if(isBulk)parts.push("bulk");if(parts.push(entity),relation){if(parts.push("with"),parts.push(relation),relationField)parts.push(relationField)}else if(field)parts.push(field);return parts.join(".")}function buildClaimPath(entity,isBulk,hasId){if(isBulk)return`/${entity}/bulk`;if(hasId)return`/${entity}/:id`;return`/${entity}`}function generateEntityClaims(entity,config,schemaRelations){let claims=[],tableName=entity.table_name,excludedMethods=entity.excluded_methods||[];for(let method of HTTP_METHODS){if(excludedMethods.includes(method))continue;let needsId=method==="PUT"||method==="PATCH"||method==="DELETE";if(claims.push({action:buildClaimAction(method,tableName),description:`${method} access to ${tableName}`,path:buildClaimPath(tableName,!1,needsId&&method!=="DELETE"),method}),method==="GET"&&entity.columns){for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName),method})}let relationKey=`${tableName.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}Relations`;if(schemaRelations[relationKey]){let relationConfig=schemaRelations[relationKey];if(relationConfig?.config?.referencedTable?._?.name){let relationName=relationConfig.config.referencedTable._.name;claims.push({action:buildClaimAction(method,tableName,void 0,relationName),description:`${method} access to ${tableName} with ${relationName}`,path:buildClaimPath(tableName),method})}}}if(method==="POST"||method==="PUT"||method==="PATCH"){if(entity.columns)for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName,!1,method!=="POST"),method})}}}if(entity.bulk_endpoints_enabled===!0)for(let method of BULK_METHODS){if(excludedMethods.includes(method))continue;claims.push({action:buildClaimAction(method,tableName,void 0,void 0,void 0,!0),description:`Bulk ${method} access to ${tableName}`,path:buildClaimPath(tableName,!0),method})}return claims}async function seedClaims(db,schemaTables,schemaRelations,entities,config,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return logger2.warn("[Authorization] Claims table not found in schema"),{total:0,created:0,existing:0,claims:[]};let allClaims=[];for(let entity of entities){if(config.skipTables.includes(entity.table_name))continue;let entityClaims=generateEntityClaims(entity,config,schemaRelations);allClaims.push(...entityClaims)}let uniqueClaims=allClaims.filter((claim,index,self2)=>index===self2.findIndex((c)=>c.action===claim.action)),created=0,existing=0,claimActions=[];for(let claim of uniqueClaims)try{if((await db.select().from(claimsTable).where(eq(claimsTable.action,claim.action)).limit(1)).length===0)await db.insert(claimsTable).values(claim),created++,claimActions.push(claim.action),logger2.debug(`[Authorization] Created claim: ${claim.action}`);else existing++}catch(error){logger2.error(`[Authorization] Failed to create claim: ${claim.action}`,error)}return logger2.info(`[Authorization] Claims seeded: ${created} created, ${existing} existing, ${uniqueClaims.length} total`),{total:uniqueClaims.length,created,existing,claims:claimActions}}var HTTP_METHODS,BULK_METHODS;var init_ClaimSeeder=__esm(()=>{HTTP_METHODS=["GET","POST","PUT","PATCH","DELETE"],BULK_METHODS=["POST","PUT","DELETE"]});function parseStoredJson(stored){if(stored===null||stored===void 0)return null;if(typeof stored==="object")return stored;if(typeof stored==="string"){if(stored.length===0)return null;try{return JSON.parse(stored)}catch{return null}}if(typeof stored==="number"||typeof stored==="boolean")return stored;return null}import{and,eq as eq2,isNull,or}from"drizzle-orm";function activeRowsPredicate(table){let column=table?.isActive;if(!column)return;return or(isNull(column),eq2(column,!0))}function activeGrantPredicate(tables){return and(activeRowsPredicate(tables.userRoles),activeRowsPredicate(tables.roleClaims),activeRowsPredicate(tables.claims))}var init_activeRows=()=>{};var exports_ClaimsCache={};__export(exports_ClaimsCache,{ClaimsCache:()=>ClaimsCache});import{and as and2,eq as eq3}from"drizzle-orm";class ClaimsCache{prefix;redis;db;schemaTables;logger;constructor(config){this.prefix=config.prefix||DEFAULT_PREFIX,this.redis=config.redis,this.db=config.db,this.schemaTables=config.schemaTables,this.logger=config.logger}key(suffix){return`${this.prefix}:${suffix}`}async buildCache(){let rolesTable=this.schemaTables.roles,roleClaimsTable=this.schemaTables.roleClaims,claimsTable=this.schemaTables.claims;if(!rolesTable||!roleClaimsTable||!claimsTable)return this.logger.warn("[ClaimsCache] Required tables not found, skipping cache build"),{version:0,roleCount:0,totalMappings:0};let allRoles=await this.db.select().from(rolesTable),roleNames=[],totalMappings=0;for(let role of allRoles){let r=role,roleId=r.id,roleName=r.name;roleNames.push(roleName);let roleClaimRows=await this.db.select().from(roleClaimsTable).innerJoin(claimsTable,eq3(roleClaimsTable.claimId,claimsTable.id)).where(and2(eq3(roleClaimsTable.roleId,roleId),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable}))),claimActions=[];for(let row of roleClaimRows){let action=row.claims?.action;if(action)claimActions.push(action)}await this.redis.set(this.key(`role:${roleName}`),JSON.stringify(claimActions)),totalMappings+=claimActions.length}await this.redis.set(this.key("roles"),JSON.stringify(roleNames));let newVersion=storedVersionNumber(await this.redis.get(this.key("version")))+1;return await this.redis.set(this.key("version"),String(newVersion)),this.logger.info("[ClaimsCache] Cache built",{version:newVersion,roleCount:roleNames.length,totalMappings}),{version:newVersion,roleCount:roleNames.length,totalMappings}}async getVersion(){return storedVersionNumber(await this.redis.get(this.key("version")))}async resolveClaimsForRoles(roleNames){let allClaims=new Set;for(let roleName of roleNames){let claims=parseStoredJson(await this.redis.get(this.key(`role:${roleName}`)));if(Array.isArray(claims))for(let c of claims)allClaims.add(c);else if(claims!==null)this.logger.warn("[ClaimsCache] Cached role entry unreadable, ignoring",{roleName})}return Array.from(allClaims)}async invalidate(){return(await this.buildCache()).version}getPrefix(){return this.prefix}}var DEFAULT_PREFIX="nucleus:claims",storedVersionNumber=(stored)=>{let value=parseStoredJson(stored),parsed=typeof value==="number"?value:Number.parseInt(String(value??""),10);return Number.isFinite(parsed)?parsed:0};var init_ClaimsCache=__esm(()=>{init_activeRows()});var DEFAULT_AUTHORIZATION_CONFIG,AUTHORIZATION_TABLE_KEYS,GODMIN_ROLE_NAME="godmin";var init_types3=__esm(()=>{DEFAULT_AUTHORIZATION_CONFIG={enabled:!1,autoSeedClaims:!0,skipTables:["audit_logs"],skipColumns:["id","created_at","updated_at","is_active","password","version"],excludedPaths:[],publicPaths:["/auth/login","/auth/register"]},AUTHORIZATION_TABLE_KEYS={users:"users",roles:"roles",claims:"claims",userRoles:"userRoles",roleClaims:"roleClaims"}});var{password}=globalThis.Bun;import{and as and3,eq as eq4}from"drizzle-orm";async function setupGodmin(db,schemaTables,config,logger2){if(!config.godminEmail||!config.godminPassword)return logger2.warn("[Authorization] Godmin email or password not configured, skipping godmin setup"),{success:!1};let{roles:rolesTable,users:usersTable,userRoles:userRolesTable}=schemaTables;if(!rolesTable||!usersTable||!userRolesTable)return logger2.error("[Authorization] Required tables not found for godmin setup"),{success:!1};try{let roleId,existingRole=await db.select().from(rolesTable).where(eq4(rolesTable.name,GODMIN_ROLE_NAME)).limit(1);if(existingRole.length===0){let[newRole]=await db.insert(rolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();roleId=newRole.id,logger2.info(`[Authorization] Created godmin role: ${roleId}`)}else roleId=existingRole[0].id,logger2.debug(`[Authorization] Godmin role already exists: ${roleId}`);let userId,existingUser=await db.select().from(usersTable).where(eq4(usersTable.email,config.godminEmail)).limit(1);if(existingUser.length===0){let hashedPassword=await password.hash(config.godminPassword,{algorithm:"bcrypt",cost:10}),[newUser]=await db.insert(usersTable).values({email:config.godminEmail,password:hashedPassword,verifiedAt:new Date,isActive:!0,isGod:!0}).returning();userId=newUser.id,logger2.info(`[Authorization] Created godmin user: ${userId}`)}else{if(userId=existingUser[0].id,!existingUser[0].isGod)await db.update(usersTable).set({isGod:!0}).where(eq4(usersTable.id,userId)),logger2.info(`[Authorization] Marked existing godmin user as isGod=true: ${userId}`);logger2.debug(`[Authorization] Godmin user already exists: ${userId}`)}if(!((await db.select().from(userRolesTable).where(and3(eq4(userRolesTable.userId,userId),eq4(userRolesTable.roleId,roleId))).limit(1)).length>0))await db.insert(userRolesTable).values({userId,roleId}),logger2.info(`[Authorization] Assigned godmin role to user: ${userId}`);return{success:!0,userId,roleId}}catch(error){return logger2.error("[Authorization] Failed to setup godmin",error),{success:!1}}}function isGodminRole(roleName){return roleName===GODMIN_ROLE_NAME}var init_GodminSetup=__esm(()=>{init_types3()});import{and as and4,eq as eq5,inArray,sql}from"drizzle-orm";function isSelfReference(value){return value.startsWith(SELF_PREFIX)}function parseSelfReference(value){return{field:value.slice(SELF_PREFIX.length)}}function parseScopeWithSelf(scope){if(!scope)return{};let params=new URLSearchParams(scope),result={};for(let[key,value]of params.entries())if(isSelfReference(value))result[key]=parseSelfReference(value);else result[key]=value;return result}function resolveScopeWithSelf(parsedScope,userData,logger2){let resolved={},unresolved=[];for(let[key,value]of Object.entries(parsedScope))if(typeof value==="object"&&"field"in value){if(!userData){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - userData not provided`),unresolved.push(key);continue}let lookup=lookupUserDataField(userData,value.field);if(!lookup.found){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - field not found in userData`),unresolved.push(key);continue}resolved[key]=lookup.value,logger2.debug(`[Authorization] Resolved self:${value.field} -> ${String(lookup.value)}`)}else resolved[key]=value;return{resolved,unresolved}}function resolveClaimScopes(rows,userData,logger2){let claimScopes={},dropped=new Set,unrestricted=new Set;for(let{action,scope}of rows){if(!scope){unrestricted.add(action);continue}if(!scope.includes("="))continue;let parsed=parseScopeWithSelf(scope),{resolved,unresolved}=resolveScopeWithSelf(parsed,userData,logger2);if(unresolved.length>0){dropped.add(action);continue}claimScopes[action]={...claimScopes[action]??{},...resolved}}for(let a of unrestricted)delete claimScopes[a],dropped.delete(a);for(let a of dropped)delete claimScopes[a];return{claimScopes,dropped:Array.from(dropped)}}function mergeGrantingScopes(grantingActions,claimScopes){if(!claimScopes)return;let merged={},any=!1;for(let action of grantingActions){let s=claimScopes[action];if(!s||Object.keys(s).length===0)return;Object.assign(merged,s),any=!0}return any?merged:void 0}function buildClaimPattern(method,entity,field,relation){let parts=[method.toLowerCase(),entity];if(relation)parts.push("with",relation);else if(field)parts.push(field);return parts.join(".")}function claimMatches(userClaim,requiredPattern,requireSpecificity=!1){if(userClaim===requiredPattern)return!0;let userParts=userClaim.split("."),requiredParts=requiredPattern.split(".");if(userParts.length>requiredParts.length)return!1;if(requireSpecificity&&userParts.length<2&&requiredParts.length>=2)return!1;for(let i=0;i<userParts.length;i++)if(userParts[i]!==requiredParts[i])return!1;return!0}async function checkAuthorization(params){let{userId,method,entity,requestedFields,requestedRelations,db,schemaTables,logger:logger2,getUserData}=params,reqSpec=params.requireClaimSpecificity??!1,ceiling=params.claimCeiling?new Set(params.claimCeiling):void 0,userData=params.userData,ensureUserData=async()=>{if(userData!==void 0)return;if(getUserData)try{userData=await getUserData()}catch(err){logger2.warn("[Authorization] getUserData callback failed",{userId,error:err instanceof Error?err.message:String(err)})}},rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles],userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],roleClaimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roleClaims],claimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.claims];if(!rolesTable||!userRolesTable||!roleClaimsTable||!claimsTable)return logger2.error("[Authorization] Required tables not found"),{authorized:!1,reason:"Authorization tables not configured"};try{let userRolesCols=userRolesTable,rolesCols=rolesTable,userRoles=await db.select({roleId:userRolesCols.roleId,roleName:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq5(userRolesCols.roleId,rolesCols.id)).where(and4(eq5(userRolesCols.userId,userId),activeGrantPredicate({userRoles:userRolesTable})));if(userRoles.length===0)return{authorized:!1,reason:"User has no roles assigned"};if(userRoles.some((ur)=>isGodminRole(ur.roleName))&&!ceiling)return logger2.debug(`[Authorization] User ${userId} has godmin role, bypassing checks`),{authorized:!0};let roleIds=userRoles.map((ur)=>ur.roleId),roleClaimsCols=roleClaimsTable,claimsCols=claimsTable,ownerGrants=await db.select({claimAction:claimsCols.action,scope:roleClaimsCols.scope}).from(roleClaimsTable).innerJoin(claimsTable,eq5(roleClaimsCols.claimId,claimsCols.id)).where(and4(inArray(roleClaimsCols.roleId,roleIds),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable})));if(ownerGrants.length===0)return{authorized:!1,reason:"User roles have no claims assigned"};let roleClaims=ceiling?ownerGrants.filter((rc)=>ceiling.has(rc.claimAction)):ownerGrants;if(roleClaims.length===0)return{authorized:!1,reason:"API key carries none of its owner's claims"};let entityClaimPattern=buildClaimPattern(method,entity),hasEntityAccess=roleClaims.some((rc)=>claimMatches(rc.claimAction,entityClaimPattern,reqSpec)),allowedFields=[],allowedRelations=[],scopeFilters={},unresolvedSelf=[],fieldPatterns=(requestedFields??[]).map((field)=>({field,pattern:buildClaimPattern(method,entity,field)})),relationPatterns=(requestedRelations??[]).map((relation)=>({relation,pattern:buildClaimPattern(method,entity,void 0,relation)})),claimCouldGrant=(action)=>claimMatches(action,entityClaimPattern,reqSpec)||fieldPatterns.some((f)=>claimMatches(action,f.pattern,reqSpec))||relationPatterns.some((r)=>claimMatches(action,r.pattern,reqSpec));if(roleClaims.some((rc)=>{let scope=rc.scope;return!!scope&&scope.includes("self:")&&claimCouldGrant(rc.claimAction)}))await ensureUserData();let applyClaimScope=(rc)=>{let parsedScope=parseScopeWithSelf(rc.scope),{resolved,unresolved}=resolveScopeWithSelf(parsedScope,userData,logger2);Object.assign(scopeFilters,resolved),unresolvedSelf.push(...unresolved)},denyOnUnresolvedSelf=()=>{if(unresolvedSelf.length===0)return null;return logger2.warn("[Authorization] Denying request: unresolvable self: scope (failing closed)",{userId,method,entity,unresolved:unresolvedSelf}),{authorized:!1,reason:"Ownership scope could not be resolved"}};if(hasEntityAccess){let unrestricted=!1;for(let rc of roleClaims){if(!claimMatches(rc.claimAction,entityClaimPattern,reqSpec))continue;if(!rc.scope){unrestricted=!0;continue}applyClaimScope(rc)}if(unrestricted)return{authorized:!0};let denied=denyOnUnresolvedSelf();if(denied)return denied;return{authorized:!0,scopeFilters:Object.keys(scopeFilters).length>0?scopeFilters:void 0}}let unrestrictedField=!1;for(let{field,pattern}of fieldPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedFields.push(field),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}for(let{relation,pattern}of relationPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedRelations.push(relation),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}if(!unrestrictedField){let denied=denyOnUnresolvedSelf();if(denied)return denied}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,scopeFilters:!unrestrictedField&&Object.keys(scopeFilters).length>0?scopeFilters:void 0}}catch(error){return logger2.error("[Authorization] Check failed",error),{authorized:!1,reason:"Authorization check failed"}}}function checkAuthorizationFromJWT(params){let{userClaims,userRoles,method,entity,requestedFields,requestedRelations,logger:logger2}=params,reqSpec=params.requireClaimSpecificity??!1,claimScopes=params.claimScopes;if(userClaims.length===0&&userRoles.length===0)return{authorized:!1,reason:"No roles or claims in token"};if(userRoles.some((r)=>isGodminRole(r)))return logger2.debug("[Authorization:JWT] User has godmin role, bypassing checks"),{authorized:!0};let entityClaimPattern=buildClaimPattern(method,entity),entityGranting=userClaims.filter((c)=>claimMatches(c,entityClaimPattern,reqSpec));if(entityGranting.length>0){let scopeFilters2=mergeGrantingScopes(entityGranting,claimScopes);return{authorized:!0,...scopeFilters2?{scopeFilters:scopeFilters2}:{}}}let allowedFields=[],allowedRelations=[],grantingActions=[];if(requestedFields)for(let field of requestedFields){let fieldPattern=buildClaimPattern(method,entity,field),granting=userClaims.filter((c)=>claimMatches(c,fieldPattern,reqSpec));if(granting.length>0)allowedFields.push(field),grantingActions.push(...granting)}if(requestedRelations)for(let relation of requestedRelations){let relationPattern=buildClaimPattern(method,entity,void 0,relation),granting=userClaims.filter((c)=>claimMatches(c,relationPattern,reqSpec));if(granting.length>0)allowedRelations.push(relation),grantingActions.push(...granting)}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};let scopeFilters=mergeGrantingScopes(grantingActions,claimScopes);return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,...scopeFilters?{scopeFilters}:{}}}async function checkAuthorizationViaIDP(params){let{idpUrl,accessToken,method,entity,requestedFields,requestedRelations,logger:logger2}=params;try{let response=await fetch(`${idpUrl}/auth/check`,{method:"POST",headers:{"Content-Type":"application/json",Cookie:`access_token=${accessToken}`},body:JSON.stringify({entity,method,fields:requestedFields,relations:requestedRelations})});if(!response.ok)return logger2.warn(`[Authorization:IDP] IDP /auth/check returned ${response.status}`),{authorized:!1,reason:`IDP authorization check failed (${response.status})`};let payload=await response.json();return unwrapIdpCheckResponse(payload)}catch(error){let msg=error instanceof Error?error.message:String(error);return logger2.error(`[Authorization:IDP] Failed to reach IDP: ${msg}`),{authorized:!1,reason:"IDP authorization service unavailable"}}}function filterResponseFields(data,allowedFields){if(!allowedFields||allowedFields.length===0)return data;let fieldsToInclude=[...new Set([...["id"],...allowedFields])],toCamel=(value)=>value.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase()),allowedKeys=new Set;for(let field of fieldsToInclude)allowedKeys.add(field),allowedKeys.add(toCamel(field));let filterSingle=(item)=>{let filtered={};for(let key of Object.keys(item))if(allowedKeys.has(key))filtered[key]=item[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function filterResponseRelations(data,allowedRelations){if(!allowedRelations)return data;let filterSingle=(item)=>{let filtered={...item};for(let key of Object.keys(filtered))if(typeof filtered[key]==="object"&&filtered[key]!==null&&!allowedRelations.includes(key))delete filtered[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function buildScopeConditions(scopeFilters,resolveColumn){let conditions=[],unresolvedFields=[];if(!scopeFilters)return{conditions,unresolvedFields};for(let[field,value]of Object.entries(scopeFilters)){let col=resolveColumn(field);if(col)conditions.push(eq5(col,value));else unresolvedFields.push(field),conditions.push(sql`1 = 0`)}return{conditions,unresolvedFields}}var SELF_PREFIX="self:",toCamelCase2=(value)=>value.replace(/_([a-z])/g,(_,c)=>c.toUpperCase()),toSnakeCase=(value)=>value.replace(/([A-Z])/g,(_,c)=>`_${c.toLowerCase()}`),lookupUserDataField=(userData,fieldName)=>{if(fieldName in userData)return{found:!0,value:userData[fieldName]};let camel=toCamelCase2(fieldName);if(camel!==fieldName&&camel in userData)return{found:!0,value:userData[camel]};let snake=toSnakeCase(fieldName);if(snake!==fieldName&&snake in userData)return{found:!0,value:userData[snake]};return{found:!1}},unwrapIdpCheckResponse=(payload)=>{if(!payload||typeof payload!=="object")return{authorized:!1,reason:"IDP returned malformed response"};let envelope=payload;if(envelope.data&&typeof envelope.data==="object"){let data=envelope.data;if(typeof data.authorized==="boolean")return data}let flat=payload;if(typeof flat.authorized==="boolean")return flat;return{authorized:!1,reason:"IDP returned unrecognised response shape"}};var init_Middleware=__esm(()=>{init_activeRows();init_GodminSetup();init_types3()});var exports_SeedRunner={};__export(exports_SeedRunner,{runSeed:()=>runSeed,expandClaimPatterns:()=>expandClaimPatterns});import{and as and5,eq as eq6}from"drizzle-orm";function expandClaimPatterns(patterns,allActions){let out=new Set;for(let pattern of patterns)if(pattern.endsWith(".*")){let prefix=pattern.slice(0,-2);for(let action of allActions)if(action===prefix||action.startsWith(`${prefix}.`))out.add(action)}else out.add(pattern);return[...out]}async function runSeed(db,schemaTables,seedConfig,logger2){let{roles:rolesTable,claims:claimsTable,roleClaims:roleClaimsTable}=schemaTables,result={rolesCreated:0,rolesExisting:0,claimsCreated:0,claimsExisting:0,assignmentsCreated:0,assignmentsExisting:0,assignmentsUpdated:0};if(seedConfig.roles?.length&&rolesTable)for(let roleDef of seedConfig.roles)try{if((await db.select().from(rolesTable).where(eq6(rolesTable.name,roleDef.name)).limit(1)).length===0)await db.insert(rolesTable).values({name:roleDef.name,description:roleDef.description||""}),result.rolesCreated++,logger2.info(`[Seed] Created role: ${roleDef.name}`);else result.rolesExisting++}catch(error){logger2.error(`[Seed] Failed to seed role: ${roleDef.name}`,error)}if(seedConfig.claims?.length&&claimsTable)for(let claimDef of seedConfig.claims)try{let existing=await db.select().from(claimsTable).where(eq6(claimsTable.action,claimDef.action)).limit(1);if(existing.length===0)await db.insert(claimsTable).values({action:claimDef.action,path:claimDef.path,method:claimDef.method,description:claimDef.description||`${claimDef.method} ${claimDef.path}`,...claimDef.policy!==void 0?{policy:claimDef.policy}:{}}),result.claimsCreated++,logger2.info(`[Seed] Created claim: ${claimDef.action}`);else if(claimDef.policy!==void 0){let existingRow=existing[0],currentPolicy=JSON.stringify(existingRow.policy??null),desiredPolicy=JSON.stringify(claimDef.policy??null);if(currentPolicy!==desiredPolicy)await db.update(claimsTable).set({policy:claimDef.policy}).where(eq6(claimsTable.action,claimDef.action)),result.claimsExisting++,logger2.warn(`[Seed] Reconciled policy for claim: ${claimDef.action}`);else result.claimsExisting++}else result.claimsExisting++}catch(error){logger2.error(`[Seed] Failed to seed claim: ${claimDef.action}`,error)}if(seedConfig.roleClaimAssignments?.length&&rolesTable&&claimsTable&&roleClaimsTable){let allClaimActions=(await db.select().from(claimsTable)).map((c)=>String(c.action??""));for(let assignment of seedConfig.roleClaimAssignments){let role=(await db.select().from(rolesTable).where(eq6(rolesTable.name,assignment.role)).limit(1))[0];if(!role){logger2.warn(`[Seed] Role not found for assignment: ${assignment.role}`);continue}let roleId=role.id,resolvedActions=expandClaimPatterns(assignment.claims,allClaimActions);for(let pattern of assignment.claims)if(pattern.endsWith(".*")&&!resolvedActions.some((a)=>a.startsWith(pattern.slice(0,-1))))logger2.warn(`[Seed] No claim matched prefix pattern: ${pattern}`);for(let claimAction of resolvedActions)try{let claim=(await db.select().from(claimsTable).where(eq6(claimsTable.action,claimAction)).limit(1))[0];if(!claim){logger2.warn(`[Seed] Claim not found for assignment: ${claimAction}`);continue}let claimId=claim.id,existingAssignment=await db.select().from(roleClaimsTable).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))).limit(1);if(existingAssignment.length===0)await db.insert(roleClaimsTable).values({roleId,claimId,scope:assignment.scope||null}),result.assignmentsCreated++;else{let existingRow=existingAssignment[0],desiredScope=assignment.scope||null,currentScope=existingRow.scope??null;if(currentScope!==desiredScope)await db.update(roleClaimsTable).set({scope:desiredScope}).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))),result.assignmentsUpdated++,logger2.warn(`[Seed] Reconciled scope for ${assignment.role} -> ${claimAction}: ${JSON.stringify(currentScope)} => ${JSON.stringify(desiredScope)}`);else result.assignmentsExisting++}}catch(error){logger2.error(`[Seed] Failed to assign claim ${claimAction} to role ${assignment.role}`,error)}if(result.assignmentsCreated>0)logger2.info(`[Seed] Role "${assignment.role}": assigned ${result.assignmentsCreated} claims`)}}return result}var init_SeedRunner=()=>{};var init_Authorization=__esm(()=>{init_ClaimSeeder();init_ClaimsCache();init_GodminSetup();init_Middleware();init_SeedRunner();init_types3()});function parseField(raw,spec){let out=new Set;for(let part of raw.split(",")){if(part==="")return null;let[rangePart,stepPart,...extra]=part.split("/");if(extra.length>0||rangePart===void 0)return null;let step=1;if(stepPart!==void 0){if(!/^\d+$/.test(stepPart))return null;if(step=Number.parseInt(stepPart,10),step<1)return null}let from,to;if(rangePart==="*")from=spec.min,to=spec.max;else if(rangePart.includes("-")){let[a,b,...rest]=rangePart.split("-");if(rest.length>0||!isIntInRange(a,spec)||!isIntInRange(b,spec))return null;if(from=namedToNumber(a,spec),to=namedToNumber(b,spec),from>to)return null}else{if(!isIntInRange(rangePart,spec))return null;from=namedToNumber(rangePart,spec),to=stepPart===void 0?from:spec.max}for(let v=from;v<=to;v+=step)out.add(v)}return out.size>0?out:null}function isIntInRange(value,spec){if(value===void 0)return!1;let n=namedToNumber(value,spec);return n!==null&&n>=spec.min&&n<=spec.max}function namedToNumber(value,spec){if(/^\d+$/.test(value))return Number.parseInt(value,10);let lower=value.toLowerCase();if(spec===MONTH){let i=MONTH_NAMES.indexOf(lower);return i===-1?null:i+1}if(spec===WEEKDAY){let i=DAY_NAMES.indexOf(lower);return i===-1?null:i}return null}function parseCron(expression){let trimmed=expression.trim(),parts=(MACROS[trimmed.toLowerCase()]??trimmed).split(/\s+/);if(parts.length!==5)return null;let[minRaw,hourRaw,dayRaw,monthRaw,weekdayRaw]=parts,minute=parseField(minRaw,MINUTE),hour=parseField(hourRaw,HOUR),day=parseField(dayRaw,DAY),month=parseField(monthRaw,MONTH),weekdayRawSet=parseField(weekdayRaw,WEEKDAY);if(!minute||!hour||!day||!month||!weekdayRawSet)return null;let weekday=new Set([...weekdayRawSet].map((d)=>d===7?0:d));return{minute,hour,day,month,weekday,dayUnrestricted:dayRaw==="*",weekdayUnrestricted:weekdayRaw==="*"}}function formatterFor(timeZone){let cached=formatterCache.get(timeZone);if(cached)return cached;try{let fmt=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short"});return formatterCache.set(timeZone,fmt),fmt}catch{return null}}function partsIn(ts,fmt){let parts=fmt.formatToParts(new Date(ts)),get=(type)=>parts.find((p)=>p.type===type)?.value??"0",hour=Number.parseInt(get("hour"),10)%24;return{year:Number.parseInt(get("year"),10),month:Number.parseInt(get("month"),10),day:Number.parseInt(get("day"),10),hour,minute:Number.parseInt(get("minute"),10),weekday:WEEKDAY_INDEX[get("weekday")]??0}}function offsetMsAt(ts,fmt){let p=partsIn(ts,fmt);return Date.UTC(p.year,p.month-1,p.day,p.hour,p.minute,new Date(ts).getUTCSeconds())-Math.floor(ts/1000)*1000}function zonedWallTimeToInstant(year,month,day,hour,minute,fmt){let naive=Date.UTC(year,month-1,day,hour,minute,0,0),ts=naive-offsetMsAt(naive,fmt),corrected=naive-offsetMsAt(ts,fmt);if(corrected!==ts)ts=corrected;let target=stamp(year,month,day,hour,minute),localStamp=(at)=>{let p=partsIn(at,fmt);return stamp(p.year,p.month,p.day,p.hour,p.minute)};if(localStamp(ts)===target)return ts;let probe=Math.min(ts,naive-offsetMsAt(naive,fmt));for(let i=0;i<=240;i++){if(localStamp(probe)>=target)return probe;probe+=60000}return ts}function stamp(year,month,day,hour,minute){return((year*100+month)*100+day)*1e4+hour*100+minute}function dayMatches(fields,wall){if(!fields.month.has(wall.month))return!1;let domOk=fields.day.has(wall.day),dowOk=fields.weekday.has(wall.weekday);if(fields.dayUnrestricted&&fields.weekdayUnrestricted)return!0;if(fields.dayUnrestricted)return dowOk;if(fields.weekdayUnrestricted)return domOk;return domOk||dowOk}function nextCronRun(expression,from=new Date,timeZone="UTC"){let fields=parseCron(expression);if(!fields)return null;let fmt=formatterFor(timeZone)??formatterFor("UTC");if(!fmt)return null;let hours=[...fields.hour].sort((a,b)=>a-b),minutes=[...fields.minute].sort((a,b)=>a-b),fromTs=from.getTime();if(!Number.isFinite(fromTs))return null;let cursor=partsIn(fromTs,fmt);for(let dayIndex=0;dayIndex<2929;dayIndex++){if(dayMatches(fields,cursor))for(let hour of hours)for(let minute of minutes){let ts=zonedWallTimeToInstant(cursor.year,cursor.month,cursor.day,hour,minute,fmt);if(ts>fromTs)return new Date(ts)}let nextDayUtc=Date.UTC(cursor.year,cursor.month-1,cursor.day+1,12,0,0),probe=new Date(nextDayUtc);cursor={year:probe.getUTCFullYear(),month:probe.getUTCMonth()+1,day:probe.getUTCDate(),hour:0,minute:0,weekday:probe.getUTCDay()}}return null}var MINUTE,HOUR,DAY,MONTH,WEEKDAY,MONTH_NAMES,DAY_NAMES,MACROS,formatterCache,WEEKDAY_INDEX;var init_cron=__esm(()=>{MINUTE={min:0,max:59},HOUR={min:0,max:23},DAY={min:1,max:31},MONTH={min:1,max:12},WEEKDAY={min:0,max:7};MONTH_NAMES=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"],DAY_NAMES=["sun","mon","tue","wed","thu","fri","sat"];MACROS={"@yearly":"0 0 1 1 *","@annually":"0 0 1 1 *","@monthly":"0 0 1 * *","@weekly":"0 0 * * 0","@daily":"0 0 * * *","@midnight":"0 0 * * *","@hourly":"0 * * * *"};formatterCache=new Map;WEEKDAY_INDEX={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6}});import{createCipheriv,createDecipheriv,randomBytes as randomBytes2,scryptSync}from"crypto";var MAGIC,IV_LEN=12,TAG_LEN=16,deriveKey=(secret)=>scryptSync(secret,"nucleus-backup-v1",32),encryptBackup=(plaintext,secret)=>{if(!secret)throw Error("backup encryption key is empty");let key=deriveKey(secret),iv=randomBytes2(IV_LEN),cipher=createCipheriv("aes-256-gcm",key,iv),ciphertext=Buffer.concat([cipher.update(plaintext,"utf-8"),cipher.final()]),tag=cipher.getAuthTag();return Buffer.concat([MAGIC,iv,tag,ciphertext])},isEncryptedBackup=(buf)=>buf.length>=MAGIC.length+IV_LEN+TAG_LEN&&buf.subarray(0,MAGIC.length).equals(MAGIC),decryptBackup=(blob,secret)=>{if(!secret)throw Error("backup encryption key is empty");if(!isEncryptedBackup(blob))throw Error("not an encrypted backup");let key=deriveKey(secret),iv=blob.subarray(MAGIC.length,MAGIC.length+IV_LEN),tag=blob.subarray(MAGIC.length+IV_LEN,MAGIC.length+IV_LEN+TAG_LEN),ciphertext=blob.subarray(MAGIC.length+IV_LEN+TAG_LEN),decipher=createDecipheriv("aes-256-gcm",key,iv);return decipher.setAuthTag(tag),Buffer.concat([decipher.update(ciphertext),decipher.final()]).toString("utf-8")};var init_encryption=__esm(()=>{MAGIC=Buffer.from("NXB1")});import{mkdir as mkdir3,readFile,stat as stat2,unlink as unlink3,writeFile}from"fs/promises";import{join as join4}from"path";import{eq as eq7,getTableColumns,sql as sql2}from"drizzle-orm";function nextHopMs(delayMs){if(!Number.isFinite(delayMs)||delayMs<=0)return 0;return Math.min(delayMs,MAX_TIMEOUT_MS)}function reviveRowTypes(table,rows){let columns;try{columns=getTableColumns(table)}catch{return rows}let dateColumns=Object.entries(columns).filter(([,col2])=>col2?.dataType==="date").map(([name])=>name);if(dateColumns.length===0)return rows;return rows.map((row)=>{let copy=null;for(let name of dateColumns){let value=row[name];if(typeof value!=="string")continue;let parsed=new Date(value);if(Number.isNaN(parsed.getTime()))continue;if(!copy)copy={...row};copy[name]=parsed}return copy??row})}function normalizeTableName(name){return name.replace(/[^a-z0-9]/gi,"").toLowerCase()}function selectBackupTables(tables,excludeTables){let excluded=new Set(excludeTables.map(normalizeTableName));return Object.keys(tables).filter((name)=>{if(excluded.has(normalizeTableName(name)))return!1;let val=tables[name];if(!val||typeof val!=="object")return!1;return Object.getOwnPropertySymbols(val).length>0})}class BackupService{db;logger;config;schemaTables;schemaName;backupLogsTable;cronTimer=null;schedulerActive=!1;lock;constructor(serviceConfig){this.db=serviceConfig.db,this.logger=serviceConfig.logger,this.config=serviceConfig.config,this.schemaTables=serviceConfig.schemaTables,this.schemaName=serviceConfig.schemaName,this.backupLogsTable=serviceConfig.backupLogsTable,this.lock=serviceConfig.lock}async createBackup(trigger="manual",performedBy,targetSchemaName,targetSchemaTables){let resolvedSchema=targetSchemaName||this.schemaName,resolvedTables=targetSchemaTables||this.schemaTables,now=new Date,backupId=crypto.randomUUID(),timestamp=now.toISOString().replace(/[:.]/g,"-"),backupName=`${resolvedSchema}_${timestamp}`,fileName=`${backupName}.json`,filePath=join4(this.config.storagePath,fileName),logRecord={id:backupId,backupName,fileName,schemaName:resolvedSchema,format:this.config.format,status:"running",trigger,sizeBytes:null,tableCount:null,rowCount:null,includedTables:[],excludedTables:this.config.excludeTables,errorMessage:null,startedAt:now.toISOString(),completedAt:null,performedBy:performedBy||null,cronExpression:trigger==="scheduled"?this.config.schedule.cron:null,retentionDays:this.config.schedule.retentionDays};await this.insertLogRecord(logRecord);try{await mkdir3(this.config.storagePath,{recursive:!0});let tableNames=this.getBackupTableNames(resolvedTables),backupData=[],totalRows=0;for(let tableName of tableNames){let table=resolvedTables[tableName];if(!table)continue;try{let rows=await this.db.select().from(table),columns=Object.keys(table).filter((k)=>!k.startsWith("_")&&typeof table[k]!=="function");backupData.push({tableName,columns,rows}),totalRows+=rows.length}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to export table ${tableName}: ${msg}`)}}let backupFile={manifest:{version:"1.0",createdAt:now.toISOString(),schemaName:resolvedSchema,format:this.config.format,tables:backupData.map((t)=>({tableName:t.tableName,rowCount:t.rows.length,columns:t.columns})),totalRows},data:backupData},jsonContent=JSON.stringify(backupFile,null,2);if(this.config.encryptionKey)await writeFile(filePath,encryptBackup(jsonContent,this.config.encryptionKey));else await writeFile(filePath,jsonContent,"utf-8");let fileStats=await stat2(filePath);return logRecord.status="completed",logRecord.completedAt=new Date().toISOString(),logRecord.tableCount=backupData.length,logRecord.rowCount=totalRows,logRecord.sizeBytes=fileStats.size,logRecord.includedTables=tableNames,await this.updateLogRecord(logRecord),this.logger.info("[Backup] Backup completed",{backupId,schemaName:resolvedSchema,tables:backupData.length,rows:totalRows,sizeBytes:fileStats.size}),await this.enforceMaxBackups(),logRecord}catch(err){let msg=err instanceof Error?err.message:String(err);return logRecord.status="failed",logRecord.errorMessage=msg,logRecord.completedAt=new Date().toISOString(),await this.updateLogRecord(logRecord),this.logger.error("[Backup] Backup failed",err,{backupId,schemaName:resolvedSchema}),logRecord}}async restoreFromBackup(backupId,performedBy,targetSchemaName,targetSchemaTables){if(!this.config.allowRestore)return{success:!1,message:"Restore is disabled in configuration"};let resolvedTables=targetSchemaTables||this.schemaTables,logRecord=await this.getLogRecord(backupId);if(!logRecord)return{success:!1,message:"Backup not found"};if(logRecord.status!=="completed")return{success:!1,message:`Cannot restore from backup with status: ${logRecord.status}`};let filePath=join4(this.config.storagePath,logRecord.fileName);try{let raw=await readFile(filePath),content;if(isEncryptedBackup(raw)){if(!this.config.encryptionKey)return{success:!1,message:"Backup is encrypted but no encryption key is configured"};content=decryptBackup(raw,this.config.encryptionKey)}else content=raw.toString("utf-8");let backupFile=JSON.parse(content);await this.createBackup("pre_restore",performedBy,targetSchemaName,targetSchemaTables);let tablesRestored=0,rowsRestored=0,ordered=backupFile.data.map((tableData)=>({tableData,table:resolvedTables[tableData.tableName]})).filter((entry)=>{if(!entry.table)return this.logger.warn(`[Backup] Skipping restore for ${entry.tableData.tableName}: table not found in schema`),!1;return!0});return await this.db.transaction(async(tx)=>{for(let{table}of[...ordered].reverse())await tx.delete(table);for(let{tableData,table}of ordered){if(tableData.rows.length===0)continue;let chunkSize=500;for(let i=0;i<tableData.rows.length;i+=chunkSize){let chunk=reviveRowTypes(table,tableData.rows.slice(i,i+chunkSize));await tx.insert(table).values(chunk)}tablesRestored++,rowsRestored+=tableData.rows.length}}),logRecord.status="restored",await this.updateLogRecord(logRecord),this.logger.info("[Backup] Restore completed",{backupId,tablesRestored,rowsRestored}),{success:!0,message:`Restored ${tablesRestored} tables with ${rowsRestored} rows`,tablesRestored,rowsRestored}}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.error("[Backup] Restore failed",err,{backupId}),{success:!1,message:`Restore failed: ${msg}`}}}async listBackups(){if(!this.backupLogsTable)return[];return await this.db.select().from(this.backupLogsTable).orderBy(sql2`created_at DESC`).limit(100)}async getBackupFilePath(backupId){let record=await this.getLogRecord(backupId);if(!record)return null;return join4(this.config.storagePath,record.fileName)}async deleteBackup(backupId){let record=await this.getLogRecord(backupId);if(!record)return!1;let filePath=join4(this.config.storagePath,record.fileName);try{await unlink3(filePath)}catch{}if(this.backupLogsTable)await this.db.delete(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId));return!0}startScheduler(){if(!this.config.schedule.enabled||!this.config.schedule.cron)return;if(!parseCron(this.config.schedule.cron))this.logger.error("[Backup] Cron expression not understood \u2014 falling back to the default",{cron:this.config.schedule.cron,fallback:DEFAULT_CRON,expected:'five fields ("0 2 * * *", "0 3 * * MON", "*/15 * * * *") or a macro (@daily, @weekly, @monthly)'}),this.config={...this.config,schedule:{...this.config.schedule,cron:DEFAULT_CRON}};this.logger.info("[Backup] Scheduler started",{cron:this.config.schedule.cron,timeZone:this.scheduleTimeZone(),retentionDays:this.config.schedule.retentionDays,replicaSafe:Boolean(this.lock)}),this.schedulerActive=!0,this.scheduleNextRun()}scheduleTimeZone(){return this.config.schedule.timeZone||"UTC"}scheduleNextRun(){if(!this.schedulerActive)return;let now=new Date,nextRun=nextCronRun(this.config.schedule.cron,now,this.scheduleTimeZone());if(!nextRun){this.logger.error("[Backup] Cron expression matches no future time \u2014 scheduler stopped",{cron:this.config.schedule.cron}),this.schedulerActive=!1;return}let delayMs=nextRun.getTime()-now.getTime();this.logger.debug?.("[Backup] Next scheduled backup",{at:nextRun.toISOString(),inMs:delayMs});let hop=nextHopMs(delayMs);this.cronTimer=setTimeout(async()=>{if(Date.now()<nextRun.getTime()){this.scheduleNextRun();return}try{if(await this.claimScheduledRun(nextRun))this.logger.info("[Backup] Scheduled backup starting..."),await this.createBackup("scheduled"),await this.cleanupExpiredBackups()}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.error("[Backup] Scheduled backup failed",{error:msg})}finally{this.scheduleNextRun()}},hop)}async claimScheduledRun(fireTime){if(!this.lock)return!0;let key=`nucleus:backup:schedule:${this.schemaName}:${fireTime.toISOString()}`;try{let result=await this.lock.acquireLock(key,3600);if(result.success&&result.data===!1)return this.logger.info("[Backup] Another replica owns this run \u2014 skipping",{fireTime:fireTime.toISOString()}),!1;return!0}catch(err){return this.logger.warn("[Backup] Lock unavailable \u2014 running anyway",{error:err instanceof Error?err.message:String(err)}),!0}}stopScheduler(){if(this.schedulerActive=!1,this.cronTimer)clearTimeout(this.cronTimer),this.cronTimer=null,this.logger.info("[Backup] Scheduler stopped")}getBackupTableNames(tables){return selectBackupTables(tables,this.config.excludeTables)}async insertLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.insert(this.backupLogsTable).values({id:record.id,backupName:record.backupName,fileName:record.fileName,schemaName:record.schemaName,format:record.format,status:record.status,trigger:record.trigger,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),excludedTables:JSON.stringify(record.excludedTables),errorMessage:record.errorMessage,startedAt:record.startedAt?new Date(record.startedAt):null,completedAt:record.completedAt?new Date(record.completedAt):null,performedBy:record.performedBy,cronExpression:record.cronExpression,retentionDays:record.retentionDays,createdAt:new Date,updatedAt:new Date})}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to insert backup log: ${msg}`)}}async updateLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.update(this.backupLogsTable).set({status:record.status,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),errorMessage:record.errorMessage,completedAt:record.completedAt?new Date(record.completedAt):null,updatedAt:new Date}).where(eq7(col(this.backupLogsTable,"id"),record.id))}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to update backup log: ${msg}`)}}async getLogRecord(backupId){if(!this.backupLogsTable)return null;return(await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId)).limit(1))[0]||null}async enforceMaxBackups(){if(!this.backupLogsTable)return;let allBackups=await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"status"),"completed")).orderBy(sql2`created_at DESC`);if(allBackups.length>this.config.maxBackups){let toDelete=allBackups.slice(this.config.maxBackups);for(let backup of toDelete){let b=backup;await this.deleteBackup(b.id)}this.logger.info("[Backup] Old backups cleaned up",{deleted:toDelete.length})}}async cleanupExpiredBackups(){if(!this.backupLogsTable||!this.config.schedule.retentionDays)return;let cutoff=new Date;cutoff.setDate(cutoff.getDate()-this.config.schedule.retentionDays);let{lt}=await import("drizzle-orm"),expired=await this.db.select().from(this.backupLogsTable).where(lt(col(this.backupLogsTable,"createdAt"),cutoff));for(let backup of expired){let b=backup;await this.deleteBackup(b.id)}if(expired.length>0)this.logger.info("[Backup] Expired backups cleaned up",{deleted:expired.length,retentionDays:this.config.schedule.retentionDays})}}var col=(table,name)=>table[name],MAX_TIMEOUT_MS=2147483647,DEFAULT_CRON="0 2 * * *";var init_BackupService=__esm(()=>{init_cron();init_encryption()});var init_Backup=__esm(()=>{init_BackupService()});function parseTimeToSeconds(time){let match=time.match(/^(\d+)(s|m|h|d)$/);if(!match||!match[1]||!match[2])return 300;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value;case"m":return value*60;case"h":return value*3600;case"d":return value*86400;default:return 300}}function generateSecureId(){let bytes=new Uint8Array(24);return crypto.getRandomValues(bytes),Array.from(bytes).map((b)=>b.toString(16).padStart(2,"0")).join("")}function hashAnswer(answer){let hasher=new Bun.CryptoHasher("sha256");return hasher.update(answer),hasher.digest("hex")}function timingSafeEqual(a,b){if(a.length!==b.length){let dummy=new Uint8Array(32);return crypto.getRandomValues(dummy),!1}let encoder=new TextEncoder,bufA=encoder.encode(a),bufB=encoder.encode(b),result=0;for(let i=0;i<bufA.length;i++)result|=(bufA[i]??0)^(bufB[i]??0);return result===0}function getSecureRandomInt(min,max){let range=max-min+1,bytesNeeded=Math.ceil(Math.log2(range)/8)||1,maxValue=256**bytesNeeded,limit=maxValue-maxValue%range,randomValue,bytes=new Uint8Array(bytesNeeded);do crypto.getRandomValues(bytes),randomValue=bytes.reduce((acc,byte,i)=>acc+byte*256**i,0);while(randomValue>=limit);return min+randomValue%range}function generateMathChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],{min,max}=config.mathRange,operations=["+","-","\xD7"],operation=operations[getSecureRandomInt(0,operations.length-1)],num1=getSecureRandomInt(min,max),num2=getSecureRandomInt(min,max),answer;switch(operation){case"+":answer=num1+num2;break;case"-":if(num1<num2)[num1,num2]=[num2,num1];answer=num1-num2;break;case"\xD7":num1=getSecureRandomInt(1,12),num2=getSecureRandomInt(1,12),answer=num1*num2;break;default:answer=num1+num2}return{question:`${num1} ${operation} ${num2} = ?`,answer:answer.toString()}}function generateTextChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],text="";for(let i=0;i<config.textLength;i++)text+=CHARACTERS.charAt(getSecureRandomInt(0,CHARACTERS.length-1));return{question:text,answer:text}}function generateImageChallenge(difficulty){let textChallenge=generateTextChallenge(difficulty),width=200,height=60,svgContent=generateCaptchaSVG(textChallenge.answer,200,60),imageData=`data:image/svg+xml;base64,${Buffer.from(svgContent).toString("base64")}`;return{question:"Enter the text shown in the image",answer:textChallenge.answer,imageData}}function getSecureFloat(){let bytes=new Uint32Array(1);return crypto.getRandomValues(bytes),(bytes[0]??0)/4294967295}function generateCaptchaSVG(text,width,height){let bgR=240+getSecureFloat()*15,bgG=240+getSecureFloat()*15,bgB=240+getSecureFloat()*15,bgColor=`rgb(${bgR}, ${bgG}, ${bgB})`,noiseLines="";for(let i=0;i<12;i++){let x1=getSecureFloat()*width,y1=getSecureFloat()*height,x2=getSecureFloat()*width,y2=getSecureFloat()*height,r=getSecureFloat()*100+100,g=getSecureFloat()*100+100,b=getSecureFloat()*100+100,strokeWidth=1+getSecureFloat()*2;noiseLines+=`<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="rgb(${r},${g},${b})" stroke-width="${strokeWidth}"/>`}let noiseCurves="";for(let i=0;i<4;i++){let startX2=getSecureFloat()*width,startY=getSecureFloat()*height,cp1X=getSecureFloat()*width,cp1Y=getSecureFloat()*height,cp2X=getSecureFloat()*width,cp2Y=getSecureFloat()*height,endX=getSecureFloat()*width,endY=getSecureFloat()*height,r=getSecureFloat()*80+80,g=getSecureFloat()*80+80,b=getSecureFloat()*80+80;noiseCurves+=`<path d="M${startX2},${startY} C${cp1X},${cp1Y} ${cp2X},${cp2Y} ${endX},${endY}" stroke="rgb(${r},${g},${b})" stroke-width="2" fill="none"/>`}let noiseDots="";for(let i=0;i<80;i++){let x=getSecureFloat()*width,y=getSecureFloat()*height,r=getSecureFloat()*150+50,g=getSecureFloat()*150+50,b=getSecureFloat()*150+50,radius=getSecureFloat()*3+1;noiseDots+=`<circle cx="${x}" cy="${y}" r="${radius}" fill="rgb(${r},${g},${b})"/>`}let textElements="",charWidth=width/(text.length+2),startX=charWidth;for(let i=0;i<text.length;i++){let x=startX+i*charWidth+(getSecureFloat()-0.5)*15,y=height/2+8+(getSecureFloat()-0.5)*12,rotation=(getSecureFloat()-0.5)*40,fontSize=22+getSecureFloat()*10,r=getSecureFloat()*80,g=getSecureFloat()*80,b=getSecureFloat()*80,skewX=(getSecureFloat()-0.5)*15,scaleY=0.9+getSecureFloat()*0.3;textElements+=`<text x="${x}" y="${y}" font-family="Arial, Helvetica, sans-serif" font-size="${fontSize}" font-weight="bold" fill="rgb(${r},${g},${b})" transform="rotate(${rotation}, ${x}, ${y}) skewX(${skewX}) scale(1, ${scaleY})" style="font-style: ${getSecureFloat()>0.5?"italic":"normal"}">${text[i]}</text>`}let overlayLines="";for(let i=0;i<3;i++){let y=10+getSecureFloat()*(height-20),r=getSecureFloat()*60+60,g=getSecureFloat()*60+60,b=getSecureFloat()*60+60;overlayLines+=`<line x1="0" y1="${y}" x2="${width}" y2="${y+(getSecureFloat()-0.5)*20}" stroke="rgb(${r},${g},${b})" stroke-width="1.5"/>`}return`<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">
+`).slice(1,4);for(let stackLine of stackLines)method(`  ${dim}${stackLine.trim()}${reset}`)}let cause=entry.error.cause,indent="  ";while(cause){indent+="  ";let code=cause.code!==void 0?` [${cause.code}]`:"";method(`${indent}${color}caused by: ${cause.name}${code}: ${cause.message}${reset}`),cause=cause.cause}}}getConsoleMethod(level){switch(level){case"debug":return console.debug.bind(console);case"info":return console.info.bind(console);case"warn":return console.warn.bind(console);case"error":case"fatal":return console.error.bind(console);default:return console.log.bind(console)}}}class ServerLogTransport{name="server-log-buffer";buffer;constructor(buffer){this.buffer=buffer}log(entry){this.buffer.add(entry)}}class DatabaseAuditTransport{name="database";db;table;enabled;dedupEnabled;dedupWindowMs;dedupSlots=new Map;lastSweep=0;constructor(options){this.db=options.db,this.table=options.table,this.enabled=options.enabled??!0,this.dedupEnabled=options.dedup?.enabled??!1,this.dedupWindowMs=Math.max(1,options.dedup?.windowSeconds??60)*1000}setDb(db){this.db=db}setTable(table){this.table=table}setEnabled(enabled){this.enabled=enabled}setDedup(dedup){if(this.dedupEnabled=dedup.enabled??this.dedupEnabled,dedup.windowSeconds!=null)this.dedupWindowMs=Math.max(1,dedup.windowSeconds)*1000}isDedupable(entry){return this.dedupEnabled&&(entry.category==="auth"||entry.category==="authz"||entry.category==="security_anomaly")}sweep(now){if(now-this.lastSweep<this.dedupWindowMs)return;this.lastSweep=now;for(let[key,slot]of this.dedupSlots)if(slot.expiresAt<=now)this.dedupSlots.delete(key)}async write(entry){if(!this.enabled||!this.db||!this.table)return;try{let now=Date.now();if(this.isDedupable(entry)){this.sweep(now);let key=`${entry.ipAddress}|${entry.operation}|${entry.summary}|${entry.userId??""}`,slot=this.dedupSlots.get(key);if(slot&&slot.expiresAt>now){slot.count+=1,await this.bumpOccurrence(slot.rowId,slot.count,now);return}this.dedupSlots.set(key,{rowId:entry.id,count:1,expiresAt:now+this.dedupWindowMs})}await this.db.insert(this.table).values({id:entry.id,entityId:entry.entityId,entityName:entry.entityName,operationType:entry.operation,userId:entry.userId,ipAddress:entry.ipAddress,userAgent:entry.userAgent,summary:entry.summary,severity:entry.severity,category:entry.category,occurrenceCount:1,oldValues:entry.oldValues,newValues:entry.newValues,path:entry.path,query:entry.query})}catch(error){console.error("Audit log write failed:",error)}}async bumpOccurrence(rowId,count,nowMs){try{let{eq}=await import("drizzle-orm"),idCol=this.table.id;await this.db.update(this.table).set({occurrenceCount:count,lastOccurrenceAt:new Date(nowMs)}).where(eq(idCol,rowId))}catch(error){console.error("Audit dedup update failed:",error)}}}class ConsoleAuditTransport{name="console-audit";enabled;constructor(options={}){this.enabled=options.enabled??!0}write(entry){if(!this.enabled)return;let reset=RESET_COLOR,dim=DIM_COLOR,color={info:"\x1B[35m",low:"\x1B[90m",medium:"\x1B[33m",high:"\x1B[31m",critical:"\x1B[1m\x1B[31m"}[entry.severity]??"\x1B[35m",sev=entry.severity.toUpperCase(),actor=entry.userId||"anonymous",cat=entry.category;console.log(`${dim}${entry.timestamp}${reset} ${color}AUDIT\xB7${sev}${reset} ${dim}(${cat})${reset} [${entry.operation}] ${entry.entityName}${entry.entityId?`:${entry.entityId}`:""} ${dim}by ${actor}${reset}${entry.summary?` ${dim}\u2014${reset} ${entry.summary}`:""}`)}}var init_transports=__esm(()=>{init_ServerLogBuffer();init_types();init_utils()});class Logger{config;transports;auditTransports;context;correlationId;static instance=null;constructor(config={},context={},correlationId){this.config={...DEFAULT_CONFIG,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||[]])],this.context=context,this.correlationId=correlationId,this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint})],this.auditTransports=[new ConsoleAuditTransport({enabled:this.config.prettyPrint})]}static getInstance(config){if(!Logger.instance)Logger.instance=new Logger(config);return Logger.instance}static resetInstance(){Logger.instance=null}configure(config){return this.config={...this.config,...config},this.config.redactKeys=[...new Set([...DEFAULT_REDACT_KEYS,...config.redactKeys||this.config.redactKeys||[]])],this.transports=[new ConsoleTransport({colorize:this.config.colorize,prettyPrint:this.config.prettyPrint}),...this.transports.filter((t)=>t.name!=="console")],this}child(context,correlationId){let childLogger=new Logger(this.config,mergeContext(this.context,context)||{},correlationId||this.correlationId);return childLogger.transports=this.transports,childLogger.auditTransports=this.auditTransports,childLogger}withCorrelationId(correlationId){return this.child({},correlationId)}addTransport(transport){this.transports.push(transport)}addAuditTransport(transport){this.auditTransports.push(transport)}setLevel(level){this.config.level=level}setAuditEnabled(enabled){this.config.auditEnabled=enabled}isAuditEnabled(){return this.config.auditEnabled}setAuditSuppressReasons(reasons){this.config.auditSuppressReasons=reasons}setAuditMinSeverity(severity){this.config.auditMinSeverity=severity}shouldLog(level){return LOG_LEVEL_PRIORITY[level]>=LOG_LEVEL_PRIORITY[this.config.level]}shouldLogScope(scope){if(!scope)return!0;return matchesScope(scope,this.config.enabledScopes)}setEnabledScopes(scopes){this.config.enabledScopes=scopes}getEnabledScopes(){return this.config.enabledScopes}scoped(scope){return new ScopedLogger(this,scope)}createEntry(level,message,context,error,startTime,scope){let entry={timestamp:new Date().toISOString(),level,message:redactSecretsInText(message,{extraNames:this.config.redactKeys}),scope,service:this.config.service,correlationId:this.correlationId},mergedContext=mergeContext(this.context,context);if(mergedContext&&Object.keys(mergedContext).length>0)entry.context=redactLogContext(mergedContext,this.config.redactKeys);if(this.config.includeCallerInfo)entry.caller=getCallerInfo();if(error)entry.error=redactErrorInfo(formatError(error),this.config.redactKeys);if(startTime!==void 0)entry.duration=performance.now()-startTime;return entry}log(level,message,context,error,startTime,scope){if(!this.shouldLog(level))return;if(!this.shouldLogScope(scope))return;let entry=this.createEntry(level,message,context,error,startTime,scope);for(let transport of this.transports)try{transport.log(entry)}catch(err){console.error(`Logger transport "${transport.name}" failed:`,err)}}debug(message,context){this.log("debug",message,context)}info(message,context){this.log("info",message,context)}warn(message,context){this.log("warn",message,context)}error(message,error,context){this.log("error",message,context,error)}fatal(message,error,context){this.log("fatal",message,context,error)}time(label){let start=performance.now();return()=>{this.log("debug",`${label} completed`,void 0,void 0,start)}}async timeAsync(label,fn,context){let start=performance.now();try{let result=await fn();return this.log("debug",`${label} completed`,context,void 0,start),result}catch(error){throw this.log("error",`${label} failed`,context,error,start),error}}request(options){let level=options.statusCode>=500?"error":options.statusCode>=400?"warn":"info";this.log(level,`${options.method} ${options.path} ${options.statusCode}`,{method:options.method,path:options.path,statusCode:options.statusCode,durationMs:options.duration,correlationId:options.correlationId,userId:options.userId,ip:options.ip,userAgent:options.userAgent})}db(options){let level=options.error?"error":"debug";this.log(level,`DB ${options.operation} on ${options.table}`,{operation:options.operation,table:options.table,durationMs:options.duration,rowCount:options.rowCount},options.error)}async flush(){for(let transport of this.transports)if(transport.flush)await transport.flush()}async audit(options){let summary=options.summary||`${options.operation} on ${options.entityName}`;if(this.config.auditSuppressReasons?.includes(summary))return;let derived=classifyAudit(options.operation,summary),severity=options.severity??derived.severity,category=options.category??derived.category;if(severityRank(severity)<severityRank(this.config.auditMinSeverity))return;let scrub={extraNames:this.config.redactKeys},entry={id:randomId(),timestamp:new Date().toISOString(),entityName:options.entityName,entityId:options.entityId??null,operation:options.operation,userId:options.userId??null,summary:redactSecretsInText(summary,scrub),severity,category,oldValues:redactSensitiveData(options.oldValues||{},this.config.redactKeys),newValues:redactSensitiveData(options.newValues||{},this.config.redactKeys),ipAddress:options.ipAddress||"unknown",userAgent:options.userAgent||"unknown",path:redactUrl(options.path||"",scrub),query:redactQueryString(options.query||"",scrub),correlationId:this.correlationId};for(let transport of this.auditTransports)try{await transport.write(entry)}catch(err){console.error(`Audit transport "${transport.name}" failed:`,err)}}auditOnly(options){this.audit(options)}async trace(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)await this.audit(options.audit)}traceSync(options){let shouldLog=options.log!==!1,shouldAudit=options.writeAudit===!0||options.writeAudit!==!1&&this.config.auditEnabled&&options.audit;if(shouldLog)this.log(options.level||"info",options.message,options.context,options.error);if(shouldAudit&&options.audit)this.audit(options.audit)}}class ScopedLogger{parent;scope;constructor(parent,scope){this.parent=parent,this.scope=scope}debug(message,context){this.parent.log("debug",message,context,void 0,void 0,this.scope)}info(message,context){this.parent.log("info",message,context,void 0,void 0,this.scope)}warn(message,context){this.parent.log("warn",message,context,void 0,void 0,this.scope)}error(message,error,context){this.parent.log("error",message,context,error,void 0,this.scope)}}var DEFAULT_CONFIG,logger;var init_Logger=__esm(()=>{init_redactSecrets();init_auditTaxonomy();init_scopes();init_transports();init_types();init_utils();DEFAULT_CONFIG={level:"info",service:"nucleus",environment:"development",redactKeys:[],colorize:!0,prettyPrint:!0,includeCallerInfo:!0,asyncBufferSize:100,flushIntervalMs:1000,auditEnabled:!1,auditSuppressReasons:DEFAULT_AUDIT_SUPPRESS_REASONS,auditMinSeverity:"info",enabledScopes:["*"]};logger=Logger.getInstance()});var require_auto_promise=__commonJS((exports,module)=>{var slice=Array.prototype.slice;module.exports=function(fn,makeResult){return function(){var promise,args=arguments,n=args.length;if(n!==0&&typeof args[n-1]!=="function")args=slice.call(arguments),promise=new Promise(function(resolve,reject){args.push(function(err,result){if(err!=null)reject(err);else resolve(makeResult!==void 0?makeResult.apply(this,slice.call(arguments,1)):result)})});return fn.apply(this,args),promise}}});var require_smb2_message=__commonJS((exports,module)=>{var protocolId=Buffer.from([254,83,77,66]),headerTranslates={Command:{NEGOTIATE:0,SESSION_SETUP:1,LOGOFF:2,TREE_CONNECT:3,TREE_DISCONNECT:4,CREATE:5,CLOSE:6,FLUSH:7,READ:8,WRITE:9,LOCK:10,IOCTL:11,CANCEL:12,ECHO:13,QUERY_DIRECTORY:14,CHANGE_NOTIFY:15,QUERY_INFO:16,SET_INFO:17,OPLOCK_BREAK:18}},headerLength=64,headerSync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["ProcessId",4,processId],["TreeId",4,0],["SessionId",8,sessionId],["Signature",16,0]]},headerASync=function(processId,sessionId){return[["ProtocolId",4,protocolId],["StructureSize",2,headerLength],["CreditCharge",2,0],["Status",4,0],["Command",2],["Credit",2,126],["Flags",4,0],["NextCommand",4,0],["MessageId",4],["MessageIdHigh",4,0],["AsyncId",8],["SessionId",8,sessionId],["Signature",16,0]]},SMB2Message=module.exports=function(options){if(this.headers={},options&&options.headers)this.setHeaders(options.headers);if(this.request={},options&&options.request)this.setRequest(options.request);this.response={}},proto=SMB2Message.prototype={};proto.setHeaders=function(obj){for(var key in obj)this.headers[key]=obj[key];this.structure=__require("../structures/"+this.headers.Command.toLowerCase())};proto.getHeaders=function(){return this.headers};proto.setRequest=function(request){this.request=request};proto.getResponse=function(){return this.response};proto.getBuffer=function(connection){var buffer=Buffer.allocUnsafe(65535),length=0;if(!this.isMessageIdSetted)this.isMessageIdSetted=!0,this.headers.MessageId=connection.messageId++;length+=writeHeaders(this,buffer),length+=writeRequest(this,buffer,headerLength);var output=Buffer.allocUnsafe(length);return buffer.copy(output,0,0,length),output};proto.parseBuffer=function(buffer){readHeaders(this,buffer),readResponse(this,buffer,headerLength)};function dataToBuffer(data,length){if(Buffer.isBuffer(data))return data;if(typeof data==="string")return Buffer.from(data);var result=Buffer.allocUnsafe(length);for(var i=0;i<length;i++)result.writeUInt8(255&data>>i*8,i);return result}function bufferToData(buffer){if(!Buffer.isBuffer(buffer))return buffer;var result=0;for(var i=0;i<buffer.length;i++)result+=buffer.readUInt8(i)<<i*8;return result}function writeData(buffer,data,offset,length){dataToBuffer(data,length).copy(buffer,offset,0)}function readData(buffer,offset,length){return buffer.slice(offset,offset+length)}function translate(key,value){if(headerTranslates[key]&&typeof headerTranslates[key][value]<"u")return headerTranslates[key][value];return value}function unTranslate(key,value){if(headerTranslates[key]){for(var t in headerTranslates[key])if(headerTranslates[key][t]===value)return t}return null}function readHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1];if(message.headers[key]=readData(buffer,offset,length),length<=8)message.headers[key]=unTranslate(key,bufferToData(message.headers[key]))||message.headers[key];offset+=length}message.structure=__require("../structures/"+message.headers.Command.toLowerCase())}function writeHeaders(message,buffer){var header=(message.isAsync?headerASync:headerSync)(message.ProcessId,message.SessionId),offset=0;for(var i in header){var key=header[i][0],length=header[i][1],defaultValue=header[i][2]||0;writeData(buffer,translate(key,message.headers[key]||defaultValue),offset,length),offset+=length}return offset}function readResponse(message,buffer,offset){for(var i in message.structure.response){var key=message.structure.response[i][0],length=message.structure.response[i][1]||1;if(typeof length==="string")length=bufferToData(message.response[length]);message.response[key]=readData(buffer,offset,length),offset+=length}}function writeRequest(message,buffer,offset){var initOffset=offset,needsRewrite=!1,tmpBuffer=Buffer.allocUnsafe(buffer.length);offset=0;for(var i in message.structure.request){var key=message.structure.request[i][0],length=message.structure.request[i][1]||1,defaultValue=message.structure.request[i][2]||0;if(typeof length==="string"){if(message.request[key]=message.request[key]||"",message.request[length]!==message.request[key].length)message.request[length]=message.request[key].length,needsRewrite=!0;length=message.request[key].length}else message.request[key]=message.request[key]||defaultValue;writeData(tmpBuffer,message.request[key],offset,length),offset+=length}if(needsRewrite)writeRequest(message,tmpBuffer,0);return tmpBuffer.copy(buffer,initOffset,0,offset),offset}});var require_smb2_forge=__commonJS((exports,module)=>{var SMB2Message=require_smb2_message(),SMB2Forge=module.exports={};SMB2Forge.request=function(messageName,params,connection,cb){var msg=__require("../messages/"+messageName),smbMessage=msg.generate(connection,params);sendNetBiosMessage(connection,smbMessage);var error=Error();error.messageName=messageName,error.params=params,getResponse(connection,smbMessage.getHeaders().MessageId,msg.parse(connection,cb,error))};SMB2Forge.response=function(c){return c.responses={},c.responsesCB={},c.responseBuffer=Buffer.allocUnsafe(0),function(response){c.responseBuffer=Buffer.concat([c.responseBuffer,response]);var extract=!0;while(extract)if(extract=!1,c.responseBuffer.length>=4){var msgLength=(c.responseBuffer.readUInt8(1)<<16)+c.responseBuffer.readUInt16BE(2);if(c.responseBuffer.length>=msgLength+4){extract=!0;var r=c.responseBuffer.slice(4,msgLength+4),message=new SMB2Message;if(message.parseBuffer(r),c.debug)console.log("--response"),console.log(r.toString("hex"));var mId=message.getHeaders().MessageId.toString("hex");if(c.responsesCB[mId])c.responsesCB[mId](message),delete c.responsesCB[mId];else c.responses[mId]=message;c.responseBuffer=c.responseBuffer.slice(msgLength+4)}}}};function sendNetBiosMessage(connection,message){var smbRequest=message.getBuffer(connection);if(connection.debug)console.log("--request"),console.log(smbRequest.toString("hex"));var buffer=Buffer.allocUnsafe(smbRequest.length+4);return buffer.writeUInt8(0,0),buffer.writeUInt8((16711680&smbRequest.length)>>16,1),buffer.writeUInt16BE(65535&smbRequest.length,2),smbRequest.copy(buffer,4,0,smbRequest.length),connection.newResponse=!1,connection.socket.write(buffer),!0}function getResponse(c,mId,cb){var messageId=Buffer.allocUnsafe(4);if(messageId.writeUInt32LE(mId,0),messageId=messageId.toString("hex"),c.responses[messageId])cb(c.responses[messageId]),delete c.responses[messageId];else c.responsesCB[messageId]=cb}});var require_smb2_connection=__commonJS((exports,module)=>{var net=__require("net"),SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,SMB2Connection=module.exports={};SMB2Connection.close=function(connection){if(clearAutoCloseTimeout(connection),connection.connected)connection.connected=!1,connection.socket.end()};SMB2Connection.requireConnect=function(method){return function(){var connection=this,args=Array.prototype.slice.call(arguments);connect(connection,function(err){var cb=args.pop();if(typeof cb!=="function")args.push(cb),cb=function(err2){if(err2){if(!(err2 instanceof Error))err2=Error(String(err2));throw err2}};if(cb=scheduleAutoClose(connection,cb),args.push(cb),err)cb(err);else method.apply(connection,args)})}};SMB2Connection.init=function(connection){connection.connected=!1,connection.socket=new net.Socket({allowHalfOpen:!0}),connection.socket.on("data",SMB2Forge.response(connection)),connection.errorHandler=[],connection.socket.on("error",function(err){if(connection.errorHandler.length>0)connection.errorHandler[0].call(null,err);if(connection.debug)console.log("-- error"),console.log(arguments)})};function connect(connection,cb){if(connection.connected){cb&&cb(null);return}cb=scheduleAutoClose(connection,cb),connection.messageId=0,connection.SessionId=Math.floor(Math.random()*256)&255,connection.socket.connect(connection.port,connection.ip),SMB2Request("negotiate",{},connection,function(err){if(err)cb&&cb(err);else SMB2Request("session_setup_step1",{},connection,function(err2){if(err2)cb&&cb(err2);else SMB2Request("session_setup_step2",{},connection,function(err3){if(err3)cb&&cb(err3);else SMB2Request("tree_connect",{},connection,function(err4){if(err4)cb&&cb(err4);else connection.connected=!0,cb&&cb(null)})})})})}function clearAutoCloseTimeout(connection){if(connection.scheduledAutoClose)clearTimeout(connection.scheduledAutoClose),connection.scheduledAutoClose=null}function setAutoCloseTimeout(connection){if(clearAutoCloseTimeout(connection),connection.autoCloseTimeout!==0)connection.scheduledAutoClose=setTimeout(function(){SMB2Connection.close(connection)},connection.autoCloseTimeout)}function scheduleAutoClose(connection,cb){return addErrorListener(connection,cb),clearAutoCloseTimeout(connection),function(){removeErrorListener(connection),setAutoCloseTimeout(connection),cb.apply(null,arguments)}}function addErrorListener(connection,callback){connection.errorHandler.unshift(callback)}function removeErrorListener(connection){connection.errorHandler.shift()}});var require_disconnect=__commonJS((exports,module)=>{var SMB2Connection=require_smb2_connection();module.exports=function(){SMB2Connection.close(this)}});var require_exists=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,cb){var connection=this;SMB2Request("open",{path},connection,function(err,file){if(err!=null){if(err.code==="STATUS_OBJECT_NAME_NOT_FOUND"||err.code==="STATUS_OBJECT_PATH_NOT_FOUND")return cb&&cb(null,!1);return cb&&cb(err)}SMB2Request("close",file,connection,function(){cb&&cb(null,!0)})})}});var require_bigint=__commonJS((exports,module)=>{var BigInt2=module.exports=function(n,v){if(BigInt2.isBigInt(n))this.buffer=Buffer.allocUnsafe(n.buffer.length),n.buffer.copy(this.buffer,0),this.sign=n.sign;else if(this.buffer=Buffer.alloc(n),this.sign=1,v=v||0,v!==0){if(v<0)this.sign=-1,v=-v;v=v.toString(16);var size=Math.ceil(v.length/2),carry=size*2-v.length;for(var i=0;i<size;i++){var start=(size-i-1)*2-carry;this.buffer.writeUInt8(parseInt(start===-1?v.substr(0,1):v.substr(start,2),16),i)}}};BigInt2.isBigInt=function(v){return v&&v.buffer&&Buffer.isBuffer(v.buffer)};BigInt2.toBigInt=function(n,v){return new BigInt2(n,v)};BigInt2.fromBuffer=function(b,sign){sign=typeof sign>"u"?1:sign;var bi=new BigInt2(0);return bi.sign=sign,bi.buffer=b,bi};BigInt2.prototype.add=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.neg().sub(v);var carry=0,n=Math.max(v.buffer.length,this.buffer.length),result=new BigInt2(n);for(var i=0;i<n;i++){var r=(i<this.buffer.length?this.buffer.readUInt8(i):0)+(i<v.buffer.length?v.buffer.readUInt8(i):0)+carry;result.buffer.writeUInt8(r&255,i),carry=r>>8}return result.sign=this.sign,result};BigInt2.prototype.neg=function(){var result=new BigInt2(this);return result.sign*=-1,result};BigInt2.prototype.abs=function(){var result=new BigInt2(this);return result.sign=1,result};BigInt2.prototype.sub=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);if(this.sign!==v.sign)return this.add(v.neg());var carry=0,a=new BigInt2(this),b=new BigInt2(v),n=Math.max(a.buffer.length,b.buffer.length),result=new BigInt2(n),sign=this.sign;if(a.abs().lt(b.abs())){var t=a;a=b,b=t,sign*=-1}for(var i=0;i<n;i++){var va=i<a.buffer.length?a.buffer.readUInt8(i):0,vb=i<b.buffer.length?b.buffer.readUInt8(i):0,c=0,r=va-vb-carry;while(r<0)r+=255,c--;result.buffer.writeUInt8(r&255,i),carry=(r>>8)+c}return result.sign=sign,result};BigInt2.prototype.toBuffer=function(){return this.buffer};BigInt2.prototype.toNumber=function(){var b=Buffer.allocUnsafe(this.buffer.length);for(var i=0;i<this.buffer.length;i++)b.writeUInt8(this.buffer.readUInt8(this.buffer.length-i-1),i);return parseInt(b.toString("hex"),16)};BigInt2.prototype.compare=function(v){if(!BigInt2.isBigInt(v))v=BigInt2.toBigInt(this.buffer.length,v);var n=Math.max(v.buffer.length,this.buffer.length);if(this.sign>v.sign)return 1;if(this.sign<v.sign)return-1;for(var i=n-1;i>=0;i--){var a=i<this.buffer.length?this.buffer.readUInt8(i):0,b=i<v.buffer.length?v.buffer.readUInt8(i):0;if(a!==b)return a>b?this.sign:-this.sign}return 0};BigInt2.prototype.lt=function(v){return this.compare(v)<0};BigInt2.prototype.le=function(v){return this.compare(v)<=0};BigInt2.prototype.gt=function(v){return this.compare(v)>0};BigInt2.prototype.ge=function(v){return this.compare(v)>=0}});var require_constants=__commonJS((exports,module)=>{module.exports={FILE_SUPERSEDE:0,FILE_OPEN:1,FILE_CREATE:2,FILE_OPEN_IF:3,FILE_OVERWRITE:4,FILE_OVERWRITE_IF:5,MAX_READ_LENGTH:65536,MAX_WRITE_LENGTH:65423,FILE_SHARE_NONE:0,FILE_SHARE_READ:1,FILE_SHARE_WRITE:2,FILE_SHARE_DELETE:4,DELETE:65536,FILE_APPEND_DATA:4,FILE_DELETE_CHILD:64,FILE_READ_ATTRIBUTES:128,FILE_READ_DATA:1,FILE_READ_EA:8,FILE_WRITE_ATTRIBUTES:256,FILE_WRITE_DATA:2,FILE_WRITE_EA:16,READ_CONTROL:131072,SYNCHRONIZE:1048576,WRITE_DAC:262144,DIRECTORY:16}});var require_rename=__commonJS((exports,module)=>{var BigInt2=require_bigint(),SMB2Request=require_smb2_forge().request,constants=require_constants();module.exports=function(oldPath,newPath,options,cb){if(typeof options==="function")cb=options,options={};var connection=this;SMB2Request("open_folder",{path:oldPath},connection,function(err,file){if(err)SMB2Request("create",{path:oldPath,createDisposition:constants.FILE_OPEN,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err2,file2){if(err2)cb&&cb(err2);else rename_(connection,file2,newPath,options,cb)});else rename_(connection,file,newPath,options,cb)})};function rename_(connection,file,newPath,options,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileRenameInformation",Buffer:renameBuffer(newPath,options)},connection,function(err){SMB2Request("close",file,connection,function(){if(err)cb&&cb(err);else cb&&cb(null)})})}function renameBuffer(newPath,options){var filename=Buffer.from(newPath,"ucs2");return Buffer.concat([new BigInt2(1,options.replace?1:0).toBuffer(),new BigInt2(7,0).toBuffer(),new BigInt2(8,0).toBuffer(),new BigInt2(4,filename.length).toBuffer(),filename])}});var require_readFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(filename,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};SMB2Request("open",{path:filename},connection,function(err,file){if(err)cb&&cb(err);else{var fileLength=0,offset=new BigInt2(8),stop=!1,nbRemainingPackets=0;for(var i=0;i<file.EndofFile.length;i++)fileLength+=file.EndofFile[i]*Math.pow(2,i*8);var result=Buffer.allocUnsafe(fileLength),callback=function(offset2){return function(err2,content){if(stop)return;if(err2)cb&&cb(err2),stop=!0;else content.copy(result,offset2.toNumber()),nbRemainingPackets--,checkDone()}},checkDone=function(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))SMB2Request("close",file,connection,function(){if(options.encoding)result=result.toString(options.encoding);cb&&cb(null,result)})},createPackets=function(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=offset.sub(fileLength).neg(),packetSize=rest.gt(MAX_READ_LENGTH)?MAX_READ_LENGTH:rest.toNumber();SMB2Request("read",{FileId:file.FileId,Length:packetSize,Offset:offset.toBuffer()},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}};checkDone()}})}});var require_createReadStream=__commonJS((exports,module)=>{var Readable=__require("stream").Readable,BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};else if(options==null)options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onOpen(err,file){if(err!=null)return cb(err);var offset=options.start||0,fileSize=BigInt2.fromBuffer(file.EndofFile).toNumber(),end=fileSize;if(options.end<end)end=options.end+1;var close=request.bind(void 0,"close",file,connection),stream=new Readable;if(stream.fileSize=fileSize,shouldClose)stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})};var running=!1;stream._read=function(size){if(running)return;if(offset>=end)return shouldClose?close(function(){stream.push(null)}):stream.push(null);running=!0,request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,size,end-offset),Offset:new BigInt2(8,offset).toBuffer()},connection,function(err2,content){if(running=!1,err2!=null)return process.nextTick(stream.emit.bind(stream,"error",err2));offset+=content.length,stream.push(content)})},cb(null,stream)}if(isFd)onOpen(null,fd);else request("open",{path},connection,onOpen)}});var require_parse_flags=__commonJS((exports,module)=>{var c=require_constants();module.exports=function(flags){var chars={__proto__:null};for(var i=0,n=flags.length;i<n;++i)chars[flags[i]]=!0;if("r"in chars)return c.FILE_OPEN;if("x"in chars)return c.FILE_CREATE;if("a"in chars)return c.FILE_OPEN_IF;if("w"in chars)return c.FILE_OVERWRITE_IF;throw Error("invalid flags")}});var require_createWriteStream=__commonJS((exports,module)=>{var Writable=__require("stream").Writable,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,options,cb){if(typeof options==="function")cb=options,options={};var connection=this,fd=options.fd,isFd=fd!=null,shouldClose=!isFd||options.autoClose==null||options.autoClose;function onCreate(err,file){if(err!=null)return cb(err);var offset=new BigInt2(8,options!=null&&options.start||0);function write(buffer,i,cb2){var j=i+constants.MAX_WRITE_LENGTH,chunk=buffer.slice(i,j);request("write",{Buffer:chunk,FileId:file.FileId,Offset:offset.toBuffer()},connection,function(err2){if(err2!=null)return cb2(err2);if(offset=offset.add(chunk.length),j<buffer.length)return write(buffer,j,cb2);cb2()})}var stream=new Writable;if(shouldClose){var close=request.bind(void 0,"close",file,connection);stream._destroy=function(err2,cb2){close(function(err22){if(err22!=null)return cb2(err22);cb2(err2)})},stream._final=close}stream._write=function(chunk,encoding,next){write(Buffer.isBuffer(chunk)?chunk:Buffer.from(chunk,encoding),0,next)},cb(null,stream)}if(isFd)onCreate(null,fd);else request("create",{createDisposition:parseFlags(options!=null&&options.flags||"wx"),path},connection,onCreate)}});var require_writeFile=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants(),parseFlags=require_parse_flags();module.exports=function(filename,data,options,cb){if(typeof options==="function")cb=options,options={};options.encoding=options.encoding||"utf8";var connection=this,file,fileContent=Buffer.isBuffer(data)?data:Buffer.from(data,options.encoding),fileLength=new BigInt2(8,fileContent.length);function createFile(fileCreated){SMB2Request("create",{createDisposition:parseFlags(options!=null&&(options.flags||options.flag)||"wx"),path:filename},connection,function(err,f){if(err)cb&&cb(err);else file=f,fileCreated()})}function closeFile(fileClosed){SMB2Request("close",file,connection,function(err){if(err)cb&&cb(err);else file=null,fileClosed()})}function setFileSize(fileSizeSetted){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,function(err){if(err)cb&&cb(err);else fileSizeSetted()})}function writeFile(fileWritten){var offset=new BigInt2(8),stop=!1,nbRemainingPackets=0,maxPacketSize=new BigInt2(8,constants.MAX_WRITE_LENGTH);function callback(){return function(err){if(stop)return;if(err)cb&&cb(err),stop=!0;else nbRemainingPackets--,checkDone()}}function checkDone(){if(stop)return;if(createPackets(),nbRemainingPackets===0&&offset.ge(fileLength))fileWritten()}function createPackets(){while(nbRemainingPackets<connection.packetConcurrency&&offset.lt(fileLength)){var rest=fileLength.sub(offset),packetSize=rest.gt(maxPacketSize)?maxPacketSize:rest;SMB2Request("write",{FileId:file.FileId,Offset:offset.toBuffer(),Buffer:fileContent.slice(offset.toNumber(),offset.add(packetSize).toNumber())},connection,callback(offset)),offset=offset.add(packetSize),nbRemainingPackets++}}checkDone()}createFile(function(){setFileSize(function(){writeFile(function(){closeFile(cb)})})})}});var require_unlink=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),constants=require_constants();module.exports=function(path,cb){var connection=this;SMB2Request("create",{path,shareAccess:constants.FILE_SHARE_DELETE},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)cb&&cb(err2);else cb&&cb(null,files)})})})}});var require_convert_time=__commonJS((exports,module)=>{var winTicks=1e7,uEpoch=11644473600;module.exports=function(time){var unixTime=time/winTicks-uEpoch;return new Date(unixTime*1000)}});var require_stats=__commonJS((exports,module)=>{var convert=require_convert_time(),BigInt2=require_bigint(),DIRECTORY=require_constants().DIRECTORY;module.exports=function(file){return{birthtime:convert(BigInt2.fromBuffer(file.CreationTime).toNumber()),atime:convert(BigInt2.fromBuffer(file.LastAccessTime).toNumber()),mtime:convert(BigInt2.fromBuffer(file.LastWriteTime).toNumber()),ctime:convert(BigInt2.fromBuffer(file.ChangeTime).toNumber()),size:BigInt2.fromBuffer(file.EndofFile).toNumber(),isDirectory:function(){var attr=file.FileAttributes;if(typeof attr!=="number")attr=BigInt2.fromBuffer(attr).toNumber();return(attr&DIRECTORY)==DIRECTORY}}}});var require_readdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,stats=require_stats();module.exports=function(path,options,cb){var connection=this;if(typeof options==="function")cb=options,options={};var mapping=options.stats?function(v){var obj=stats(v);return obj.name=v.Filename,obj}:function(v){return v.Filename};function queryDirectory(filesBatch,file,connection2,cb2){SMB2Request("query_directory",file,connection2,function(err,files){if(err)if(err.code==="STATUS_NO_MORE_FILES")cb2(null,filesBatch);else cb2(err);else filesBatch.push(files.filter(function(v){return v.Filename!=="."&&v.Filename!==".."}).map(mapping)),queryDirectory(filesBatch,file,connection2,cb2)})}function openDirectory(path2,connection2,cb2){SMB2Request("open",{path:path2},connection2,function(err,file){if(err)cb2(err);else return cb2(null,file)})}function closeDirectory(file,connection2,cb2){SMB2Request("close",file,connection2,function(err,res){if(err){if(err.code!=="STATUS_FILE_CLOSED")cb2(err)}cb2(null,res)})}openDirectory(path,connection,function(err,file){var totalFiles=[],filesBatch=[];if(err)cb(err);else queryDirectory(filesBatch,file,connection,function(err2,file2){if(err2)cb(err2);else closeDirectory(file2,connection,function(err3,file3){if(err3)cb(err3);else totalFiles=[].concat(...filesBatch),cb(null,totalFiles)})})})}});var require_rmdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint();module.exports=function(path,cb){var connection=this;SMB2Request("open_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileDispositionInformation",Buffer:new BigInt2(1,1).toBuffer()},connection,function(err2,files){SMB2Request("close",file,connection,function(){if(err2)return cb(err2);cb(null,files)})})})}});var require_mkdir=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request;module.exports=function(path,mode,cb){if(typeof mode==="function")cb=mode,mode="0777";var connection=this;SMB2Request("create_folder",{path},connection,function(err,file){if(err)cb&&cb(err);else SMB2Request("close",file,connection,function(){cb&&cb(null)})})}});var require_getSize=__commonJS((exports,module)=>{var BigInt2=require_bigint(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,BigInt2.fromBuffer(file.EndofFile).toNumber())})})}});var require_stat=__commonJS((exports,module)=>{var stats=require_stats(),request=require_smb2_forge().request;module.exports=function(path,cb){var connection=this;request("open",{path},connection,function(err,file){if(err!=null)return cb(err);request("close",file,connection,function(){cb(null,stats(file))})})}});var require_open=__commonJS((exports,module)=>{var parseFlags=require_parse_flags(),request=require_smb2_forge().request;module.exports=function(path,flags,cb){if(typeof flags==="function")cb=flags,flags=void 0;request("create",{createDisposition:parseFlags(flags||"r"),path},this,cb)}});var require_read=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_READ_LENGTH=require_constants().MAX_READ_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){assert(start!==null,"null pos is not supported");var connection=this,end=Math.min(start+length,BigInt2.fromBuffer(file.EndofFile).toNumber()),pos=start;function onRead(err,chunk){if(err!=null)return cb(err,pos-start,buffer);chunk.copy(buffer,offset);var n=chunk.length;offset+=n,pos+=n,readChunk()}function readChunk(){if(pos>=end)return cb(null,pos-start,buffer);request("read",{FileId:file.FileId,Length:Math.min(MAX_READ_LENGTH,end-pos),Offset:new BigInt2(8,pos).toBuffer()},connection,onRead)}process.nextTick(readChunk)}});var require_write=__commonJS((exports,module)=>{var assert=__require("assert"),BigInt2=require_bigint(),request=require_smb2_forge().request,MAX_WRITE_LENGTH=require_constants().MAX_WRITE_LENGTH;module.exports=function(file,buffer,offset,length,start,cb){if(assert(Buffer.isBuffer(buffer)),offset==null)offset=0;else assert.strictEqual(typeof offset,"number"),assert(offset>0),assert(offset<buffer.length);if(length==null)length=buffer.length-offset;else assert.strictEqual(typeof length,"number"),assert(length>0),length=Math.min(length,buffer.length-offset);assert.strictEqual(typeof start,"number");var connection=this,pos=start,chunkLength;function onWrite(err){if(err!=null)return cb(err,pos-start,buffer);length-=chunkLength,offset+=chunkLength,pos+=chunkLength,writeChunk()}function writeChunk(){if(length<=0)return cb(null,pos-start,buffer);chunkLength=Math.min(MAX_WRITE_LENGTH,length),request("write",{Buffer:buffer.slice(offset,offset+chunkLength),FileId:file.FileId,Offset:new BigInt2(8,pos).toBuffer()},connection,onWrite)}process.nextTick(writeChunk)}});var require_close=__commonJS((exports,module)=>{var request=require_smb2_forge().request;module.exports=function(file,cb){request("close",file,this,cb)}});var require_truncate=__commonJS((exports,module)=>{var SMB2Forge=require_smb2_forge(),SMB2Request=SMB2Forge.request,BigInt2=require_bigint(),FILE_WRITE_DATA=require_constants().FILE_WRITE_DATA;function setFileSize(file,fileLength,connection,cb){SMB2Request("set_info",{FileId:file.FileId,FileInfoClass:"FileEndOfFileInformation",Buffer:fileLength.toBuffer()},connection,cb)}module.exports=function(path,length,cb){var connection=this;SMB2Request("open",{path,desiredAccess:FILE_WRITE_DATA},connection,function(err,file){if(err!=null)return cb(err);setFileSize(file,new BigInt2(8,length),connection,function(err2){SMB2Request("close",file,connection,function(){cb(err2)})})})}});var require_smb2=__commonJS((exports,module)=>{var shareRegExp=/\\\\([^\\]*)\\([^\\]*)\\?/,port=445,packetConcurrency=20,autoCloseTimeout=1e4,autoPromise=require_auto_promise(),SMB2Connection=require_smb2_connection(),SMB=module.exports=function(opt){opt=opt||{};var matches;if(!opt.share||!(matches=opt.share.match(shareRegExp)))throw Error("the share is not valid");if(this.ip=matches[1],this.port=opt.port||port,this.share=matches[2],this.fullPath=opt.share,this.packetConcurrency=opt.packetConcurrency||packetConcurrency,opt.autoCloseTimeout!==void 0)this.autoCloseTimeout=opt.autoCloseTimeout;else this.autoCloseTimeout=autoCloseTimeout;this.domain=opt.domain,this.username=opt.username,this.password=opt.password,this.ProcessId=Buffer.from([Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&255,Math.floor(Math.random()*256)&254]),this.debug=opt.debug,SMB2Connection.init(this)},proto=SMB.prototype={};proto.disconnect=require_disconnect();proto.exists=autoPromise(SMB2Connection.requireConnect(require_exists()));proto.rename=autoPromise(SMB2Connection.requireConnect(require_rename()));proto.readFile=autoPromise(SMB2Connection.requireConnect(require_readFile()));proto.createReadStream=autoPromise(SMB2Connection.requireConnect(require_createReadStream()));proto.createWriteStream=autoPromise(SMB2Connection.requireConnect(require_createWriteStream()));proto.writeFile=autoPromise(SMB2Connection.requireConnect(require_writeFile()));proto.unlink=autoPromise(SMB2Connection.requireConnect(require_unlink()));proto.readdir=autoPromise(SMB2Connection.requireConnect(require_readdir()));proto.rmdir=autoPromise(SMB2Connection.requireConnect(require_rmdir()));proto.mkdir=autoPromise(SMB2Connection.requireConnect(require_mkdir()));proto.getSize=autoPromise(SMB2Connection.requireConnect(require_getSize()));proto.stat=autoPromise(SMB2Connection.requireConnect(require_stat()));proto.open=autoPromise(SMB2Connection.requireConnect(require_open()));proto.read=autoPromise(require_read(),function(bytesRead,buffer){return{bytesRead,buffer}});proto.write=autoPromise(require_write(),function(bytesWritten,buffer){return{bytesWritten,buffer}});proto.close=autoPromise(require_close());proto.truncate=autoPromise(SMB2Connection.requireConnect(require_truncate()))});import{createHash,randomBytes}from"crypto";var API_KEY_BYTE_LENGTH=32,HASH_ALGORITHM="sha256",generateApiKey=(prefix="nk_live")=>{let randomPart=randomBytes(API_KEY_BYTE_LENGTH).toString("hex"),rawKey=`${prefix}_${randomPart}`,keyHash=hashApiKey(rawKey),keyPreview=`${prefix}_...${randomPart.slice(-4)}`;return{rawKey,keyHash,keyPreview}},hashApiKey=(rawKey)=>{return createHash(HASH_ALGORITHM).update(rawKey).digest("hex")},validateApiKeyFormat=(rawKey)=>{return/^nk_(live|test)_[a-f0-9]{64}$/.test(rawKey)},extractApiKeyFromHeader=(headers)=>{let apiKeyHeader=headers.get("x-api-key");if(apiKeyHeader&&validateApiKeyFormat(apiKeyHeader))return apiKeyHeader;let authHeader=headers.get("authorization");if(authHeader){let bearerMatch=authHeader.match(/^Bearer\s+(nk_(?:live|test)_[a-f0-9]{64})$/);if(bearerMatch?.[1])return bearerMatch[1]}return null},validateApiKeyRecord=(record)=>{if(!record.isActive)return{valid:!1,reason:"API key is inactive"};if(record.revokedAt)return{valid:!1,reason:"API key has been revoked"};if(record.expiresAt&&new Date(record.expiresAt)<new Date)return{valid:!1,reason:"API key has expired"};return{valid:!0,record}},intersectPermissions=(userPermissions,keyPermissions)=>{let userSet=new Set(userPermissions);return keyPermissions.filter((p)=>userSet.has(p))};var init_ApiKey=()=>{};var normalize=(value)=>{return value?.trim().toLowerCase()||"unknown"},extractHeaderValue=(headers,key)=>{return headers[key.toLowerCase()]??headers[key]};import crypto2 from"crypto";var generateDeviceFingerprint=(input)=>{let payload=JSON.stringify({userAgent:normalize(input.userAgent),extra:input.extra??{}});return{hash:crypto2.createHash("sha256").update(payload).digest("base64url"),components:input}};var init_Generate=()=>{};var validateDeviceFingerprint=({savedFingerprint,requestIp,headers})=>{let userAgent=extractHeaderValue(headers,"user-agent"),forwardedFor=extractHeaderValue(headers,"x-forwarded-for")??requestIp??void 0,currentFingerprint=generateDeviceFingerprint({userAgent,ipAddress:forwardedFor}),componentMismatch=[{field:"userAgent",saved:savedFingerprint.components.userAgent,received:userAgent},{field:"ipAddress",saved:savedFingerprint.components.ipAddress,received:forwardedFor}].find(({saved,received})=>saved??(received??"")!=="");if(componentMismatch)return{isValid:!1,reason:`${componentMismatch.field} mismatch`,currentFingerprint};return{isValid:!0,currentFingerprint}};var init_Validate=__esm(()=>{init_Generate()});var init_Fingerprint=__esm(()=>{init_Generate();init_Validate()});import crypto3 from"crypto";var base64UrlEncode=(data)=>{return(Buffer.isBuffer(data)?data.toString("base64"):Buffer.from(data).toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},base64UrlDecode=(data)=>{let padding="=".repeat((4-data.length%4)%4),base64=data.replace(/-/g,"+").replace(/_/g,"/")+padding;return Buffer.from(base64,"base64").toString("utf-8")},createSignature=(data,secret,algorithm)=>{let hmacAlgorithm=algorithm.replace("HS","sha"),hmac=crypto3.createHmac(hmacAlgorithm,secret);return hmac.update(data),base64UrlEncode(hmac.digest())},verifySignature=(data,signature,secret,algorithm)=>{let expectedSignature=createSignature(data,secret,algorithm),sigBuf=Buffer.from(signature),expBuf=Buffer.from(expectedSignature);if(sigBuf.length!==expBuf.length)return!1;return crypto3.timingSafeEqual(sigBuf,expBuf)},encodeHeader=(header)=>{return base64UrlEncode(JSON.stringify(header))},encodePayload=(payload)=>{return base64UrlEncode(JSON.stringify(payload))},decodeHeader=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}},decodePayload=(encoded)=>{try{return JSON.parse(base64UrlDecode(encoded))}catch{return null}};var init_utils2=()=>{};var decodeJWT=(token)=>{let parts=token.split(".");if(parts.length!==3)return null;let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return null;let header=decodeHeader(encodedHeader),payload=decodePayload(encodedPayload);if(!header||!payload)return null;return{header,payload,signature}};var init_Decode=__esm(()=>{init_utils2()});import{randomUUID}from"crypto";var signJWT=(options,secret,algorithm="HS256")=>{let header={alg:algorithm,typ:"JWT"},now=Math.floor(Date.now()/1000),payload={sub:options.subject,iat:now,...options.expiresInSeconds===null?{}:{exp:now+options.expiresInSeconds},iss:options.issuer,aud:options.audience,jti:options.jwtId||randomUUID(),sessionId:options.sessionId,...options.customClaims},encodedHeader=encodeHeader(header),encodedPayload=encodePayload(payload),dataToSign=`${encodedHeader}.${encodedPayload}`,signature=createSignature(dataToSign,secret,algorithm);return`${dataToSign}.${signature}`};var init_Sign=__esm(()=>{init_utils2()});var audienceMatches=(aud,expected)=>{if(typeof aud==="string")return aud===expected;if(Array.isArray(aud))return aud.includes(expected);return!1},verifyJWT=(token,secret,expected)=>{let parts=token.split(".");if(parts.length!==3)return{valid:!1,error:"Invalid token format: expected 3 parts"};let[encodedHeader,encodedPayload,signature]=parts;if(!encodedHeader||!encodedPayload||!signature)return{valid:!1,error:"Invalid token format: missing parts"};let header=decodeHeader(encodedHeader);if(!header)return{valid:!1,error:"Invalid header: failed to decode"};if(header.typ!=="JWT")return{valid:!1,error:"Invalid header: typ must be JWT"};if(!["HS256","HS384","HS512"].includes(header.alg))return{valid:!1,error:`Unsupported algorithm: ${header.alg}`};let dataToVerify=`${encodedHeader}.${encodedPayload}`;if(!verifySignature(dataToVerify,signature,secret,header.alg))return{valid:!1,error:"Invalid signature"};let payload=decodePayload(encodedPayload);if(!payload)return{valid:!1,error:"Invalid payload: failed to decode"};let now=Math.floor(Date.now()/1000);if(payload.exp&&payload.exp<now)return{valid:!1,error:"Token expired"};if(payload.iat&&payload.iat>now+60)return{valid:!1,error:"Token issued in the future"};if(expected?.issuer&&payload.iss!==expected.issuer)return{valid:!1,error:"Invalid issuer"};if(expected?.audience&&!audienceMatches(payload.aud,expected.audience))return{valid:!1,error:"Invalid audience"};return{valid:!0,payload}};var init_Verify=__esm(()=>{init_utils2()});var exports_JWT={};__export(exports_JWT,{verifyJWT:()=>verifyJWT,signJWT:()=>signJWT,decodeJWT:()=>decodeJWT});var init_JWT=__esm(()=>{init_Decode();init_Sign();init_Verify()});var init_Generate2=()=>{};var init_Password=__esm(()=>{init_Generate2()});var init_Logger2=__esm(()=>{init_auditTaxonomy();init_Logger();init_ServerLogBuffer();init_transports();init_utils();init_scopes()});var DEFAULT_DAPR_HOST="127.0.0.1",DEFAULT_DAPR_PORT="3500",DEFAULT_MAX_BODY_SIZE_MB=4,DEFAULT_STATE_STORE="statestore-redis",DEFAULT_PUBSUB_NAME="pubsub-rabbitmq",DEFAULT_SECRET_STORE="secretstore",DEFAULT_CONFIG_STORE="configstore-redis",ENV_DAPR_HOST="DAPR_HOST",ENV_DAPR_HTTP_PORT="DAPR_HTTP_PORT",ENV_DAPR_HTTP_ENDPOINT="DAPR_HTTP_ENDPOINT",ENV_DAPR_GRPC_ENDPOINT="DAPR_GRPC_ENDPOINT",ENV_DAPR_API_TOKEN="DAPR_API_TOKEN",DEFAULT_OPERATION_TIMEOUT_MS=30000,DEFAULT_CONNECTION_TIMEOUT_MS=1e4,DEFAULT_HEALTH_CHECK_TIMEOUT_MS=5000,CONNECTION_STATUS,HEALTH_STATUS,ERROR_CODES;var init_constants=__esm(()=>{CONNECTION_STATUS={CONNECTED:"connected",DISCONNECTED:"disconnected",CONNECTING:"connecting",ERROR:"error"},HEALTH_STATUS={HEALTHY:"healthy",UNHEALTHY:"unhealthy"},ERROR_CODES={CONNECTION_ERROR:"DAPR_CONNECTION_ERROR",TIMEOUT_ERROR:"DAPR_TIMEOUT_ERROR",STATE_ERROR:"DAPR_STATE_ERROR",PUBSUB_ERROR:"DAPR_PUBSUB_ERROR",BINDING_ERROR:"DAPR_BINDING_ERROR",SECRET_ERROR:"DAPR_SECRET_ERROR",CONFIG_ERROR:"DAPR_CONFIG_ERROR",INVOKE_ERROR:"DAPR_INVOKE_ERROR",CRYPTO_ERROR:"DAPR_CRYPTO_ERROR",LOCK_ERROR:"DAPR_LOCK_ERROR",WORKFLOW_ERROR:"DAPR_WORKFLOW_ERROR",VALIDATION_ERROR:"DAPR_VALIDATION_ERROR"}});var DaprManagerError,createConnectionError=(message,details)=>new DaprManagerError(ERROR_CODES.CONNECTION_ERROR,message,details),createTimeoutError=(message,details)=>new DaprManagerError(ERROR_CODES.TIMEOUT_ERROR,message,details),createStateError=(message,details)=>new DaprManagerError(ERROR_CODES.STATE_ERROR,message,details),createPubSubError=(message,details)=>new DaprManagerError(ERROR_CODES.PUBSUB_ERROR,message,details),createBindingError=(message,details)=>new DaprManagerError(ERROR_CODES.BINDING_ERROR,message,details),createSecretError=(message,details)=>new DaprManagerError(ERROR_CODES.SECRET_ERROR,message,details),createConfigError=(message,details)=>new DaprManagerError(ERROR_CODES.CONFIG_ERROR,message,details),createInvokeError=(message,details)=>new DaprManagerError(ERROR_CODES.INVOKE_ERROR,message,details),createCryptoError=(message,details)=>new DaprManagerError(ERROR_CODES.CRYPTO_ERROR,message,details),createLockError=(message,details)=>new DaprManagerError(ERROR_CODES.LOCK_ERROR,message,details),createWorkflowError=(message,details)=>new DaprManagerError(ERROR_CODES.WORKFLOW_ERROR,message,details),safeExecute=async(operation,errorCreator)=>{try{return await operation()}catch(error){let errorMessage=error instanceof Error?error.message:String(error);throw errorCreator(errorMessage,error)}};var init_error_handling=__esm(()=>{init_constants();DaprManagerError=class DaprManagerError extends Error{code;details;constructor(code,message,details){super(message);this.name="DaprManagerError",this.code=code,this.details=details}toJSON(){return{code:this.code,message:this.message,details:this.details}}}});var LOG_LEVEL_PRIORITY2,createDefaultLogger=(minLevel="info")=>{let minPriority=LOG_LEVEL_PRIORITY2[minLevel],scoped=logger.scoped("dapr.client"),logWithLevel=(level)=>(message,...meta)=>{if(LOG_LEVEL_PRIORITY2[level]<minPriority)return;let context=meta.length>0?{meta}:void 0;if(level==="error")scoped.error(message,void 0,context);else scoped[level](message,context)};return{debug:logWithLevel("debug"),info:logWithLevel("info"),warn:logWithLevel("warn"),error:logWithLevel("error")}},withTimeout=async(fn,timeoutMs,errorMessage="Operation timed out")=>{return Promise.race([fn(),new Promise((_,reject)=>{setTimeout(()=>{reject(createTimeoutError(errorMessage))},timeoutMs)})])},validateRequired=(params,requiredKeys,entityName)=>{let missingKeys=requiredKeys.filter((key)=>params[key]===void 0);if(missingKeys.length>0)throw Error(`Missing required ${entityName} parameters: ${missingKeys.join(", ")}`)};var init_utils3=__esm(()=>{init_Logger2();init_constants();init_error_handling();LOG_LEVEL_PRIORITY2={debug:0,info:1,warn:2,error:3}});class DaprBindingClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(name,operation,data,options={}){return validateRequired({name,operation},["name","operation"],"binding invoke"),safeExecute(async()=>{this.logger.debug("Invoking binding",{name,operation});let response=await(await this.client()).binding.send(name,operation,data,options.metadata);return this.logger.debug("Binding invoked successfully",{name,operation}),response},(message,details)=>createBindingError(`Failed to invoke binding ${name}: ${message}`,details))}}var init_binding_client=__esm(()=>{init_error_handling();init_utils3()});class DaprConfigClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(keys,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"config get"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting configuration",{keys,storeName});let response=await(await this.client()).configuration.get(storeName,keys);return this.logger.debug("Configuration retrieved",{keys,storeName,itemCount:Object.keys(response.items||{}).length}),response.items||{}},(message,details)=>createConfigError(`Failed to get configuration: ${message}`,details))}async subscribeWithKeys(keys,callback,storeName=DEFAULT_CONFIG_STORE){if(validateRequired({keys,callback,storeName},["keys","callback","storeName"],"config subscribeWithKeys"),keys.length===0)throw createConfigError("At least one key must be provided for subscription");return safeExecute(async()=>{this.logger.debug("Subscribing to configuration updates",{keys,storeName});let stream=await(await this.client()).configuration.subscribeWithKeys(storeName,keys,async(data)=>{try{this.logger.debug("Received configuration update",{storeName,updatedKeys:Object.keys(data.items||{})}),await callback(data)}catch(error){this.logger.error("Error in configuration subscription callback",error)}});return this.logger.debug("Configuration subscription established",{keys,storeName}),{stop:()=>{this.logger.debug("Stopping configuration subscription",{keys,storeName}),stream.stop()}}},(message,details)=>createConfigError(`Failed to subscribe to configuration updates: ${message}`,details))}async getValue(key,storeName=DEFAULT_CONFIG_STORE){return(await this.get([key],storeName))[key]?.value}async getValues(keys,storeName=DEFAULT_CONFIG_STORE){let items=await this.get(keys,storeName),values={};for(let key in items)if(items[key]?.value!==void 0)values[key]=items[key].value;return values}}var init_config_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprCryptoClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async encrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto encrypt"),safeExecute(async()=>{this.logger.debug("Encrypting data",{componentName:options.componentName,keyName:options.keyName,keyWrapAlgorithm:options.keyWrapAlgorithm});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let encryptedData=await client.crypto.encrypt(inputData,cryptoOptions);return this.logger.debug("Data encrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:encryptedData.length}),encryptedData},(message,details)=>createCryptoError(`Failed to encrypt data: ${message}`,details))}async decrypt(data,options){return validateRequired({data,componentName:options.componentName},["data","componentName"],"crypto decrypt"),safeExecute(async()=>{this.logger.debug("Decrypting data",{componentName:options.componentName});let client=await this.client(),inputData=typeof data==="string"?Buffer.from(data):data,cryptoOptions={componentName:options.componentName};if(options.keyName)cryptoOptions.keyName=options.keyName;if(options.keyWrapAlgorithm)cryptoOptions.keyWrapAlgorithm=options.keyWrapAlgorithm;let decryptedData=await client.crypto.decrypt(inputData,cryptoOptions);return this.logger.debug("Data decrypted successfully",{componentName:options.componentName,inputSize:inputData.length,outputSize:decryptedData.length}),decryptedData},(message,details)=>createCryptoError(`Failed to decrypt data: ${message}`,details))}async encryptString(plaintext,options){return(await this.encrypt(plaintext,options)).toString("base64")}async decryptString(ciphertext,options){let encryptedBuffer=Buffer.from(ciphertext,"base64");return(await this.decrypt(encryptedBuffer,options)).toString("utf-8")}}var init_crypto_client=__esm(()=>{init_error_handling();init_utils3()});function dapr(){if(!cachedDapr)cachedDapr=__require("@dapr/dapr");return cachedDapr}class DaprInvokeClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async invoke(appId,methodName,httpMethod,data,options={}){httpMethod??=dapr().HttpMethod.POST,validateRequired({appId,methodName,httpMethod},["appId","methodName","httpMethod"],"invoke service");let timeoutMs=options.timeout||DEFAULT_OPERATION_TIMEOUT_MS;return safeExecute(async()=>{this.logger.debug("Invoking service",{appId,methodName,httpMethod,hasData:data!==void 0});let fullMethodName=methodName;if(options.queryParams&&Object.keys(options.queryParams).length>0){let queryString=Object.entries(options.queryParams).map(([key,value])=>`${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");fullMethodName=`${methodName}?${queryString}`}let client=await this.client(),response=await withTimeout(()=>client.invoker.invoke(appId,fullMethodName,httpMethod,data,options.headers),timeoutMs,`Service invocation timed out after ${timeoutMs}ms`);if(this.logger.debug("Service invoked successfully",{appId,methodName,httpMethod,status:response?.status}),!response)return;if("data"in response)return response.data;return response},(message,details)=>createInvokeError(`Failed to invoke service ${appId}.${methodName}: ${message}`,details))}async get(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.GET,void 0,options)}async post(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.POST,data,options)}async put(appId,methodName,data,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.PUT,data,options)}async delete(appId,methodName,options={}){return this.invoke(appId,methodName,dapr().HttpMethod.DELETE,void 0,options)}}var cachedDapr=null;var init_invoke_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprLockClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async lock(storeName,resourceId,lockOwner,options){return validateRequired({storeName,resourceId,lockOwner,expiryInSeconds:options.expiryInSeconds},["storeName","resourceId","lockOwner","expiryInSeconds"],"lock"),safeExecute(async()=>{this.logger.debug("Acquiring lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.lock(storeName,resourceId,lockOwner,options.expiryInSeconds);return this.logger.debug("Lock acquisition result",{storeName,resourceId,lockOwner,success:response.success}),{success:response.success}},(message,details)=>createLockError(`Failed to acquire lock for resource ${resourceId}: ${message}`,details))}async unlock(storeName,resourceId,lockOwner){return validateRequired({storeName,resourceId,lockOwner},["storeName","resourceId","lockOwner"],"unlock"),safeExecute(async()=>{this.logger.debug("Releasing lock",{storeName,resourceId,lockOwner});let response=await(await this.client()).lock.unlock(storeName,resourceId,lockOwner);return this.logger.debug("Lock release result",{storeName,resourceId,lockOwner,status:this.getLockStatusName(response.status)}),{status:response.status}},(message,details)=>createLockError(`Failed to release lock for resource ${resourceId}: ${message}`,details))}getLockStatusName(status){switch(status){case 0:return"Success";case 1:return"LockDoesNotExist";case 2:return"LockBelongsToOthers";default:return"InternalError"}}}var init_lock_client=__esm(()=>{init_error_handling();init_utils3()});class DaprPubSubClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async publish(topic,data,options={},pubsubName=DEFAULT_PUBSUB_NAME){return validateRequired({topic,data,pubsubName},["topic","data","pubsubName"],"pubsub publish"),safeExecute(async()=>{this.logger.debug("Publishing message to topic",{topic,pubsubName}),await(await this.client()).pubsub.publish(pubsubName,topic,data,{metadata:options.metadata,contentType:options.contentType}),this.logger.debug("Message published successfully",{topic,pubsubName})},(message,details)=>createPubSubError(`Failed to publish message to topic ${topic}: ${message}`,details))}async publishBulk(topic,messages,pubsubName=DEFAULT_PUBSUB_NAME){if(validateRequired({topic,messages,pubsubName},["topic","messages","pubsubName"],"pubsub publishBulk"),messages.length===0)return{failedEntries:[]};return safeExecute(async()=>{this.logger.debug("Publishing bulk messages to topic",{topic,pubsubName,messageCount:messages.length});let client=await this.client(),daprMessages=messages.map((msg)=>{if(typeof msg==="object"&&"event"in msg)return{entryID:msg.entryId,event:msg.event,contentType:msg.contentType,metadata:msg.metadata};return{event:msg}}),response=await client.pubsub.publishBulk(pubsubName,topic,daprMessages),failedCount=response.failedMessages?.length||0;if(failedCount>0)this.logger.warn("Some messages failed to publish",{topic,pubsubName,failedCount,totalCount:messages.length});else this.logger.debug("All bulk messages published successfully",{topic,pubsubName,messageCount:messages.length});return{failedEntries:(response.failedMessages||[]).map((failed)=>({entryId:failed.message.entryID||"",error:failed.error?.message||"Unknown error"}))}},(message,details)=>createPubSubError(`Failed to publish bulk messages to topic ${topic}: ${message}`,details))}createBulkPublishMessage(event,entryId,contentType,metadata){return{entryId,event,contentType,metadata}}}var init_pubsub_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprSecretClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async get(key,options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({key,storeName},["key","storeName"],"secret get"),safeExecute(async()=>{this.logger.debug("Getting secret",{key,storeName});let client=await this.client(),metadataStr=options.metadata?JSON.stringify(options.metadata):void 0,result=await client.secret.get(storeName,key,metadataStr);return this.logger.debug("Secret retrieved",{key,storeName}),result},(message,details)=>createSecretError(`Failed to get secret ${key}: ${message}`,details))}async getBulk(_options={},storeName=DEFAULT_SECRET_STORE){return validateRequired({storeName},["storeName"],"secret getBulk"),safeExecute(async()=>{this.logger.debug("Getting all secrets",{storeName});let result=await(await this.client()).secret.getBulk(storeName);return this.logger.debug("All secrets retrieved",{storeName,secretCount:Object.keys(result).length}),result},(message,details)=>createSecretError(`Failed to get all secrets: ${message}`,details))}}var init_secret_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprStateClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async save(stateItems,options={},storeName=DEFAULT_STATE_STORE){if(validateRequired({stateItems,storeName},["stateItems","storeName"],"state save"),stateItems.length===0)return;return safeExecute(async()=>{this.logger.debug("Saving state items",{count:stateItems.length,storeName}),await(await this.client()).state.save(storeName,stateItems,options),this.logger.debug("State items saved successfully",{count:stateItems.length,storeName})},(message,details)=>createStateError(`Failed to save state items: ${message}`,details))}async get(key,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state get"),safeExecute(async()=>{this.logger.debug("Getting state item",{key,storeName});let result=await(await this.client()).state.get(storeName,key);if(this.logger.debug("State item retrieved",{key,storeName,found:result!==void 0&&result!==null&&result!==""}),result===void 0||result===null)return;if(typeof result==="string")try{return JSON.parse(result)}catch{return result}if(typeof result==="object")return result;return result},(message,details)=>createStateError(`Failed to get state item ${key}: ${message}`,details))}async getBulk(keys,storeName=DEFAULT_STATE_STORE){if(validateRequired({keys,storeName},["keys","storeName"],"state getBulk"),keys.length===0)return{};return safeExecute(async()=>{this.logger.debug("Getting bulk state items",{count:keys.length,storeName});let results=await(await this.client()).state.getBulk(storeName,keys),resultMap={};return results.forEach((item)=>{if(item.data!==void 0)resultMap[item.key]=item.data}),this.logger.debug("Bulk state items retrieved",{count:keys.length,found:Object.keys(resultMap).length,storeName}),resultMap},(message,details)=>createStateError(`Failed to get bulk state items: ${message}`,details))}async delete(key,etag,metadata,storeName=DEFAULT_STATE_STORE){return validateRequired({key,storeName},["key","storeName"],"state delete"),safeExecute(async()=>{this.logger.debug("Deleting state item",{key,storeName});let client=await this.client(),options={};if(etag)options.etag=etag;if(metadata)options.metadata=metadata;await client.state.delete(storeName,key,options),this.logger.debug("State item deleted",{key,storeName})},(message,details)=>createStateError(`Failed to delete state item ${key}: ${message}`,details))}async transaction(operations,storeName=DEFAULT_STATE_STORE){if(validateRequired({operations,storeName},["operations","storeName"],"state transaction"),operations.length===0)return;return safeExecute(async()=>{this.logger.debug("Executing state transaction",{operationCount:operations.length,storeName});let client=await this.client(),daprOperations=operations.map((op)=>({operation:op.operation,request:{key:op.request.key,value:op.request.value,etag:op.request.etag?{value:op.request.etag}:void 0,metadata:op.request.metadata}}));await client.state.transaction(storeName,daprOperations),this.logger.debug("State transaction executed successfully",{operationCount:operations.length,storeName})},(message,details)=>createStateError(`Failed to execute state transaction: ${message}`,details))}async query(query,storeName=DEFAULT_STATE_STORE){return validateRequired({query,storeName},["query","storeName"],"state query"),safeExecute(async()=>{this.logger.debug("Querying state store",{storeName});let result=await(await this.client()).state.query(storeName,query);return this.logger.debug("State query executed",{storeName,resultCount:result.results?.length||0}),(result.results||[]).map((item)=>item.data)},(message,details)=>createStateError(`Failed to query state store: ${message}`,details))}async saveItem(key,value,options={},storeName=DEFAULT_STATE_STORE){let stateItem={key,value};return this.save([stateItem],options,storeName)}async upsert(key,value,options={},storeName=DEFAULT_STATE_STORE){return this.saveItem(key,value,options,storeName)}}var init_state_client=__esm(()=>{init_constants();init_error_handling();init_utils3()});class DaprWorkflowClient{client;logger;constructor(clientProvider,logger2){this.client=clientProvider,this.logger=logger2}async start(workflowName,input,options={}){return validateRequired({workflowName},["workflowName"],"workflow start"),safeExecute(async()=>{this.logger.debug("Starting workflow",{workflowName,instanceId:options.instanceId||"auto-generated",workflowComponent:options.workflowComponent});let instanceId=await(await this.client()).workflow.start(workflowName,input,options.instanceId);return this.logger.debug("Workflow started",{workflowName,instanceId}),instanceId},(message,details)=>createWorkflowError(`Failed to start workflow ${workflowName}: ${message}`,details))}async get(instanceId){return validateRequired({instanceId},["instanceId"],"workflow get"),safeExecute(async()=>{this.logger.debug("Getting workflow instance",{instanceId});let instance=await(await this.client()).workflow.get(instanceId);return this.logger.debug("Workflow instance retrieved",{instanceId,workflowName:instance.workflowName,runtimeStatus:instance.runtimeStatus}),{instanceId:instance.instanceID,workflowName:instance.workflowName,createdAt:new Date(instance.createdAt),lastUpdatedAt:new Date(instance.lastUpdatedAt),runtimeStatus:instance.runtimeStatus,properties:instance.properties||{}}},(message,details)=>createWorkflowError(`Failed to get workflow instance ${instanceId}: ${message}`,details))}async terminate(instanceId){return validateRequired({instanceId},["instanceId"],"workflow terminate"),safeExecute(async()=>{this.logger.debug("Terminating workflow instance",{instanceId}),await(await this.client()).workflow.terminate(instanceId),this.logger.debug("Workflow instance terminated",{instanceId})},(message,details)=>createWorkflowError(`Failed to terminate workflow instance ${instanceId}: ${message}`,details))}async pause(instanceId){return validateRequired({instanceId},["instanceId"],"workflow pause"),safeExecute(async()=>{this.logger.debug("Pausing workflow instance",{instanceId}),await(await this.client()).workflow.pause(instanceId),this.logger.debug("Workflow instance paused",{instanceId})},(message,details)=>createWorkflowError(`Failed to pause workflow instance ${instanceId}: ${message}`,details))}async resume(instanceId){return validateRequired({instanceId},["instanceId"],"workflow resume"),safeExecute(async()=>{this.logger.debug("Resuming workflow instance",{instanceId}),await(await this.client()).workflow.resume(instanceId),this.logger.debug("Workflow instance resumed",{instanceId})},(message,details)=>createWorkflowError(`Failed to resume workflow instance ${instanceId}: ${message}`,details))}async purge(instanceId){return validateRequired({instanceId},["instanceId"],"workflow purge"),safeExecute(async()=>{this.logger.debug("Purging workflow instance",{instanceId}),await(await this.client()).workflow.purge(instanceId),this.logger.debug("Workflow instance purged",{instanceId})},(message,details)=>createWorkflowError(`Failed to purge workflow instance ${instanceId}: ${message}`,details))}async raiseEvent(instanceId,eventName,eventData){return validateRequired({instanceId,eventName},["instanceId","eventName"],"workflow raiseEvent"),safeExecute(async()=>{this.logger.debug("Raising event for workflow instance",{instanceId,eventName}),await(await this.client()).workflow.raise(instanceId,eventName,eventData),this.logger.debug("Event raised for workflow instance",{instanceId,eventName})},(message,details)=>createWorkflowError(`Failed to raise event ${eventName} for workflow instance ${instanceId}: ${message}`,details))}}var init_workflow_client=__esm(()=>{init_error_handling();init_utils3()});function dapr2(){if(!cachedDapr2)cachedDapr2=__require("@dapr/dapr");return cachedDapr2}class DaprConnectionManager{client=null;daprHost;daprPort;communicationProtocolOption;maxBodySizeMb;daprApiToken;logger;connectionStatus=CONNECTION_STATUS.DISCONNECTED;connectionPromise=null;constructor(options={}){this.daprHost=options.daprHost||process.env[ENV_DAPR_HOST]||DEFAULT_DAPR_HOST,this.daprPort=options.daprPort||process.env[ENV_DAPR_HTTP_PORT]||DEFAULT_DAPR_PORT,this.communicationProtocolOption=options.communicationProtocol,this.maxBodySizeMb=options.maxBodySizeMb||DEFAULT_MAX_BODY_SIZE_MB,this.daprApiToken=options.daprApiToken||process.env[ENV_DAPR_API_TOKEN],this.logger=options.logger||createDefaultLogger(),this.logger.info("DaprConnectionManager initialized",{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocolOption??"default (HTTP)"})}get communicationProtocol(){return this.communicationProtocolOption??dapr2().CommunicationProtocolEnum.HTTP}async getClient(){if(!this.client||this.connectionStatus!==CONNECTION_STATUS.CONNECTED)await this.connect();if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");return this.client}async connect(){if(this.connectionPromise)return this.connectionPromise;if(this.client&&this.connectionStatus===CONNECTION_STATUS.CONNECTED)return Promise.resolve();this.connectionStatus=CONNECTION_STATUS.CONNECTING,this.connectionPromise=this.establishConnection();try{await this.connectionPromise,this.connectionStatus=CONNECTION_STATUS.CONNECTED}catch(error){throw this.connectionStatus=CONNECTION_STATUS.ERROR,error}finally{this.connectionPromise=null}}async establishConnection(){try{this.logger.info("Connecting to Dapr sidecar",{daprHost:this.daprHost,daprPort:this.daprPort,protocol:this.communicationProtocol});let protocols=dapr2().CommunicationProtocolEnum,useEndpointFromEnv=process.env[ENV_DAPR_HTTP_ENDPOINT]&&this.communicationProtocol===protocols.HTTP||process.env[ENV_DAPR_GRPC_ENDPOINT]&&this.communicationProtocol===protocols.GRPC,clientOptions={communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,logger:{level:dapr2().LogLevel.Warn}};if(!useEndpointFromEnv)clientOptions.daprHost=this.daprHost,clientOptions.daprPort=this.daprPort;if(this.daprApiToken)clientOptions.daprApiToken=this.daprApiToken;await withTimeout(async()=>{this.client=new(dapr2()).DaprClient(clientOptions)},DEFAULT_CONNECTION_TIMEOUT_MS,"Connection to Dapr sidecar timed out"),await this.healthCheck(),this.logger.info("Successfully connected to Dapr sidecar")}catch(error){throw this.logger.error("Failed to connect to Dapr sidecar",error),this.client=null,createConnectionError(`Failed to connect to Dapr sidecar at ${this.daprHost}:${this.daprPort}`,error)}}async disconnect(){if(!this.client)return;try{this.logger.info("Disconnecting from Dapr sidecar"),this.client=null,this.connectionStatus=CONNECTION_STATUS.DISCONNECTED,this.logger.info("Disconnected from Dapr sidecar")}catch(error){throw this.logger.error("Error during disconnect",error),createConnectionError("Failed to disconnect from Dapr sidecar",error)}}isConnected(){return this.client!==null&&this.connectionStatus===CONNECTION_STATUS.CONNECTED}getConnectionStatus(){return this.connectionStatus}async healthCheck(){if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");try{return await withTimeout(async()=>{if(!this.client)throw createConnectionError("Not connected to Dapr sidecar");let response=await this.client.invoker.invoke("healthz","healthz",dapr2().HttpMethod.GET);return{status:response.status===204?HEALTH_STATUS.HEALTHY:HEALTH_STATUS.UNHEALTHY,version:response.headers?.["dapr-version"]||"unknown"}},DEFAULT_HEALTH_CHECK_TIMEOUT_MS,"Health check timed out")}catch(error){return this.logger.error("Health check failed",error),{status:HEALTH_STATUS.UNHEALTHY,version:"unknown"}}}getClientConfig(){return{daprHost:this.daprHost,daprPort:this.daprPort,communicationProtocol:this.communicationProtocol,maxBodySizeMb:this.maxBodySizeMb,hasApiToken:!!this.daprApiToken,connectionStatus:this.connectionStatus}}}var cachedDapr2=null;var init_connection_manager=__esm(()=>{init_constants();init_error_handling();init_utils3()});var init_types2=()=>{};class DaprManager{connectionManager;logger;_state;_pubsub;_binding;_secret;_config;_invoke;_lock;_crypto;_workflow;constructor(options={}){this.logger=options.logger||createDefaultLogger(),this.connectionManager=new DaprConnectionManager(options);let clientProvider=async()=>{return this.connectionManager.getClient()};this._state=new DaprStateClient(clientProvider,this.logger),this._pubsub=new DaprPubSubClient(clientProvider,this.logger),this._binding=new DaprBindingClient(clientProvider,this.logger),this._secret=new DaprSecretClient(clientProvider,this.logger),this._config=new DaprConfigClient(clientProvider,this.logger),this._invoke=new DaprInvokeClient(clientProvider,this.logger),this._lock=new DaprLockClient(clientProvider,this.logger),this._crypto=new DaprCryptoClient(clientProvider,this.logger),this._workflow=new DaprWorkflowClient(clientProvider,this.logger)}async connect(){await this.connectionManager.connect()}async disconnect(){await this.connectionManager.disconnect()}isConnected(){return this.connectionManager.isConnected()}getConnectionStatus(){return this.connectionManager.getConnectionStatus()}async healthCheck(){return this.connectionManager.healthCheck()}getClientConfig(){return this.connectionManager.getClientConfig()}get state(){return this._state}get pubsub(){return this._pubsub}get binding(){return this._binding}get secret(){return this._secret}get config(){return this._config}get invoke(){return this._invoke}get lock(){return this._lock}get crypto(){return this._crypto}get workflow(){return this._workflow}}function getDaprManager(){if(!daprManagerInstance)daprManagerInstance=new DaprManager;return daprManagerInstance}var daprManagerInstance=null,daprManager;var init_Dapr=__esm(()=>{init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_connection_manager();init_utils3();init_binding_client();init_config_client();init_crypto_client();init_invoke_client();init_lock_client();init_pubsub_client();init_secret_client();init_state_client();init_workflow_client();init_constants();init_error_handling();init_types2();daprManager=new Proxy({},{get(_target,property,receiver){let value=Reflect.get(getDaprManager(),property,receiver);return typeof value==="function"?value.bind(getDaprManager()):value},has(_target,property){return property in getDaprManager()}})});import Redis from"ioredis";class DirectRedisStore{client;constructor(client){this.client=client}async create(key,value,ttlSeconds){try{return{success:!0,data:ttlSeconds?await this.client.set(key,JSON.stringify(value),"EX",ttlSeconds):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async read(key){try{let raw=await this.client.get(key);return{success:!0,data:raw?JSON.parse(raw):null}}catch(error){return{success:!1,error:error.message}}}async update(key,value,preserveTtl=!0){try{return{success:!0,data:preserveTtl?await this.client.set(key,JSON.stringify(value),"KEEPTTL"):await this.client.set(key,JSON.stringify(value))}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return{success:!0,data:await this.client.del(key)}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.client.exists(key)===1}}catch(error){return{success:!1,error:error.message}}}getClient(){return this.client}}class DaprRedisStore{storeName;keyPrefix;dapr;constructor(storeName,keyPrefix=""){this.storeName=storeName;this.keyPrefix=keyPrefix;this.dapr=new DaprManager}k(key){return this.keyPrefix+key}async get(key){let data=await this.dapr.state.get(this.k(key),this.storeName);return data===void 0||data===null||data===""?null:data}async create(key,value,ttlSeconds){try{let metadata=ttlSeconds?{ttlInSeconds:String(ttlSeconds)}:void 0;return await this.dapr.state.save([{key:this.k(key),value,metadata}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async read(key){try{return{success:!0,data:await this.get(key)}}catch(error){return{success:!1,error:error.message}}}async update(key,value,_preserveTtl=!0){try{return await this.dapr.state.save([{key:this.k(key),value}],void 0,this.storeName),{success:!0,data:"OK"}}catch(error){return{success:!1,error:error.message}}}async remove(key){try{return await this.dapr.state.delete(this.k(key),void 0,void 0,this.storeName),{success:!0,data:1}}catch(error){return{success:!1,error:error.message}}}async exists(key){try{return{success:!0,data:await this.get(key)!==null}}catch(error){return{success:!1,error:error.message}}}}class RedisManager{static instance=null;store;directClient=null;useDapr;constructor(config){if(RedisManager.instance){this.store=RedisManager.instance.store,this.directClient=RedisManager.instance.directClient,this.useDapr=RedisManager.instance.useDapr;return}if(!config)throw Error("Redis config must be provided for first initialization.");assertRedisConfig(config),this.useDapr=config.withDapr??!1;let keyPrefix=config.keyPrefix||"";if(config.withDapr)this.store=new DaprRedisStore(config.stateStoreName??"statestore",keyPrefix);else{let client=config.url?new Redis(config.url,keyPrefix?{keyPrefix}:{}):new Redis({host:config.host,port:config.port,...config.password?{password:config.password}:{},...config.username?{username:config.username}:{},...config.tls?{tls:{}}:{},...keyPrefix?{keyPrefix}:{}});this.directClient=client,this.store=new DirectRedisStore(client)}RedisManager.instance=this}static async reset(){let current=RedisManager.instance;if(RedisManager.instance=null,!current?.directClient)return;try{await current.directClient.quit()}catch{}}async create(key,value,ttlSeconds){return this.store.create(key,value,ttlSeconds)}async read(key){return this.store.read(key)}async update(key,value,preserveTtl=!0){return this.store.update(key,value,preserveTtl)}async remove(key){return this.store.remove(key)}async exists(key){return this.store.exists(key)}async readCounters(keys){return(await Promise.all(keys.map((k)=>this.read(k)))).map((r)=>{let v=r.success?r.data:null,n=typeof v==="number"?v:Number.parseFloat(String(v??""));return Number.isFinite(n)?n:0})}async incrementCounter(key,delta,ttlSeconds){if(!this.useDapr&&this.directClient){let v=await this.directClient.incrbyfloat(key,delta);if(ttlSeconds&&ttlSeconds>0)try{await this.directClient.expire(key,ttlSeconds)}catch{}return Number(v)}let cur=await this.read(key),raw=cur.success?cur.data:null,base=typeof raw==="number"?raw:Number.parseFloat(String(raw??"")),next=(Number.isFinite(base)?base:0)+delta;return await this.create(key,next,ttlSeconds),next}getDirectClient(){return this.directClient}async reauthenticate(username,password){if(this.directClient)await this.directClient.auth(username,password)}async keys(pattern){if(this.useDapr||!this.directClient)return logger.scoped("database.redis").warn("keys() not supported in Dapr mode",{pattern}),[];try{return await this.directClient.keys(pattern)}catch(error){return logger.scoped("database.redis").error("keys() failed",error,{pattern}),[]}}async acquireLock(lockKey,ttlSeconds=10){if(this.useDapr||!this.directClient){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(existsResult.data)return{success:!0,data:!1};if((await this.create(lockKey,"1",ttlSeconds)).success)return{success:!0,data:!0};return{success:!1,error:"Failed to acquire lock"}}try{return{success:!0,data:await this.directClient.set(lockKey,"1","EX",ttlSeconds,"NX")==="OK"}}catch(error){return{success:!1,error:error.message}}}async releaseLock(lockKey){return this.remove(lockKey)}async waitForLock(lockKey,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let existsResult=await this.exists(lockKey);if(!existsResult.success)return{success:!1,error:existsResult.error};if(!existsResult.data)return{success:!0,data:!0};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:!1}}async getOrWait(key,timeoutMs=5000,pollIntervalMs=50){let startTime=Date.now();while(Date.now()-startTime<timeoutMs){let readResult=await this.read(key);if(!readResult.success)return{success:!1,error:readResult.error};if(readResult.data!==null)return{success:!0,data:readResult.data};await new Promise((resolve)=>setTimeout(resolve,pollIntervalMs))}return{success:!0,data:null}}}var assertRedisConfig=(config)=>{if(!config)throw Error("Redis config must be provided.");if(config.withDapr){if(!config.stateStoreName)throw Error("Dapr mode requires stateStoreName.");return}let hasUrl=Boolean(config.url),hasHostPort=Boolean(config.host)&&typeof config.port==="number";if(!hasUrl&&!hasHostPort)throw Error("Redis config requires either url or host and port.")};var init_Redis=__esm(()=>{init_Logger2();init_Dapr()});var init_Delete=__esm(()=>{init_Redis()});var init_Generate3=__esm(()=>{init_Redis();init_JWT()});var init_Read=__esm(()=>{init_Redis();init_JWT();init_Delete()});var init_Validate2=__esm(()=>{init_Read()});var init_RefreshToken=__esm(()=>{init_Delete();init_Generate3();init_Read();init_Validate2()});var DEFAULT_EXPIRY_SECONDS=86400,buildSessionKey=(sessionId)=>`session:${sessionId}`,buildRefreshChainKey=(sessionId)=>`refresh-chain:${sessionId}`,serializeSession=(record)=>JSON.stringify(record),deserializeSession=(data)=>{if(!data)return null;if(typeof data==="object")return data;try{return JSON.parse(data)}catch{return null}};var deleteSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),removeResult=await manager.remove(key);return await manager.remove(buildRefreshChainKey(options.sessionId)).catch(()=>{return}),removeResult.success&&removeResult.data>0},forgetSessionsInRedis=async(sessionIds)=>{for(let id of sessionIds){if(!id)continue;try{await deleteSession({sessionId:String(id)})}catch{}}};var init_Delete2=__esm(()=>{init_Redis()});import crypto4 from"crypto";var generateSession=async(options)=>{let manager=new RedisManager,sessionId=options.sessionId??crypto4.randomUUID(),now=Date.now(),nowIso=new Date(now).toISOString(),never=options.expiresInSeconds===null,ttlSeconds=never?void 0:options.expiresInSeconds??DEFAULT_EXPIRY_SECONDS,record={id:sessionId,userId:options.userId,createdAt:nowIso,expiresAt:never?null:new Date(now+ttlSeconds*1000).toISOString(),lastActiveAt:nowIso,clientMeta:options.clientMeta,fingerprintHash:options.fingerprintHash,deviceInfo:options.deviceInfo,refreshTokenHash:options.refreshTokenHash,loginMethod:options.loginMethod,rememberMe:options.rememberMe},writeResult=await manager.create(buildSessionKey(sessionId),serializeSession(record),ttlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:record}};var init_Generate4=__esm(()=>{init_Redis()});var init_Issue=__esm(()=>{init_JWT();init_Generate3();init_Delete2();init_Generate4()});var init_Session=__esm(()=>{init_Issue()});var lookupSession=async(options)=>{let manager=new RedisManager,key=buildSessionKey(options.sessionId),readResult=await manager.read(key);if(!readResult.success)return{state:"unavailable",error:readResult.error??"session store read failed"};if(!readResult.data)return{state:"missing"};let record=deserializeSession(readResult.data);if(!record)return{state:"missing"};if(record.expiresAt&&new Date(record.expiresAt).getTime()<=Date.now())return await deleteSession({sessionId:options.sessionId}),{state:"missing"};return{state:"found",record}},readSession=async(options)=>{let lookup=await lookupSession(options);return lookup.state==="found"?lookup.record:null};var init_Read2=__esm(()=>{init_Redis();init_Delete2()});var updateSession=async(options)=>{let existing=await readSession({sessionId:options.sessionId});if(!existing)return{success:!1,error:"Session not found"};let updated={...existing,...options.updates,lastActiveAt:options.updates.lastActiveAt??new Date().toISOString()},manager=new RedisManager,remainingTtlSeconds=updated.expiresAt?Math.max(60,Math.ceil((new Date(updated.expiresAt).getTime()-Date.now())/1000)):void 0,writeResult=await manager.create(buildSessionKey(options.sessionId),serializeSession(updated),remainingTtlSeconds);if(!writeResult.success)return{success:!1,error:writeResult.error};return{success:!0,session:updated}},updateLastActiveAt=async(sessionId)=>{return updateSession({sessionId,updates:{lastActiveAt:new Date().toISOString()}})};var init_Update=__esm(()=>{init_Redis();init_Read2()});var validateSession=async(options)=>{let jwtResult=verifyJWT(options.jwtToken,options.jwtSecret);if(!jwtResult.valid)return{isValid:!1,reason:jwtResult.error};let session=await readSession({sessionId:options.sessionId});if(!session)return{isValid:!1,reason:"Session not found"};let fingerprintValid;if(options.savedFingerprint&&options.headers&&options.requestIp){let sanitizedHeaders={};for(let[key,value]of Object.entries(options.headers))if(value!==void 0)sanitizedHeaders[key]=value;let fingerprintResult=validateDeviceFingerprint({savedFingerprint:options.savedFingerprint,headers:sanitizedHeaders,requestIp:options.requestIp});if(fingerprintValid=fingerprintResult.isValid,!fingerprintResult.isValid)return{isValid:!1,reason:fingerprintResult.reason??"Fingerprint mismatch"}}return{isValid:!0,context:{userId:session.userId,sessionId:session.id,fingerprintValid}}};var init_Validate3=__esm(()=>{init_Validate();init_JWT();init_Read2()});var exports_SessionStore={};__export(exports_SessionStore,{validateSession:()=>validateSession,updateSession:()=>updateSession,updateLastActiveAt:()=>updateLastActiveAt,readSession:()=>readSession,lookupSession:()=>lookupSession,generateSession:()=>generateSession,forgetSessionsInRedis:()=>forgetSessionsInRedis,deleteSession:()=>deleteSession});var init_SessionStore=__esm(()=>{init_Delete2();init_Generate4();init_Read2();init_Update();init_Validate3()});var init_Auth=__esm(()=>{init_Fingerprint();init_JWT();init_Password();init_RefreshToken();init_Session();init_SessionStore()});import{eq}from"drizzle-orm";function buildClaimAction(method,entity,field,relation,relationField,isBulk){let parts=[method.toLowerCase()];if(isBulk)parts.push("bulk");if(parts.push(entity),relation){if(parts.push("with"),parts.push(relation),relationField)parts.push(relationField)}else if(field)parts.push(field);return parts.join(".")}function buildClaimPath(entity,isBulk,hasId){if(isBulk)return`/${entity}/bulk`;if(hasId)return`/${entity}/:id`;return`/${entity}`}function generateEntityClaims(entity,config,schemaRelations){let claims=[],tableName=entity.table_name,excludedMethods=entity.excluded_methods||[];for(let method of HTTP_METHODS){if(excludedMethods.includes(method))continue;let needsId=method==="PUT"||method==="PATCH"||method==="DELETE";if(claims.push({action:buildClaimAction(method,tableName),description:`${method} access to ${tableName}`,path:buildClaimPath(tableName,!1,needsId&&method!=="DELETE"),method}),method==="GET"&&entity.columns){for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName),method})}let relationKey=`${tableName.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}Relations`;if(schemaRelations[relationKey]){let relationConfig=schemaRelations[relationKey];if(relationConfig?.config?.referencedTable?._?.name){let relationName=relationConfig.config.referencedTable._.name;claims.push({action:buildClaimAction(method,tableName,void 0,relationName),description:`${method} access to ${tableName} with ${relationName}`,path:buildClaimPath(tableName),method})}}}if(method==="POST"||method==="PUT"||method==="PATCH"){if(entity.columns)for(let column of entity.columns){if(config.skipColumns.includes(column.name))continue;claims.push({action:buildClaimAction(method,tableName,column.name),description:`${method} access to ${tableName}.${column.name}`,path:buildClaimPath(tableName,!1,method!=="POST"),method})}}}if(entity.bulk_endpoints_enabled===!0)for(let method of BULK_METHODS){if(excludedMethods.includes(method))continue;claims.push({action:buildClaimAction(method,tableName,void 0,void 0,void 0,!0),description:`Bulk ${method} access to ${tableName}`,path:buildClaimPath(tableName,!0),method})}return claims}async function seedClaims(db,schemaTables,schemaRelations,entities,config,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return logger2.warn("[Authorization] Claims table not found in schema"),{total:0,created:0,existing:0,claims:[]};let allClaims=[];for(let entity of entities){if(config.skipTables.includes(entity.table_name))continue;let entityClaims=generateEntityClaims(entity,config,schemaRelations);allClaims.push(...entityClaims)}let uniqueClaims=allClaims.filter((claim,index,self2)=>index===self2.findIndex((c)=>c.action===claim.action)),created=0,existing=0,claimActions=[];for(let claim of uniqueClaims)try{if((await db.select().from(claimsTable).where(eq(claimsTable.action,claim.action)).limit(1)).length===0)await db.insert(claimsTable).values(claim),created++,claimActions.push(claim.action),logger2.debug(`[Authorization] Created claim: ${claim.action}`);else existing++}catch(error){logger2.error(`[Authorization] Failed to create claim: ${claim.action}`,error)}return logger2.info(`[Authorization] Claims seeded: ${created} created, ${existing} existing, ${uniqueClaims.length} total`),{total:uniqueClaims.length,created,existing,claims:claimActions}}var HTTP_METHODS,BULK_METHODS;var init_ClaimSeeder=__esm(()=>{HTTP_METHODS=["GET","POST","PUT","PATCH","DELETE"],BULK_METHODS=["POST","PUT","DELETE"]});function parseStoredJson(stored){if(stored===null||stored===void 0)return null;if(typeof stored==="object")return stored;if(typeof stored==="string"){if(stored.length===0)return null;try{return JSON.parse(stored)}catch{return null}}if(typeof stored==="number"||typeof stored==="boolean")return stored;return null}import{and,eq as eq2,isNull,or}from"drizzle-orm";function activeRowsPredicate(table){let column=table?.isActive;if(!column)return;return or(isNull(column),eq2(column,!0))}function activeGrantPredicate(tables){return and(activeRowsPredicate(tables.userRoles),activeRowsPredicate(tables.roleClaims),activeRowsPredicate(tables.claims))}var init_activeRows=()=>{};var exports_ClaimsCache={};__export(exports_ClaimsCache,{ClaimsCache:()=>ClaimsCache});import{and as and2,eq as eq3}from"drizzle-orm";class ClaimsCache{prefix;redis;db;schemaTables;logger;constructor(config){this.prefix=config.prefix||DEFAULT_PREFIX,this.redis=config.redis,this.db=config.db,this.schemaTables=config.schemaTables,this.logger=config.logger}key(suffix){return`${this.prefix}:${suffix}`}async buildCache(){let rolesTable=this.schemaTables.roles,roleClaimsTable=this.schemaTables.roleClaims,claimsTable=this.schemaTables.claims;if(!rolesTable||!roleClaimsTable||!claimsTable)return this.logger.warn("[ClaimsCache] Required tables not found, skipping cache build"),{version:0,roleCount:0,totalMappings:0};let allRoles=await this.db.select().from(rolesTable),roleNames=[],totalMappings=0;for(let role of allRoles){let r=role,roleId=r.id,roleName=r.name;roleNames.push(roleName);let roleClaimRows=await this.db.select().from(roleClaimsTable).innerJoin(claimsTable,eq3(roleClaimsTable.claimId,claimsTable.id)).where(and2(eq3(roleClaimsTable.roleId,roleId),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable}))),claimActions=[];for(let row of roleClaimRows){let action=row.claims?.action;if(action)claimActions.push(action)}await this.redis.set(this.key(`role:${roleName}`),JSON.stringify(claimActions)),totalMappings+=claimActions.length}await this.redis.set(this.key("roles"),JSON.stringify(roleNames));let newVersion=storedVersionNumber(await this.redis.get(this.key("version")))+1;return await this.redis.set(this.key("version"),String(newVersion)),this.logger.info("[ClaimsCache] Cache built",{version:newVersion,roleCount:roleNames.length,totalMappings}),{version:newVersion,roleCount:roleNames.length,totalMappings}}async getVersion(){return storedVersionNumber(await this.redis.get(this.key("version")))}async resolveClaimsForRoles(roleNames){let allClaims=new Set;for(let roleName of roleNames){let claims=parseStoredJson(await this.redis.get(this.key(`role:${roleName}`)));if(Array.isArray(claims))for(let c of claims)allClaims.add(c);else if(claims!==null)this.logger.warn("[ClaimsCache] Cached role entry unreadable, ignoring",{roleName})}return Array.from(allClaims)}async invalidate(){return(await this.buildCache()).version}getPrefix(){return this.prefix}}var DEFAULT_PREFIX="nucleus:claims",storedVersionNumber=(stored)=>{let value=parseStoredJson(stored),parsed=typeof value==="number"?value:Number.parseInt(String(value??""),10);return Number.isFinite(parsed)?parsed:0};var init_ClaimsCache=__esm(()=>{init_activeRows()});var DEFAULT_AUTHORIZATION_CONFIG,AUTHORIZATION_TABLE_KEYS,GODMIN_ROLE_NAME="godmin";var init_types3=__esm(()=>{DEFAULT_AUTHORIZATION_CONFIG={enabled:!1,autoSeedClaims:!0,skipTables:["audit_logs"],skipColumns:["id","created_at","updated_at","is_active","password","version"],excludedPaths:[],publicPaths:["/auth/login","/auth/register"]},AUTHORIZATION_TABLE_KEYS={users:"users",roles:"roles",claims:"claims",userRoles:"userRoles",roleClaims:"roleClaims"}});var{password}=globalThis.Bun;import{and as and3,eq as eq4}from"drizzle-orm";async function setupGodmin(db,schemaTables,config,logger2){if(!config.godminEmail||!config.godminPassword)return logger2.warn("[Authorization] Godmin email or password not configured, skipping godmin setup"),{success:!1};let{roles:rolesTable,users:usersTable,userRoles:userRolesTable}=schemaTables;if(!rolesTable||!usersTable||!userRolesTable)return logger2.error("[Authorization] Required tables not found for godmin setup"),{success:!1};try{let roleId,existingRole=await db.select().from(rolesTable).where(eq4(rolesTable.name,GODMIN_ROLE_NAME)).limit(1);if(existingRole.length===0){let[newRole]=await db.insert(rolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();roleId=newRole.id,logger2.info(`[Authorization] Created godmin role: ${roleId}`)}else roleId=existingRole[0].id,logger2.debug(`[Authorization] Godmin role already exists: ${roleId}`);let userId,existingUser=await db.select().from(usersTable).where(eq4(usersTable.email,config.godminEmail)).limit(1);if(existingUser.length===0){let hashedPassword=await password.hash(config.godminPassword,{algorithm:"bcrypt",cost:10}),[newUser]=await db.insert(usersTable).values({email:config.godminEmail,password:hashedPassword,verifiedAt:new Date,isActive:!0,isGod:!0}).returning();userId=newUser.id,logger2.info(`[Authorization] Created godmin user: ${userId}`)}else{if(userId=existingUser[0].id,!existingUser[0].isGod)await db.update(usersTable).set({isGod:!0}).where(eq4(usersTable.id,userId)),logger2.info(`[Authorization] Marked existing godmin user as isGod=true: ${userId}`);logger2.debug(`[Authorization] Godmin user already exists: ${userId}`)}if(!((await db.select().from(userRolesTable).where(and3(eq4(userRolesTable.userId,userId),eq4(userRolesTable.roleId,roleId))).limit(1)).length>0))await db.insert(userRolesTable).values({userId,roleId}),logger2.info(`[Authorization] Assigned godmin role to user: ${userId}`);return{success:!0,userId,roleId}}catch(error){return logger2.error("[Authorization] Failed to setup godmin",error),{success:!1}}}function isGodminRole(roleName){return roleName===GODMIN_ROLE_NAME}var init_GodminSetup=__esm(()=>{init_types3()});import{and as and4,eq as eq5,inArray,sql}from"drizzle-orm";function isSelfReference(value){return value.startsWith(SELF_PREFIX)}function parseSelfReference(value){return{field:value.slice(SELF_PREFIX.length)}}function parseScopeWithSelf(scope){if(!scope)return{};let params=new URLSearchParams(scope),result={};for(let[key,value]of params.entries())if(isSelfReference(value))result[key]=parseSelfReference(value);else result[key]=value;return result}function resolveScopeWithSelf(parsedScope,userData,logger2){let resolved={},unresolved=[];for(let[key,value]of Object.entries(parsedScope))if(typeof value==="object"&&"field"in value){if(!userData){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - userData not provided`),unresolved.push(key);continue}let lookup=lookupUserDataField(userData,value.field);if(!lookup.found){logger2.warn(`[Authorization] Cannot resolve self:${value.field} - field not found in userData`),unresolved.push(key);continue}resolved[key]=lookup.value,logger2.debug(`[Authorization] Resolved self:${value.field} -> ${String(lookup.value)}`)}else resolved[key]=value;return{resolved,unresolved}}function resolveClaimScopes(rows,userData,logger2){let claimScopes={},dropped=new Set,unrestricted=new Set;for(let{action,scope}of rows){if(!scope){unrestricted.add(action);continue}if(!scope.includes("="))continue;let parsed=parseScopeWithSelf(scope),{resolved,unresolved}=resolveScopeWithSelf(parsed,userData,logger2);if(unresolved.length>0){dropped.add(action);continue}claimScopes[action]={...claimScopes[action]??{},...resolved}}for(let a of unrestricted)delete claimScopes[a],dropped.delete(a);for(let a of dropped)delete claimScopes[a];return{claimScopes,dropped:Array.from(dropped)}}function mergeGrantingScopes(grantingActions,claimScopes){if(!claimScopes)return;let merged={},any=!1;for(let action of grantingActions){let s=claimScopes[action];if(!s||Object.keys(s).length===0)return;Object.assign(merged,s),any=!0}return any?merged:void 0}function buildClaimPattern(method,entity,field,relation){let parts=[method.toLowerCase(),entity];if(relation)parts.push("with",relation);else if(field)parts.push(field);return parts.join(".")}function claimMatches(userClaim,requiredPattern,requireSpecificity=!1){if(userClaim===requiredPattern)return!0;let userParts=userClaim.split("."),requiredParts=requiredPattern.split(".");if(userParts.length>requiredParts.length)return!1;if(requireSpecificity&&userParts.length<2&&requiredParts.length>=2)return!1;for(let i=0;i<userParts.length;i++)if(userParts[i]!==requiredParts[i])return!1;return!0}async function checkAuthorization(params){let{userId,method,entity,requestedFields,requestedRelations,db,schemaTables,logger:logger2,getUserData}=params,reqSpec=params.requireClaimSpecificity??!1,ceiling=params.claimCeiling?new Set(params.claimCeiling):void 0,userData=params.userData,ensureUserData=async()=>{if(userData!==void 0)return;if(getUserData)try{userData=await getUserData()}catch(err){logger2.warn("[Authorization] getUserData callback failed",{userId,error:err instanceof Error?err.message:String(err)})}},rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles],userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],roleClaimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roleClaims],claimsTable=schemaTables[AUTHORIZATION_TABLE_KEYS.claims];if(!rolesTable||!userRolesTable||!roleClaimsTable||!claimsTable)return logger2.error("[Authorization] Required tables not found"),{authorized:!1,reason:"Authorization tables not configured"};try{let userRolesCols=userRolesTable,rolesCols=rolesTable,userRoles=await db.select({roleId:userRolesCols.roleId,roleName:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq5(userRolesCols.roleId,rolesCols.id)).where(and4(eq5(userRolesCols.userId,userId),activeGrantPredicate({userRoles:userRolesTable})));if(userRoles.length===0)return{authorized:!1,reason:"User has no roles assigned"};if(userRoles.some((ur)=>isGodminRole(ur.roleName))&&!ceiling)return logger2.debug(`[Authorization] User ${userId} has godmin role, bypassing checks`),{authorized:!0};let roleIds=userRoles.map((ur)=>ur.roleId),roleClaimsCols=roleClaimsTable,claimsCols=claimsTable,ownerGrants=await db.select({claimAction:claimsCols.action,scope:roleClaimsCols.scope}).from(roleClaimsTable).innerJoin(claimsTable,eq5(roleClaimsCols.claimId,claimsCols.id)).where(and4(inArray(roleClaimsCols.roleId,roleIds),activeGrantPredicate({roleClaims:roleClaimsTable,claims:claimsTable})));if(ownerGrants.length===0)return{authorized:!1,reason:"User roles have no claims assigned"};let roleClaims=ceiling?ownerGrants.filter((rc)=>ceiling.has(rc.claimAction)):ownerGrants;if(roleClaims.length===0)return{authorized:!1,reason:"API key carries none of its owner's claims"};let entityClaimPattern=buildClaimPattern(method,entity),hasEntityAccess=roleClaims.some((rc)=>claimMatches(rc.claimAction,entityClaimPattern,reqSpec)),allowedFields=[],allowedRelations=[],scopeFilters={},unresolvedSelf=[],fieldPatterns=(requestedFields??[]).map((field)=>({field,pattern:buildClaimPattern(method,entity,field)})),relationPatterns=(requestedRelations??[]).map((relation)=>({relation,pattern:buildClaimPattern(method,entity,void 0,relation)})),claimCouldGrant=(action)=>claimMatches(action,entityClaimPattern,reqSpec)||fieldPatterns.some((f)=>claimMatches(action,f.pattern,reqSpec))||relationPatterns.some((r)=>claimMatches(action,r.pattern,reqSpec));if(roleClaims.some((rc)=>{let scope=rc.scope;return!!scope&&scope.includes("self:")&&claimCouldGrant(rc.claimAction)}))await ensureUserData();let applyClaimScope=(rc)=>{let parsedScope=parseScopeWithSelf(rc.scope),{resolved,unresolved}=resolveScopeWithSelf(parsedScope,userData,logger2);Object.assign(scopeFilters,resolved),unresolvedSelf.push(...unresolved)},denyOnUnresolvedSelf=()=>{if(unresolvedSelf.length===0)return null;return logger2.warn("[Authorization] Denying request: unresolvable self: scope (failing closed)",{userId,method,entity,unresolved:unresolvedSelf}),{authorized:!1,reason:"Ownership scope could not be resolved"}};if(hasEntityAccess){let unrestricted=!1;for(let rc of roleClaims){if(!claimMatches(rc.claimAction,entityClaimPattern,reqSpec))continue;if(!rc.scope){unrestricted=!0;continue}applyClaimScope(rc)}if(unrestricted)return{authorized:!0};let denied=denyOnUnresolvedSelf();if(denied)return denied;return{authorized:!0,scopeFilters:Object.keys(scopeFilters).length>0?scopeFilters:void 0}}let unrestrictedField=!1;for(let{field,pattern}of fieldPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedFields.push(field),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}for(let{relation,pattern}of relationPatterns){let granting=roleClaims.filter((rc)=>claimMatches(rc.claimAction,pattern,reqSpec));if(granting.length>0)if(allowedRelations.push(relation),granting.some((rc)=>!rc.scope))unrestrictedField=!0;else for(let rc of granting)applyClaimScope(rc)}if(!unrestrictedField){let denied=denyOnUnresolvedSelf();if(denied)return denied}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,scopeFilters:!unrestrictedField&&Object.keys(scopeFilters).length>0?scopeFilters:void 0}}catch(error){return logger2.error("[Authorization] Check failed",error),{authorized:!1,reason:"Authorization check failed"}}}function checkAuthorizationFromJWT(params){let{userClaims,userRoles,method,entity,requestedFields,requestedRelations,logger:logger2}=params,reqSpec=params.requireClaimSpecificity??!1,claimScopes=params.claimScopes;if(userClaims.length===0&&userRoles.length===0)return{authorized:!1,reason:"No roles or claims in token"};if(userRoles.some((r)=>isGodminRole(r)))return logger2.debug("[Authorization:JWT] User has godmin role, bypassing checks"),{authorized:!0};let entityClaimPattern=buildClaimPattern(method,entity),entityGranting=userClaims.filter((c)=>claimMatches(c,entityClaimPattern,reqSpec));if(entityGranting.length>0){let scopeFilters2=mergeGrantingScopes(entityGranting,claimScopes);return{authorized:!0,...scopeFilters2?{scopeFilters:scopeFilters2}:{}}}let allowedFields=[],allowedRelations=[],grantingActions=[];if(requestedFields)for(let field of requestedFields){let fieldPattern=buildClaimPattern(method,entity,field),granting=userClaims.filter((c)=>claimMatches(c,fieldPattern,reqSpec));if(granting.length>0)allowedFields.push(field),grantingActions.push(...granting)}if(requestedRelations)for(let relation of requestedRelations){let relationPattern=buildClaimPattern(method,entity,void 0,relation),granting=userClaims.filter((c)=>claimMatches(c,relationPattern,reqSpec));if(granting.length>0)allowedRelations.push(relation),grantingActions.push(...granting)}if(!(allowedFields.length>0||allowedRelations.length>0))return{authorized:!1,reason:`No access to ${method} ${entity}`};let scopeFilters=mergeGrantingScopes(grantingActions,claimScopes);return{authorized:!0,allowedFields:allowedFields.length>0?allowedFields:["id"],allowedRelations,...scopeFilters?{scopeFilters}:{}}}async function checkAuthorizationViaIDP(params){let{idpUrl,accessToken,method,entity,requestedFields,requestedRelations,logger:logger2}=params;try{let response=await fetch(`${idpUrl}/auth/check`,{method:"POST",headers:{"Content-Type":"application/json",Cookie:`access_token=${accessToken}`},body:JSON.stringify({entity,method,fields:requestedFields,relations:requestedRelations})});if(!response.ok)return logger2.warn(`[Authorization:IDP] IDP /auth/check returned ${response.status}`),{authorized:!1,reason:`IDP authorization check failed (${response.status})`};let payload=await response.json();return unwrapIdpCheckResponse(payload)}catch(error){let msg=error instanceof Error?error.message:String(error);return logger2.error(`[Authorization:IDP] Failed to reach IDP: ${msg}`),{authorized:!1,reason:"IDP authorization service unavailable"}}}function filterResponseFields(data,allowedFields){if(!allowedFields||allowedFields.length===0)return data;let fieldsToInclude=[...new Set([...["id"],...allowedFields])],toCamel=(value)=>value.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase()),allowedKeys=new Set;for(let field of fieldsToInclude)allowedKeys.add(field),allowedKeys.add(toCamel(field));let filterSingle=(item)=>{let filtered={};for(let key of Object.keys(item))if(allowedKeys.has(key))filtered[key]=item[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function filterResponseRelations(data,allowedRelations){if(!allowedRelations)return data;let filterSingle=(item)=>{let filtered={...item};for(let key of Object.keys(filtered))if(typeof filtered[key]==="object"&&filtered[key]!==null&&!allowedRelations.includes(key))delete filtered[key];return filtered};if(Array.isArray(data))return data.map(filterSingle);return filterSingle(data)}function buildScopeConditions(scopeFilters,resolveColumn){let conditions=[],unresolvedFields=[];if(!scopeFilters)return{conditions,unresolvedFields};for(let[field,value]of Object.entries(scopeFilters)){let col=resolveColumn(field);if(col)conditions.push(eq5(col,value));else unresolvedFields.push(field),conditions.push(sql`1 = 0`)}return{conditions,unresolvedFields}}var SELF_PREFIX="self:",toCamelCase2=(value)=>value.replace(/_([a-z])/g,(_,c)=>c.toUpperCase()),toSnakeCase=(value)=>value.replace(/([A-Z])/g,(_,c)=>`_${c.toLowerCase()}`),lookupUserDataField=(userData,fieldName)=>{if(fieldName in userData)return{found:!0,value:userData[fieldName]};let camel=toCamelCase2(fieldName);if(camel!==fieldName&&camel in userData)return{found:!0,value:userData[camel]};let snake=toSnakeCase(fieldName);if(snake!==fieldName&&snake in userData)return{found:!0,value:userData[snake]};return{found:!1}},unwrapIdpCheckResponse=(payload)=>{if(!payload||typeof payload!=="object")return{authorized:!1,reason:"IDP returned malformed response"};let envelope=payload;if(envelope.data&&typeof envelope.data==="object"){let data=envelope.data;if(typeof data.authorized==="boolean")return data}let flat=payload;if(typeof flat.authorized==="boolean")return flat;return{authorized:!1,reason:"IDP returned unrecognised response shape"}};var init_Middleware=__esm(()=>{init_activeRows();init_GodminSetup();init_types3()});var exports_SeedRunner={};__export(exports_SeedRunner,{runSeed:()=>runSeed,expandClaimPatterns:()=>expandClaimPatterns});import{and as and5,eq as eq6}from"drizzle-orm";function expandClaimPatterns(patterns,allActions){let out=new Set;for(let pattern of patterns)if(pattern.endsWith(".*")){let prefix=pattern.slice(0,-2);for(let action of allActions)if(action===prefix||action.startsWith(`${prefix}.`))out.add(action)}else out.add(pattern);return[...out]}async function runSeed(db,schemaTables,seedConfig,logger2){let{roles:rolesTable,claims:claimsTable,roleClaims:roleClaimsTable}=schemaTables,result={rolesCreated:0,rolesExisting:0,claimsCreated:0,claimsExisting:0,assignmentsCreated:0,assignmentsExisting:0,assignmentsUpdated:0};if(seedConfig.roles?.length&&rolesTable)for(let roleDef of seedConfig.roles)try{if((await db.select().from(rolesTable).where(eq6(rolesTable.name,roleDef.name)).limit(1)).length===0)await db.insert(rolesTable).values({name:roleDef.name,description:roleDef.description||""}),result.rolesCreated++,logger2.info(`[Seed] Created role: ${roleDef.name}`);else result.rolesExisting++}catch(error){logger2.error(`[Seed] Failed to seed role: ${roleDef.name}`,error)}if(seedConfig.claims?.length&&claimsTable)for(let claimDef of seedConfig.claims)try{let existing=await db.select().from(claimsTable).where(eq6(claimsTable.action,claimDef.action)).limit(1);if(existing.length===0)await db.insert(claimsTable).values({action:claimDef.action,path:claimDef.path,method:claimDef.method,description:claimDef.description||`${claimDef.method} ${claimDef.path}`,...claimDef.policy!==void 0?{policy:claimDef.policy}:{}}),result.claimsCreated++,logger2.info(`[Seed] Created claim: ${claimDef.action}`);else if(claimDef.policy!==void 0){let existingRow=existing[0],currentPolicy=JSON.stringify(existingRow.policy??null),desiredPolicy=JSON.stringify(claimDef.policy??null);if(currentPolicy!==desiredPolicy)await db.update(claimsTable).set({policy:claimDef.policy}).where(eq6(claimsTable.action,claimDef.action)),result.claimsExisting++,logger2.warn(`[Seed] Reconciled policy for claim: ${claimDef.action}`);else result.claimsExisting++}else result.claimsExisting++}catch(error){logger2.error(`[Seed] Failed to seed claim: ${claimDef.action}`,error)}if(seedConfig.roleClaimAssignments?.length&&rolesTable&&claimsTable&&roleClaimsTable){let allClaimActions=(await db.select().from(claimsTable)).map((c)=>String(c.action??""));for(let assignment of seedConfig.roleClaimAssignments){let role=(await db.select().from(rolesTable).where(eq6(rolesTable.name,assignment.role)).limit(1))[0];if(!role){logger2.warn(`[Seed] Role not found for assignment: ${assignment.role}`);continue}let roleId=role.id,resolvedActions=expandClaimPatterns(assignment.claims,allClaimActions);for(let pattern of assignment.claims)if(pattern.endsWith(".*")&&!resolvedActions.some((a)=>a.startsWith(pattern.slice(0,-1))))logger2.warn(`[Seed] No claim matched prefix pattern: ${pattern}`);for(let claimAction of resolvedActions)try{let claim=(await db.select().from(claimsTable).where(eq6(claimsTable.action,claimAction)).limit(1))[0];if(!claim){logger2.warn(`[Seed] Claim not found for assignment: ${claimAction}`);continue}let claimId=claim.id,existingAssignment=await db.select().from(roleClaimsTable).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))).limit(1);if(existingAssignment.length===0)await db.insert(roleClaimsTable).values({roleId,claimId,scope:assignment.scope||null}),result.assignmentsCreated++;else{let existingRow=existingAssignment[0],desiredScope=assignment.scope||null,currentScope=existingRow.scope??null;if(currentScope!==desiredScope)await db.update(roleClaimsTable).set({scope:desiredScope}).where(and5(eq6(roleClaimsTable.roleId,roleId),eq6(roleClaimsTable.claimId,claimId))),result.assignmentsUpdated++,logger2.warn(`[Seed] Reconciled scope for ${assignment.role} -> ${claimAction}: ${JSON.stringify(currentScope)} => ${JSON.stringify(desiredScope)}`);else result.assignmentsExisting++}}catch(error){logger2.error(`[Seed] Failed to assign claim ${claimAction} to role ${assignment.role}`,error)}if(result.assignmentsCreated>0)logger2.info(`[Seed] Role "${assignment.role}": assigned ${result.assignmentsCreated} claims`)}}return result}var init_SeedRunner=()=>{};var init_Authorization=__esm(()=>{init_ClaimSeeder();init_ClaimsCache();init_GodminSetup();init_Middleware();init_SeedRunner();init_types3()});function parseField(raw,spec){let out=new Set;for(let part of raw.split(",")){if(part==="")return null;let[rangePart,stepPart,...extra]=part.split("/");if(extra.length>0||rangePart===void 0)return null;let step=1;if(stepPart!==void 0){if(!/^\d+$/.test(stepPart))return null;if(step=Number.parseInt(stepPart,10),step<1)return null}let from,to;if(rangePart==="*")from=spec.min,to=spec.max;else if(rangePart.includes("-")){let[a,b,...rest]=rangePart.split("-");if(rest.length>0||!isIntInRange(a,spec)||!isIntInRange(b,spec))return null;if(from=namedToNumber(a,spec),to=namedToNumber(b,spec),from>to)return null}else{if(!isIntInRange(rangePart,spec))return null;from=namedToNumber(rangePart,spec),to=stepPart===void 0?from:spec.max}for(let v=from;v<=to;v+=step)out.add(v)}return out.size>0?out:null}function isIntInRange(value,spec){if(value===void 0)return!1;let n=namedToNumber(value,spec);return n!==null&&n>=spec.min&&n<=spec.max}function namedToNumber(value,spec){if(/^\d+$/.test(value))return Number.parseInt(value,10);let lower=value.toLowerCase();if(spec===MONTH){let i=MONTH_NAMES.indexOf(lower);return i===-1?null:i+1}if(spec===WEEKDAY){let i=DAY_NAMES.indexOf(lower);return i===-1?null:i}return null}function parseCron(expression){let trimmed=expression.trim(),parts=(MACROS[trimmed.toLowerCase()]??trimmed).split(/\s+/);if(parts.length!==5)return null;let[minRaw,hourRaw,dayRaw,monthRaw,weekdayRaw]=parts,minute=parseField(minRaw,MINUTE),hour=parseField(hourRaw,HOUR),day=parseField(dayRaw,DAY),month=parseField(monthRaw,MONTH),weekdayRawSet=parseField(weekdayRaw,WEEKDAY);if(!minute||!hour||!day||!month||!weekdayRawSet)return null;let weekday=new Set([...weekdayRawSet].map((d)=>d===7?0:d));return{minute,hour,day,month,weekday,dayUnrestricted:dayRaw==="*",weekdayUnrestricted:weekdayRaw==="*"}}function formatterFor(timeZone){let cached=formatterCache.get(timeZone);if(cached)return cached;try{let fmt=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short"});return formatterCache.set(timeZone,fmt),fmt}catch{return null}}function partsIn(ts,fmt){let parts=fmt.formatToParts(new Date(ts)),get=(type)=>parts.find((p)=>p.type===type)?.value??"0",hour=Number.parseInt(get("hour"),10)%24;return{year:Number.parseInt(get("year"),10),month:Number.parseInt(get("month"),10),day:Number.parseInt(get("day"),10),hour,minute:Number.parseInt(get("minute"),10),weekday:WEEKDAY_INDEX[get("weekday")]??0}}function offsetMsAt(ts,fmt){let p=partsIn(ts,fmt);return Date.UTC(p.year,p.month-1,p.day,p.hour,p.minute,new Date(ts).getUTCSeconds())-Math.floor(ts/1000)*1000}function zonedWallTimeToInstant(year,month,day,hour,minute,fmt){let naive=Date.UTC(year,month-1,day,hour,minute,0,0),ts=naive-offsetMsAt(naive,fmt),corrected=naive-offsetMsAt(ts,fmt);if(corrected!==ts)ts=corrected;let target=stamp(year,month,day,hour,minute),localStamp=(at)=>{let p=partsIn(at,fmt);return stamp(p.year,p.month,p.day,p.hour,p.minute)};if(localStamp(ts)===target)return ts;let probe=Math.min(ts,naive-offsetMsAt(naive,fmt));for(let i=0;i<=240;i++){if(localStamp(probe)>=target)return probe;probe+=60000}return ts}function stamp(year,month,day,hour,minute){return((year*100+month)*100+day)*1e4+hour*100+minute}function dayMatches(fields,wall){if(!fields.month.has(wall.month))return!1;let domOk=fields.day.has(wall.day),dowOk=fields.weekday.has(wall.weekday);if(fields.dayUnrestricted&&fields.weekdayUnrestricted)return!0;if(fields.dayUnrestricted)return dowOk;if(fields.weekdayUnrestricted)return domOk;return domOk||dowOk}function nextCronRun(expression,from=new Date,timeZone="UTC"){let fields=parseCron(expression);if(!fields)return null;let fmt=formatterFor(timeZone)??formatterFor("UTC");if(!fmt)return null;let hours=[...fields.hour].sort((a,b)=>a-b),minutes=[...fields.minute].sort((a,b)=>a-b),fromTs=from.getTime();if(!Number.isFinite(fromTs))return null;let cursor=partsIn(fromTs,fmt);for(let dayIndex=0;dayIndex<2929;dayIndex++){if(dayMatches(fields,cursor))for(let hour of hours)for(let minute of minutes){let ts=zonedWallTimeToInstant(cursor.year,cursor.month,cursor.day,hour,minute,fmt);if(ts>fromTs)return new Date(ts)}let nextDayUtc=Date.UTC(cursor.year,cursor.month-1,cursor.day+1,12,0,0),probe=new Date(nextDayUtc);cursor={year:probe.getUTCFullYear(),month:probe.getUTCMonth()+1,day:probe.getUTCDate(),hour:0,minute:0,weekday:probe.getUTCDay()}}return null}var MINUTE,HOUR,DAY,MONTH,WEEKDAY,MONTH_NAMES,DAY_NAMES,MACROS,formatterCache,WEEKDAY_INDEX;var init_cron=__esm(()=>{MINUTE={min:0,max:59},HOUR={min:0,max:23},DAY={min:1,max:31},MONTH={min:1,max:12},WEEKDAY={min:0,max:7};MONTH_NAMES=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"],DAY_NAMES=["sun","mon","tue","wed","thu","fri","sat"];MACROS={"@yearly":"0 0 1 1 *","@annually":"0 0 1 1 *","@monthly":"0 0 1 * *","@weekly":"0 0 * * 0","@daily":"0 0 * * *","@midnight":"0 0 * * *","@hourly":"0 * * * *"};formatterCache=new Map;WEEKDAY_INDEX={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6}});import{createCipheriv,createDecipheriv,randomBytes as randomBytes2,scryptSync}from"crypto";var MAGIC,IV_LEN=12,TAG_LEN=16,deriveKey=(secret)=>scryptSync(secret,"nucleus-backup-v1",32),encryptBackup=(plaintext,secret)=>{if(!secret)throw Error("backup encryption key is empty");let key=deriveKey(secret),iv=randomBytes2(IV_LEN),cipher=createCipheriv("aes-256-gcm",key,iv),ciphertext=Buffer.concat([cipher.update(plaintext,"utf-8"),cipher.final()]),tag=cipher.getAuthTag();return Buffer.concat([MAGIC,iv,tag,ciphertext])},isEncryptedBackup=(buf)=>buf.length>=MAGIC.length+IV_LEN+TAG_LEN&&buf.subarray(0,MAGIC.length).equals(MAGIC),decryptBackup=(blob,secret)=>{if(!secret)throw Error("backup encryption key is empty");if(!isEncryptedBackup(blob))throw Error("not an encrypted backup");let key=deriveKey(secret),iv=blob.subarray(MAGIC.length,MAGIC.length+IV_LEN),tag=blob.subarray(MAGIC.length+IV_LEN,MAGIC.length+IV_LEN+TAG_LEN),ciphertext=blob.subarray(MAGIC.length+IV_LEN+TAG_LEN),decipher=createDecipheriv("aes-256-gcm",key,iv);return decipher.setAuthTag(tag),Buffer.concat([decipher.update(ciphertext),decipher.final()]).toString("utf-8")};var init_encryption=__esm(()=>{MAGIC=Buffer.from("NXB1")});import{mkdir as mkdir3,readFile,stat as stat2,unlink as unlink3,writeFile}from"fs/promises";import{join as join4}from"path";import{eq as eq7,getTableColumns,sql as sql2}from"drizzle-orm";function nextHopMs(delayMs){if(!Number.isFinite(delayMs)||delayMs<=0)return 0;return Math.min(delayMs,MAX_TIMEOUT_MS)}function reviveRowTypes(table,rows){let columns;try{columns=getTableColumns(table)}catch{return rows}let dateColumns=Object.entries(columns).filter(([,col2])=>col2?.dataType==="date").map(([name])=>name);if(dateColumns.length===0)return rows;return rows.map((row)=>{let copy=null;for(let name of dateColumns){let value=row[name];if(typeof value!=="string")continue;let parsed=new Date(value);if(Number.isNaN(parsed.getTime()))continue;if(!copy)copy={...row};copy[name]=parsed}return copy??row})}function normalizeTableName(name){return name.replace(/[^a-z0-9]/gi,"").toLowerCase()}function selectBackupTables(tables,excludeTables){let excluded=new Set(excludeTables.map(normalizeTableName));return Object.keys(tables).filter((name)=>{if(excluded.has(normalizeTableName(name)))return!1;let val=tables[name];if(!val||typeof val!=="object")return!1;return Object.getOwnPropertySymbols(val).length>0})}class BackupService{db;logger;config;schemaTables;schemaName;backupLogsTable;cronTimer=null;schedulerActive=!1;lock;constructor(serviceConfig){this.db=serviceConfig.db,this.logger=serviceConfig.logger,this.config=serviceConfig.config,this.schemaTables=serviceConfig.schemaTables,this.schemaName=serviceConfig.schemaName,this.backupLogsTable=serviceConfig.backupLogsTable,this.lock=serviceConfig.lock}async createBackup(trigger="manual",performedBy,targetSchemaName,targetSchemaTables){let resolvedSchema=targetSchemaName||this.schemaName,resolvedTables=targetSchemaTables||this.schemaTables,now=new Date,backupId=crypto.randomUUID(),timestamp=now.toISOString().replace(/[:.]/g,"-"),backupName=`${resolvedSchema}_${timestamp}`,fileName=`${backupName}.json`,filePath=join4(this.config.storagePath,fileName),logRecord={id:backupId,backupName,fileName,schemaName:resolvedSchema,format:this.config.format,status:"running",trigger,sizeBytes:null,tableCount:null,rowCount:null,includedTables:[],excludedTables:this.config.excludeTables,errorMessage:null,startedAt:now.toISOString(),completedAt:null,performedBy:performedBy||null,cronExpression:trigger==="scheduled"?this.config.schedule.cron:null,retentionDays:this.config.schedule.retentionDays};await this.insertLogRecord(logRecord);try{await mkdir3(this.config.storagePath,{recursive:!0});let tableNames=this.getBackupTableNames(resolvedTables),backupData=[],totalRows=0;for(let tableName of tableNames){let table=resolvedTables[tableName];if(!table)continue;try{let rows=await this.db.select().from(table),columns=Object.keys(table).filter((k)=>!k.startsWith("_")&&typeof table[k]!=="function");backupData.push({tableName,columns,rows}),totalRows+=rows.length}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to export table ${tableName}: ${msg}`)}}let backupFile={manifest:{version:"1.0",createdAt:now.toISOString(),schemaName:resolvedSchema,format:this.config.format,tables:backupData.map((t)=>({tableName:t.tableName,rowCount:t.rows.length,columns:t.columns})),totalRows},data:backupData},jsonContent=JSON.stringify(backupFile,null,2);if(this.config.encryptionKey)await writeFile(filePath,encryptBackup(jsonContent,this.config.encryptionKey));else await writeFile(filePath,jsonContent,"utf-8");let fileStats=await stat2(filePath);return logRecord.status="completed",logRecord.completedAt=new Date().toISOString(),logRecord.tableCount=backupData.length,logRecord.rowCount=totalRows,logRecord.sizeBytes=fileStats.size,logRecord.includedTables=tableNames,await this.updateLogRecord(logRecord),this.logger.info("[Backup] Backup completed",{backupId,schemaName:resolvedSchema,tables:backupData.length,rows:totalRows,sizeBytes:fileStats.size}),await this.enforceMaxBackups(),logRecord}catch(err){let msg=err instanceof Error?err.message:String(err);return logRecord.status="failed",logRecord.errorMessage=msg,logRecord.completedAt=new Date().toISOString(),await this.updateLogRecord(logRecord),this.logger.error("[Backup] Backup failed",err,{backupId,schemaName:resolvedSchema}),logRecord}}async restoreFromBackup(backupId,performedBy,targetSchemaName,targetSchemaTables){if(!this.config.allowRestore)return{success:!1,message:"Restore is disabled in configuration"};let resolvedTables=targetSchemaTables||this.schemaTables,logRecord=await this.getLogRecord(backupId);if(!logRecord)return{success:!1,message:"Backup not found"};if(logRecord.status!=="completed")return{success:!1,message:`Cannot restore from backup with status: ${logRecord.status}`};let filePath=join4(this.config.storagePath,logRecord.fileName);try{let raw=await readFile(filePath),content;if(isEncryptedBackup(raw)){if(!this.config.encryptionKey)return{success:!1,message:"Backup is encrypted but no encryption key is configured"};content=decryptBackup(raw,this.config.encryptionKey)}else content=raw.toString("utf-8");let backupFile=JSON.parse(content);await this.createBackup("pre_restore",performedBy,targetSchemaName,targetSchemaTables);let tablesRestored=0,rowsRestored=0,ordered=backupFile.data.map((tableData)=>({tableData,table:resolvedTables[tableData.tableName]})).filter((entry)=>{if(!entry.table)return this.logger.warn(`[Backup] Skipping restore for ${entry.tableData.tableName}: table not found in schema`),!1;return!0});return await this.db.transaction(async(tx)=>{for(let{table}of[...ordered].reverse())await tx.delete(table);for(let{tableData,table}of ordered){if(tableData.rows.length===0)continue;let chunkSize=500;for(let i=0;i<tableData.rows.length;i+=chunkSize){let chunk=reviveRowTypes(table,tableData.rows.slice(i,i+chunkSize));await tx.insert(table).values(chunk)}tablesRestored++,rowsRestored+=tableData.rows.length}}),logRecord.status="restored",await this.updateLogRecord(logRecord),this.logger.info("[Backup] Restore completed",{backupId,tablesRestored,rowsRestored}),{success:!0,message:`Restored ${tablesRestored} tables with ${rowsRestored} rows`,tablesRestored,rowsRestored}}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.error("[Backup] Restore failed",err,{backupId}),{success:!1,message:`Restore failed: ${msg}`}}}async listBackups(){if(!this.backupLogsTable)return[];return await this.db.select().from(this.backupLogsTable).orderBy(sql2`created_at DESC`).limit(100)}async getBackupFilePath(backupId){let record=await this.getLogRecord(backupId);if(!record)return null;return join4(this.config.storagePath,record.fileName)}async deleteBackup(backupId){let record=await this.getLogRecord(backupId);if(!record)return!1;let filePath=join4(this.config.storagePath,record.fileName);try{await unlink3(filePath)}catch{}if(this.backupLogsTable)await this.db.delete(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId));return!0}startScheduler(){if(!this.config.schedule.enabled||!this.config.schedule.cron)return;if(!parseCron(this.config.schedule.cron))this.logger.error("[Backup] Cron expression not understood \u2014 falling back to the default",{cron:this.config.schedule.cron,fallback:DEFAULT_CRON,expected:'five fields ("0 2 * * *", "0 3 * * MON", "*/15 * * * *") or a macro (@daily, @weekly, @monthly)'}),this.config={...this.config,schedule:{...this.config.schedule,cron:DEFAULT_CRON}};this.logger.info("[Backup] Scheduler started",{cron:this.config.schedule.cron,timeZone:this.scheduleTimeZone(),retentionDays:this.config.schedule.retentionDays,replicaSafe:Boolean(this.lock)}),this.schedulerActive=!0,this.scheduleNextRun()}scheduleTimeZone(){return this.config.schedule.timeZone||"UTC"}scheduleNextRun(){if(!this.schedulerActive)return;let now=new Date,nextRun=nextCronRun(this.config.schedule.cron,now,this.scheduleTimeZone());if(!nextRun){this.logger.error("[Backup] Cron expression matches no future time \u2014 scheduler stopped",{cron:this.config.schedule.cron}),this.schedulerActive=!1;return}let delayMs=nextRun.getTime()-now.getTime();this.logger.debug?.("[Backup] Next scheduled backup",{at:nextRun.toISOString(),inMs:delayMs});let hop=nextHopMs(delayMs);this.cronTimer=setTimeout(async()=>{if(Date.now()<nextRun.getTime()){this.scheduleNextRun();return}try{if(await this.claimScheduledRun(nextRun))this.logger.info("[Backup] Scheduled backup starting..."),await this.createBackup("scheduled"),await this.cleanupExpiredBackups()}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.error("[Backup] Scheduled backup failed",{error:msg})}finally{this.scheduleNextRun()}},hop)}async claimScheduledRun(fireTime){if(!this.lock)return!0;let key=`nucleus:backup:schedule:${this.schemaName}:${fireTime.toISOString()}`;try{let result=await this.lock.acquireLock(key,3600);if(result.success&&result.data===!1)return this.logger.info("[Backup] Another replica owns this run \u2014 skipping",{fireTime:fireTime.toISOString()}),!1;return!0}catch(err){return this.logger.warn("[Backup] Lock unavailable \u2014 running anyway",{error:err instanceof Error?err.message:String(err)}),!0}}stopScheduler(){if(this.schedulerActive=!1,this.cronTimer)clearTimeout(this.cronTimer),this.cronTimer=null,this.logger.info("[Backup] Scheduler stopped")}getBackupTableNames(tables){return selectBackupTables(tables,this.config.excludeTables)}async insertLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.insert(this.backupLogsTable).values({id:record.id,backupName:record.backupName,fileName:record.fileName,schemaName:record.schemaName,format:record.format,status:record.status,trigger:record.trigger,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),excludedTables:JSON.stringify(record.excludedTables),errorMessage:record.errorMessage,startedAt:record.startedAt?new Date(record.startedAt):null,completedAt:record.completedAt?new Date(record.completedAt):null,performedBy:record.performedBy,cronExpression:record.cronExpression,retentionDays:record.retentionDays,createdAt:new Date,updatedAt:new Date})}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to insert backup log: ${msg}`)}}async updateLogRecord(record){if(!this.backupLogsTable)return;try{await this.db.update(this.backupLogsTable).set({status:record.status,sizeBytes:record.sizeBytes,tableCount:record.tableCount,rowCount:record.rowCount,includedTables:JSON.stringify(record.includedTables),errorMessage:record.errorMessage,completedAt:record.completedAt?new Date(record.completedAt):null,updatedAt:new Date}).where(eq7(col(this.backupLogsTable,"id"),record.id))}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[Backup] Failed to update backup log: ${msg}`)}}async getLogRecord(backupId){if(!this.backupLogsTable)return null;return(await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"id"),backupId)).limit(1))[0]||null}async enforceMaxBackups(){if(!this.backupLogsTable)return;let allBackups=await this.db.select().from(this.backupLogsTable).where(eq7(col(this.backupLogsTable,"status"),"completed")).orderBy(sql2`created_at DESC`);if(allBackups.length>this.config.maxBackups){let toDelete=allBackups.slice(this.config.maxBackups);for(let backup of toDelete){let b=backup;await this.deleteBackup(b.id)}this.logger.info("[Backup] Old backups cleaned up",{deleted:toDelete.length})}}async cleanupExpiredBackups(){if(!this.backupLogsTable||!this.config.schedule.retentionDays)return;let cutoff=new Date;cutoff.setDate(cutoff.getDate()-this.config.schedule.retentionDays);let{lt}=await import("drizzle-orm"),expired=await this.db.select().from(this.backupLogsTable).where(lt(col(this.backupLogsTable,"createdAt"),cutoff));for(let backup of expired){let b=backup;await this.deleteBackup(b.id)}if(expired.length>0)this.logger.info("[Backup] Expired backups cleaned up",{deleted:expired.length,retentionDays:this.config.schedule.retentionDays})}}var col=(table,name)=>table[name],MAX_TIMEOUT_MS=2147483647,DEFAULT_CRON="0 2 * * *";var init_BackupService=__esm(()=>{init_cron();init_encryption()});var init_Backup=__esm(()=>{init_BackupService()});function parseTimeToSeconds(time){let match=time.match(/^(\d+)(s|m|h|d)$/);if(!match||!match[1]||!match[2])return 300;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value;case"m":return value*60;case"h":return value*3600;case"d":return value*86400;default:return 300}}function generateSecureId(){let bytes=new Uint8Array(24);return crypto.getRandomValues(bytes),Array.from(bytes).map((b)=>b.toString(16).padStart(2,"0")).join("")}function hashAnswer(answer){let hasher=new Bun.CryptoHasher("sha256");return hasher.update(answer),hasher.digest("hex")}function timingSafeEqual(a,b){if(a.length!==b.length){let dummy=new Uint8Array(32);return crypto.getRandomValues(dummy),!1}let encoder=new TextEncoder,bufA=encoder.encode(a),bufB=encoder.encode(b),result=0;for(let i=0;i<bufA.length;i++)result|=(bufA[i]??0)^(bufB[i]??0);return result===0}function getSecureRandomInt(min,max){let range=max-min+1,bytesNeeded=Math.ceil(Math.log2(range)/8)||1,maxValue=256**bytesNeeded,limit=maxValue-maxValue%range,randomValue,bytes=new Uint8Array(bytesNeeded);do crypto.getRandomValues(bytes),randomValue=bytes.reduce((acc,byte,i)=>acc+byte*256**i,0);while(randomValue>=limit);return min+randomValue%range}function generateMathChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],{min,max}=config.mathRange,operations=["+","-","\xD7"],operation=operations[getSecureRandomInt(0,operations.length-1)],num1=getSecureRandomInt(min,max),num2=getSecureRandomInt(min,max),answer;switch(operation){case"+":answer=num1+num2;break;case"-":if(num1<num2)[num1,num2]=[num2,num1];answer=num1-num2;break;case"\xD7":num1=getSecureRandomInt(1,12),num2=getSecureRandomInt(1,12),answer=num1*num2;break;default:answer=num1+num2}return{question:`${num1} ${operation} ${num2} = ?`,answer:answer.toString()}}function generateTextChallenge(difficulty){let config=DIFFICULTY_CONFIG[difficulty],text="";for(let i=0;i<config.textLength;i++)text+=CHARACTERS.charAt(getSecureRandomInt(0,CHARACTERS.length-1));return{question:text,answer:text}}function generateImageChallenge(difficulty){let textChallenge=generateTextChallenge(difficulty),width=200,height=60,svgContent=generateCaptchaSVG(textChallenge.answer,200,60),imageData=`data:image/svg+xml;base64,${Buffer.from(svgContent).toString("base64")}`;return{question:"Enter the text shown in the image",answer:textChallenge.answer,imageData}}function getSecureFloat(){let bytes=new Uint32Array(1);return crypto.getRandomValues(bytes),(bytes[0]??0)/4294967295}function generateCaptchaSVG(text,width,height){let bgR=240+getSecureFloat()*15,bgG=240+getSecureFloat()*15,bgB=240+getSecureFloat()*15,bgColor=`rgb(${bgR}, ${bgG}, ${bgB})`,noiseLines="";for(let i=0;i<12;i++){let x1=getSecureFloat()*width,y1=getSecureFloat()*height,x2=getSecureFloat()*width,y2=getSecureFloat()*height,r=getSecureFloat()*100+100,g=getSecureFloat()*100+100,b=getSecureFloat()*100+100,strokeWidth=1+getSecureFloat()*2;noiseLines+=`<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="rgb(${r},${g},${b})" stroke-width="${strokeWidth}"/>`}let noiseCurves="";for(let i=0;i<4;i++){let startX2=getSecureFloat()*width,startY=getSecureFloat()*height,cp1X=getSecureFloat()*width,cp1Y=getSecureFloat()*height,cp2X=getSecureFloat()*width,cp2Y=getSecureFloat()*height,endX=getSecureFloat()*width,endY=getSecureFloat()*height,r=getSecureFloat()*80+80,g=getSecureFloat()*80+80,b=getSecureFloat()*80+80;noiseCurves+=`<path d="M${startX2},${startY} C${cp1X},${cp1Y} ${cp2X},${cp2Y} ${endX},${endY}" stroke="rgb(${r},${g},${b})" stroke-width="2" fill="none"/>`}let noiseDots="";for(let i=0;i<80;i++){let x=getSecureFloat()*width,y=getSecureFloat()*height,r=getSecureFloat()*150+50,g=getSecureFloat()*150+50,b=getSecureFloat()*150+50,radius=getSecureFloat()*3+1;noiseDots+=`<circle cx="${x}" cy="${y}" r="${radius}" fill="rgb(${r},${g},${b})"/>`}let textElements="",charWidth=width/(text.length+2),startX=charWidth;for(let i=0;i<text.length;i++){let x=startX+i*charWidth+(getSecureFloat()-0.5)*15,y=height/2+8+(getSecureFloat()-0.5)*12,rotation=(getSecureFloat()-0.5)*40,fontSize=22+getSecureFloat()*10,r=getSecureFloat()*80,g=getSecureFloat()*80,b=getSecureFloat()*80,skewX=(getSecureFloat()-0.5)*15,scaleY=0.9+getSecureFloat()*0.3;textElements+=`<text x="${x}" y="${y}" font-family="Arial, Helvetica, sans-serif" font-size="${fontSize}" font-weight="bold" fill="rgb(${r},${g},${b})" transform="rotate(${rotation}, ${x}, ${y}) skewX(${skewX}) scale(1, ${scaleY})" style="font-style: ${getSecureFloat()>0.5?"italic":"normal"}">${text[i]}</text>`}let overlayLines="";for(let i=0;i<3;i++){let y=10+getSecureFloat()*(height-20),r=getSecureFloat()*60+60,g=getSecureFloat()*60+60,b=getSecureFloat()*60+60;overlayLines+=`<line x1="0" y1="${y}" x2="${width}" y2="${y+(getSecureFloat()-0.5)*20}" stroke="rgb(${r},${g},${b})" stroke-width="1.5"/>`}return`<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">
 		<defs>
 			<filter id="noise" x="0%" y="0%" width="100%" height="100%">
 				<feTurbulence type="fractalNoise" baseFrequency="0.04" numOctaves="2" result="noise"/>
@@ -551,14 +551,14 @@ ${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algor
       where table_schema = ${schemaName}
         and table_name = ${tableName}
         and column_name = 'expires_at'
-    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql15.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function positive(value2,fallback){return typeof value2==="number"&&Number.isFinite(value2)&&value2>0?value2:fallback}function resolveFetchLimits(options={}){let retries=typeof options.retries==="number"&&Number.isFinite(options.retries)?Math.min(1,Math.max(0,Math.floor(options.retries))):DISCOVERY_FETCH_DEFAULTS.retries,retryDelayMs=typeof options.retryDelayMs==="number"&&Number.isFinite(options.retryDelayMs)&&options.retryDelayMs>=0?options.retryDelayMs:DISCOVERY_FETCH_DEFAULTS.retryDelayMs;return{timeoutMs:positive(options.timeoutMs,DISCOVERY_FETCH_DEFAULTS.timeoutMs),maxBytes:positive(options.maxBytes,DISCOVERY_FETCH_DEFAULTS.maxBytes),retries,retryDelayMs,hookTimeoutMs:positive(options.hookTimeoutMs,DISCOVERY_FETCH_DEFAULTS.hookTimeoutMs)}}function withDeadline2(work,ms,onTimeout,onExpire){return new Promise((resolve2,reject)=>{let timer=setTimeout(()=>{onExpire?.(),reject(onTimeout())},ms);work.then((value2)=>{clearTimeout(timer),resolve2(value2)},(error3)=>{clearTimeout(timer),reject(error3)})})}function discoveryUrl(baseUrl,openapiPath){let joined=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,parsed;try{parsed=new URL(joined)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined}`,!1)}if(parsed.protocol!=="http:"&&parsed.protocol!=="https:")throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined} (only http and https are fetched)`,!1);return joined}async function discard2(response){await response.body?.cancel().catch(()=>{return})}async function readCapped(response,maxBytes,url){let tooLarge=()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI document exceeds ${maxBytes} bytes for ${url}`,!1),advertised=Number(response.headers.get("content-length"));if(Number.isFinite(advertised)&&advertised>maxBytes)throw await discard2(response),tooLarge();let body=response.body;if(!body)return"";let reader=body.getReader(),chunks=[],size=0;while(!0){let part=await reader.read();if(part.done)break;if(size+=part.value.byteLength,size>maxBytes)throw await reader.cancel().catch(()=>{return}),tooLarge();chunks.push(part.value)}return new TextDecoder().decode(Buffer.concat(chunks,size))}async function attempt(url,fetchImpl,limits){let controller=new AbortController,work=(async()=>{let response;try{response=await fetchImpl(url,{headers:{accept:"application/json"},redirect:"manual",signal:controller.signal})}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed for ${url}: ${reason}`,!0)}if(response.type==="opaqueredirect"||REDIRECT_STATUSES.has(response.status))throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch refused a redirect (${response.status}) for ${url}`,!1);if(!response.ok)throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed ${response.status} for ${url}`,response.status===429||response.status>=500);let text3;try{text3=await readCapped(response,limits.maxBytes,url)}catch(error3){if(error3 instanceof DiscoveryFetchError)throw error3;let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI body read failed for ${url}: ${reason}`,!0)}try{return JSON.parse(text3)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_document (not JSON) for ${url}`,!1)}})();try{return await withDeadline2(work,limits.timeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch timed out after ${limits.timeoutMs}ms for ${url}`,!0),()=>controller.abort())}finally{controller.abort()}}async function fetchDiscoveryJson(url,fetchImpl,options={}){let limits=resolveFetchLimits(options),lastError;for(let tried=0;tried<=limits.retries;tried++){if(tried>0)await Bun.sleep(limits.retryDelayMs);try{return await attempt(url,fetchImpl,limits)}catch(error3){if(lastError=error3,!(error3 instanceof DiscoveryFetchError&&error3.retryable))throw error3}}throw lastError}var DISCOVERY_FETCH_DEFAULTS,DiscoveryFetchError,REDIRECT_STATUSES;var init_fetch2=__esm(()=>{DISCOVERY_FETCH_DEFAULTS=Object.freeze({timeoutMs:5000,maxBytes:16777216,retries:1,retryDelayMs:250,hookTimeoutMs:60000});DiscoveryFetchError=class DiscoveryFetchError extends Error{retryable;constructor(message,retryable){super(message);this.name="DiscoveryFetchError",this.retryable=retryable}};REDIRECT_STATUSES=new Set([301,302,303,307,308])});function isDiscoveryHooks(value2){return typeof value2==="object"&&value2!==null&&"captureConfig"in value2&&typeof value2.captureConfig==="function"&&"fetchDocument"in value2&&typeof value2.fetchDocument==="function"&&"run"in value2&&typeof value2.run==="function"}function configureAuthorizationDiscovery(hooks){if(!isDiscoveryHooks(hooks))throw TypeError("configureAuthorizationDiscovery: captureConfig, fetchDocument and run must all be functions");return installed.set(hooks),()=>{if(installed.get()===hooks)installed.set(void 0)}}function authorizationDiscoveryHooks(){return installed.get()}function hostDiscoveryConfig(config){let view={};if(config.enabled!==void 0)view.enabled=config.enabled;if(config.runOnBoot!==void 0)view.runOnBoot=config.runOnBoot;if(config.services)view.services=config.services.map((service)=>{let copy2={id:service.id,baseUrl:service.baseUrl};if(service.openapi!==void 0)copy2.openapi=service.openapi;if(service.exclude)copy2.exclude=[...service.exclude];return copy2});return view}function hostRunCeilingMs(serviceCount,hookTimeoutMs){return(Math.max(0,serviceCount)+1)*hookTimeoutMs}function isDiscoveryResult(value2){return typeof value2==="object"&&value2!==null&&"services"in value2&&Array.isArray(value2.services)}function isThenable(value2){return typeof value2==="object"&&value2!==null&&"then"in value2&&typeof value2.then==="function"}function warnCaptureFailed(logger2,error3){logger2.warn("[Discovery] Host captureConfig hook failed",{error:error3 instanceof Error?error3.message:String(error3)})}function captureDiscoveryConfig(config,logger2){let hooks=authorizationDiscoveryHooks();if(!hooks)return;let returned;try{returned=hooks.captureConfig(hostDiscoveryConfig(config))}catch(error3){warnCaptureFailed(logger2,error3);return}if(isThenable(returned))Promise.resolve(returned).then(void 0,(error3)=>warnCaptureFailed(logger2,error3))}var installed;var init_hooks=__esm(()=>{installed=processRegistry("nucleus-core-ts.authorizationDiscovery.hooks.v1",isDiscoveryHooks)});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}function isRecord2(value2){return typeof value2==="object"&&value2!==null&&!Array.isArray(value2)}function toOperation(value2){let operation={};if(Array.isArray(value2.tags))operation.tags=value2.tags.filter((tag)=>typeof tag==="string");if(typeof value2.operationId==="string")operation.operationId=value2.operationId;if(typeof value2.summary==="string")operation.summary=value2.summary;if(typeof value2.description==="string")operation.description=value2.description;return operation}function toOpenApiDoc(value2){if(!isRecord2(value2))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (not a JSON object)",!1);if(value2.paths===void 0)return{};if(!isRecord2(value2.paths))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (paths is not an object)",!1);return{paths:Object.fromEntries(Object.entries(value2.paths).flatMap(([path7,item])=>isRecord2(item)?[[path7,operationsOf(item)]]:[]))}}function operationsOf(item){return Object.fromEntries(Object.entries(item).flatMap(([method,operation])=>isRecord2(operation)?[[method,toOperation(operation)]]:[]))}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(hooks){let{hookTimeoutMs}=resolveFetchLimits(options),document2=await withDeadline2(Promise.resolve().then(()=>hooks.fetchDocument(baseUrl,openapiPath,fetchImpl)),hookTimeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: host fetchDocument hook timed out after ${hookTimeoutMs}ms`,!0));return toOpenApiDoc(document2)}let url=discoveryUrl(baseUrl,openapiPath);return toOpenApiDoc(await fetchDiscoveryJson(url,fetchImpl,options))}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{init_fetch2();init_hooks();HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest,EMPTY_CATALOG_ERROR:()=>EMPTY_CATALOG_ERROR});import{eq as eq72,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){if(specs.length===0)throw Error(EMPTY_CATALOG_ERROR);let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq72(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq72(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(!hooks)return reconcileServices(db,schemaTables,config,logger2,fetchImpl,options);let services=config.services??[],execute=(serviceIds)=>reconcileServices(db,schemaTables,serviceIds?{...config,services:services.filter((svc)=>serviceIds.includes(svc.id))}:config,logger2,fetchImpl,options),ceilingMs=hostRunCeilingMs(services.length,resolveFetchLimits(options).hookTimeoutMs);logger2.info("[Discovery] Running through the host discovery hooks",{services:services.map((svc)=>svc.id),ceilingMs});let returned=await withDeadline2(Promise.resolve().then(()=>hooks.run(hostDiscoveryConfig(config),execute)),ceilingMs,()=>Error(`endpointDiscovery: host run hook timed out after ${ceilingMs}ms`));if(!isDiscoveryResult(returned))throw Error("endpointDiscovery: host run hook returned no DiscoveryResult");return returned}async function reconcileServices(db,schemaTables,config,logger2,fetchImpl,options){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl,options),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var EMPTY_CATALOG_ERROR="endpointDiscovery: empty_catalog";var init_seed=__esm(()=>{init_fetch2();init_hooks();init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord3(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord3(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord3(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord3(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord3(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});function covers(prefix,claim){return claim===prefix||claim.startsWith(`${prefix}.`)}function dotPrefixes(action,maxLength=action.length){let prefixes=[];for(let dot=action.indexOf(".");dot>=0&&dot<=maxLength;)prefixes.push(action.slice(0,dot)),dot=action.indexOf(".",dot+1);if(action.length<=maxLength)prefixes.push(action);return prefixes}function roleGrants(list2){let grants=new Set(list2.filter((grant)=>grant!=="")),above=new Set;for(let grant of grants){if(grant.endsWith(".*"))continue;for(let prefix of dotPrefixes(grant).slice(0,-1))above.add(prefix)}return{grants,above}}function catalogActions(catalog){return[...new Set(catalog)].filter((action)=>action!==""&&!action.endsWith(".*")).sort()}function family(guard4){if(guard4.valueType!=="int"||typeof guard4.threshold!=="number")return null;if(!Number.isFinite(guard4.threshold))return null;if(guard4.op==="gt"||guard4.op==="gte")return"upper";if(guard4.op==="lt"||guard4.op==="lte")return"lower";return null}function permissiveness(guard4){let threshold=typeof guard4.threshold==="number"?guard4.threshold:0;if(guard4.op==="gt"||guard4.op==="gte")return[threshold,guard4.op==="gt"?1:0];return[-threshold,guard4.op==="lt"?1:0]}function compare2(a,b){return a[0]!==b[0]?a[0]-b[0]:a[1]-b[1]}function keptCover(node,actions,dropped,catalog){let droppedHere=actions.filter((action)=>dropped.has(action)).length;if(droppedHere===0)return[node];if(droppedHere===actions.length)return[];if(catalog.has(node)&&!dropped.has(node))return[node];let children=new Map;for(let action of actions){if(action===node)continue;let rest3=action.slice(node.length+1),dot=rest3.indexOf("."),child=`${node}.${dot>=0?rest3.slice(0,dot):rest3}`,under=children.get(child);if(under)under.push(action);else children.set(child,[action])}return[...children].flatMap(([child,under])=>keptCover(child,under,dropped,catalog))}function decideAction(action,guards,roles,held,longestHeld){let prefixes=dotPrefixes(action,longestHeld),granting=new Set,partial3=new Set;for(let[roleId,role]of roles)if(prefixes.some((prefix)=>role.grants.has(prefix)))granting.add(roleId);else if(role.above.has(action))partial3.add(roleId);let heldPrefix=prefixes.find((prefix)=>held.has(prefix)),onAction=guards.map((guard4,index)=>({guard:guard4,index})).filter(({guard:guard4})=>granting.has(guard4.roleId)&&guard4.invalidates.some((entry)=>covers(entry,action))),guarded=new Set(onAction.map(({guard:guard4})=>guard4.roleId)),unlimited=[...granting].some((roleId)=>!guarded.has(roleId)),winners=new Map;if(unlimited)return{granting,partial:partial3,heldPrefix,unlimited,winners};let strictest=new Map;for(let entry of onAction){let kind=family(entry.guard);if(!kind)continue;let group=`${kind}:${entry.guard.key}`,byRole=strictest.get(group)??new Map;strictest.set(group,byRole);let known=byRole.get(entry.guard.roleId);if(!known||compare2(permissiveness(entry.guard),permissiveness(known.guard))<0)byRole.set(entry.guard.roleId,entry)}for(let[group,byRole]of strictest){let best;for(let candidate of byRole.values()){let order=best?compare2(permissiveness(candidate.guard),permissiveness(best.guard)):1;if(!best||order>0||order===0&&candidate.index<best.index)best=candidate}if(best)winners.set(group,best.guard.roleId)}return{granting,partial:partial3,heldPrefix,unlimited,winners}}function stillLimits(guard4,decision){if(!decision.granting.has(guard4.roleId)){if(!decision.partial.has(guard4.roleId))return!0;return decision.granting.size===0&&decision.heldPrefix!==void 0}if(decision.unlimited)return!1;let kind=family(guard4);if(!kind)return!0;return decision.winners.get(`${kind}:${guard4.key}`)===guard4.roleId}function suppressEntries(invalidates,limited,decide){let suppress=new Set(invalidates);for(let action of limited){let claim=decide(action).heldPrefix;if(claim!==void 0&&!dotPrefixes(claim).some((prefix)=>suppress.has(prefix)))suppress.add(claim)}return[...suppress]}function mostGenerousTargets(input){let{guards}=input,roles=new Map;for(let[roleId,grants]of input.grantsByRole)roles.set(roleId,roleGrants(grants));let held=new Set([...roles.values()].flatMap(({grants})=>[...grants]));for(let claim of input.heldWithoutGrant??[])if(claim!=="")held.add(claim);let heldList=[...held],longestHeld=heldList.reduce((longest,claim)=>Math.max(longest,claim.length),0),reached=(entry)=>heldList.some((claim)=>covers(entry,claim)||covers(claim,entry)),actions=catalogActions(input.catalog),actionSet=new Set(actions),decisions=new Map,decide=(action)=>{let known=decisions.get(action);if(known)return known;let decision=decideAction(action,guards,roles,held,longestHeld);return decisions.set(action,decision),decision};return guards.map((guard4)=>{let invalidates=new Set,limited=new Set;for(let target2 of guard4.invalidates){let under=actions.filter((action)=>covers(target2,action)),targetActions=under.length>0?under:[target2],dropped=new Set(targetActions.filter((action)=>!stillLimits(guard4,decide(action))));for(let entry of keptCover(target2,targetActions,dropped,actionSet))if(entry===target2||reached(entry))invalidates.add(entry);for(let action of targetActions)if(!dropped.has(action)&&actionSet.has(action))limited.add(action)}return{invalidates:[...invalidates],suppress:suppressEntries([...invalidates],[...limited],decide)}})}async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map,grantActionByClaimId=new Map,inactiveActionByClaimId=new Map;for(let c of claimRows){let action=String(c.action??""),policy=parseGuardPolicy(c.policy);if(c.isActive===!1){if(action)inactiveActionByClaimId.set(String(c.id),action)}else if(policy)guardByClaimId.set(String(c.id),{action,policy});else if(action)grantActionByClaimId.set(String(c.id),action)}if(guardByClaimId.size===0)return EMPTY;let mine=(await db.select().from(userRolesTable)).filter((r)=>String(r.userId??r.user_id)===userId),roleIds=new Set(mine.filter((r)=>r.isActive!==!1).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let assignedRoleIds=new Set(mine.map((r)=>String(r.roleId??r.role_id))),rcRows=(await db.select().from(roleClaimsTable)).filter((rc)=>assignedRoleIds.has(String(rc.roleId??rc.role_id))).map((row)=>({row,key:assignmentKey(row)})).sort((a,b)=>a.key<b.key?-1:a.key>b.key?1:0).map(({row})=>row),assignments=[],grantsByRole=new Map,heldWithoutGrant=[];for(let rc of rcRows){let roleId=String(rc.roleId??rc.role_id),claimId=String(rc.claimId??rc.claim_id),inactive=inactiveActionByClaimId.get(claimId);if(inactive){heldWithoutGrant.push(inactive);continue}let grant=grantActionByClaimId.get(claimId);if(rc.isActive===!1||!roleIds.has(roleId)){let action=grant??guardByClaimId.get(claimId)?.action;if(action)heldWithoutGrant.push(action);continue}if(grant){if(!countsAsGrant(rc.scope)){heldWithoutGrant.push(grant);continue}let held=grantsByRole.get(roleId);if(held)held.push(grant);else grantsByRole.set(roleId,[grant]);continue}let guard4=guardByClaimId.get(claimId);if(!guard4)continue;if(guard4.action)heldWithoutGrant.push(guard4.action);let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;assignments.push({roleId,action:guard4.action,policy:guard4.policy,condition})}if(assignments.length===0)return EMPTY;let keyOf=(a)=>resolveGuardKey(a.policy.keyTemplate,{userId,tenant:ctx.tenant}),targets=mostGenerousTargets({guards:assignments.map((a)=>({roleId:a.roleId,key:keyOf(a),valueType:a.policy.valueType,op:a.condition.op,threshold:a.condition.value,invalidates:a.condition.invalidates})),grantsByRole,heldWithoutGrant,catalog:[...grantActionByClaimId.values()]}),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let[index,assignment]of assignments.entries()){let invalidates=targets[index]?.invalidates??[],suppress=targets[index]?.suppress??invalidates;if(invalidates.length===0&&assignment.condition.invalidates.length>0)continue;let{policy,condition}=assignment,key2=keyOf(assignment),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,policy.valueType,condition),current=normalizeCurrent(value2,policy.valueType);if(guards.push({action:assignment.action,key:key2,valueType:policy.valueType,op:condition.op,threshold:condition.value,current,invalidates,holds}),holds&&suppress.length>0){for(let a of suppress)suppressed.add(a);firedGuards.push({action:assignment.action,key:key2,invalidates:suppress})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function countsAsGrant(scope){return!(typeof scope==="string"&&scope.includes("="))}function assignmentKey(row){return[row.roleId??row.role_id,row.claimId??row.claim_id,row.scope,row.id].map((value2)=>value2==null?"":typeof value2==="string"?value2:JSON.stringify(value2)).join("\x00")}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq73}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq73(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq73(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and34,eq as eq74,isNull as isNull9}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and34(eq74(col17(table,"challenge"),challenge),eq74(col17(table,"challengeType"),challengeType),isNull9(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq74(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq74(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq74(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard3(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard3(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard3,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg;captureDiscoveryConfig(discovery,logger2);let token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_hooks();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{batch,createStore}from"h-state";import{useEffectEvent}from"react";function createInitialState(endpoints){let state={};for(let key of Object.keys(endpoints))state[key]={isPending:!1,data:null,error:null,code:null};return state}function createActionsFacade(endpoints,buildAction){let cache=new Map;return new Proxy({},{get(_target,property){if(typeof property!=="string")return;if(!Object.hasOwn(endpoints,property))return;if(cache.has(property))return cache.get(property);let action=buildAction(property);return cache.set(property,action),action},has(_target,property){return typeof property==="string"&&Object.hasOwn(endpoints,property)},ownKeys(){return Object.keys(endpoints)},getOwnPropertyDescriptor(){return{enumerable:!0,configurable:!0}}})}function applyResponse(response,fallbackError){if(response.isSuccess&&response.data!==void 0)return{data:response.data,error:null,code:response.code??null};return{data:null,error:response.errors??fallbackError??null,code:response.code??null}}function createApiHook(endpoints,factory){let{useStore}=createStore(createInitialState(endpoints),{_callEndpoint:(store)=>async(endpointKey,options)=>{if(!store[endpointKey])return;batch(()=>{store[endpointKey].isPending=!0,store[endpointKey].error=null});try{let response=await factory(endpointKey,options.payload);if(batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].code=response.code??null;let applied=applyResponse(response);store[endpointKey].data=applied.data,store[endpointKey].error=applied.error}),response.isSuccess)options.onAfterHandle?.(response.data??response);else options.onErrorHandle?.(response.errors??{message:"Request failed"},response.code,response.requestId)}catch(err){batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].data=null,store[endpointKey].error={message:err instanceof Error?err.message:"Unknown error"}}),options.onErrorHandle?.({message:err instanceof Error?err.message:"Unknown error"},null)}}});return function(){let store=useStore(),callEndpoint=useEffectEvent((endpointKey,options)=>{store._callEndpoint(endpointKey,options)});return createActionsFacade(endpoints,(property)=>{let key=property;return{state:store[key],start:(options)=>{callEndpoint(key,options)}}})}}var system_tables_default={$schema:"../schemas/nucleus.tables.schema.json",tables:[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}]};function deriveAuthEndpoints(configs){let out={};for(let config of Object.values(configs)){let subs=config.subEndpoints??[{key:config.key,method:config.method,suffix:""}];for(let sub of subs){let base=sub.defaultRoute??config.defaultRoute,entry={method:sub.method??config.method,path:`${base}${sub.suffix??""}`},isPublic=sub.isPublic??config.defaultIsPublic;if(isPublic!==void 0)entry.isPublic=isPublic;entry._payload=sub._payload??config._payload,entry._success=sub._success??config._success,entry._error=sub._error??config._error,out[sub.key]=entry}}return out}var AUTH_ENDPOINT_CONFIGS={login:{key:"LOGIN",method:"POST",defaultRoute:"/auth/login",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},register:{key:"REGISTER",method:"POST",defaultRoute:"/auth/register",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},logout:{key:"LOGOUT",method:"POST",defaultRoute:"/auth/logout",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},refresh:{key:"REFRESH",method:"POST",defaultRoute:"/auth/refresh",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},me:{key:"ME",method:"GET",defaultRoute:"/auth/me",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordChange:{key:"PASSWORD_CHANGE",method:"POST",defaultRoute:"/auth/password-change",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordSet:{key:"PASSWORD_SET",method:"POST",defaultRoute:"/auth/password-set",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordReset:{key:"PASSWORD_RESET_REQUEST",method:"POST",defaultRoute:"/auth/password-reset",defaultIsPublic:!0,subEndpoints:[{key:"PASSWORD_RESET_REQUEST",method:"POST",suffix:"/request",_payload:void 0,_success:void 0,_error:void 0},{key:"PASSWORD_RESET_CONFIRM",method:"POST",suffix:"/confirm",_payload:void 0,_success:void 0,_error:void 0}]},sessions:{key:"SESSIONS",method:"GET",defaultRoute:"/auth/sessions",defaultIsPublic:!1,subEndpoints:[{key:"SESSIONS",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_CURRENT",method:"GET",suffix:"/current",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_STATS",method:"GET",suffix:"/stats",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_PENDING",method:"GET",suffix:"/pending",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE",method:"DELETE",suffix:"/:sessionId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE_ALL",method:"DELETE",suffix:"/all",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_LIST",method:"GET",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_REVOKE",method:"DELETE",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_APPROVE",method:"POST",suffix:"/approve",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REJECT",method:"POST",suffix:"/reject",_payload:void 0,_success:void 0,_error:void 0}]},magicLink:{key:"MAGIC_LINK",method:"POST",defaultRoute:"/auth/magic-link",defaultIsPublic:!0,subEndpoints:[{key:"MAGIC_LINK",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"MAGIC_LINK_VERIFY",method:"GET",suffix:"/verify",routeKey:"verifyRoute",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},invite:{key:"INVITE",method:"POST",defaultRoute:"/auth/invite",defaultIsPublic:!1,subEndpoints:[{key:"INVITE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"INVITE_VERIFY",method:"POST",suffix:"/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},emailVerification:{key:"VERIFY_EMAIL",method:"GET",defaultRoute:"/verify-email",defaultIsPublic:!0,subEndpoints:[{key:"VERIFY_EMAIL",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"RESEND_VERIFICATION",method:"POST",suffix:"",routeKey:"resendRoute",defaultRoute:"/resend-verification",_payload:void 0,_success:void 0,_error:void 0}]},captcha:{key:"CAPTCHA",method:"GET",defaultRoute:"/auth/captcha",defaultIsPublic:!0,subEndpoints:[{key:"CAPTCHA_GENERATE",method:"GET",suffix:"/generate",_payload:void 0,_success:void 0,_error:void 0},{key:"CAPTCHA_VALIDATE",method:"POST",suffix:"/validate",_payload:void 0,_success:void 0,_error:void 0}]},oauth:{key:"OAUTH_PROVIDERS",method:"GET",defaultRoute:"/auth/oauth",defaultIsPublic:!0,subEndpoints:[{key:"OAUTH_PROVIDERS",method:"GET",suffix:"/providers",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_REDIRECT",method:"GET",suffix:"/:provider",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_ACCOUNTS",method:"GET",suffix:"/accounts",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_UNLINK",method:"DELETE",suffix:"/unlink/:provider",_payload:void 0,_success:void 0,_error:void 0}]},webauthn:{key:"WEBAUTHN",method:"POST",defaultRoute:"/auth/webauthn",defaultIsPublic:!1,subEndpoints:[{key:"WEBAUTHN_REGISTER_OPTIONS",method:"POST",suffix:"/register/options",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REGISTER_VERIFY",method:"POST",suffix:"/register/verify",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_OPTIONS",method:"POST",suffix:"/authenticate/options",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_VERIFY",method:"POST",suffix:"/authenticate/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_LIST",method:"GET",suffix:"/credentials",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REVOKE",method:"DELETE",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_RENAME",method:"PATCH",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0}]},apiKeys:{key:"API_KEYS",method:"GET",defaultRoute:"/auth/api-keys",defaultIsPublic:!1,subEndpoints:[{key:"API_KEYS_CREATE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_LIST",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_DETAIL",method:"GET",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_UPDATE",method:"PATCH",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_REVOKE",method:"DELETE",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0}]}},ADMIN_ENDPOINTS={ADMIN_IMPERSONATE:{method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_IMPERSONATE_STOP:{method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CHANGE_USER_ID:{method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_USER:{method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_HARD_DELETE_USER:{method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_LOCK_USER:{method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UNLOCK_USER:{method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_MARK_EMAIL_VERIFIED:{method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},UNPUBLISHED_AUTH_KEYS=[];function publishedAuthEndpoints(){let all=deriveAuthEndpoints(AUTH_ENDPOINT_CONFIGS),excluded=new Set(UNPUBLISHED_AUTH_KEYS);return Object.fromEntries(Object.entries(all).filter(([key])=>!excluded.has(key)))}var AUTH_ENDPOINTS={...publishedAuthEndpoints(),...ADMIN_ENDPOINTS},CONFIG_ENDPOINTS={CONFIG_GET:{method:"GET",path:"/nucleus/config",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTIONS:{method:"GET",path:"/nucleus/config/sections",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_GET:{method:"GET",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_UPDATE:{method:"PATCH",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_ENV:{method:"GET",path:"/nucleus/config/env",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_GET:{method:"GET",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_CLEAR:{method:"DELETE",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_RESTART:{method:"POST",path:"/nucleus/config/restart",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},VERIFICATION_ENDPOINTS={VERIFICATION_STATUS:{method:"GET",path:"/verification/status/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_DECIDE:{method:"POST",path:"/verification/decide/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_CANCEL:{method:"POST",path:"/verification/:entity_name/:entity_id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_PENDING:{method:"GET",path:"/verification/pending",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_HISTORY:{method:"GET",path:"/verification/history/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START:{method:"POST",path:"/verification/start",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START_FOR_ENTITY:{method:"POST",path:"/verification/start-for-entity",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_ENTITY_STATUSES:{method:"GET",path:"/verification/entity-statuses/:entity_name",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_LIST:{method:"GET",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_GET:{method:"GET",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_SAVE:{method:"POST",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_FEASIBILITY:{method:"POST",path:"/verification/flows/feasibility",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_PUBLISH:{method:"POST",path:"/verification/flows/:flow_id/publish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_UNPUBLISH:{method:"POST",path:"/verification/flows/:flow_id/unpublish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_DELETE:{method:"DELETE",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_LIST:{method:"GET",path:"/notifications",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_UNSEEN_COUNT:{method:"GET",path:"/notifications/unseen-count",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_SEEN:{method:"POST",path:"/notifications/:notification_id/seen",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_ALL_SEEN:{method:"POST",path:"/notifications/seen-all",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},CHAT_ENDPOINTS={CHAT_LIST_CONVERSATIONS:{method:"GET",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_CREATE_CONVERSATION:{method:"POST",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_CONVERSATION:{method:"GET",path:"/chat/conversations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_MESSAGES:{method:"GET",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_SEND_MESSAGE:{method:"POST",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_MARK_READ:{method:"POST",path:"/chat/conversations/:id/read",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_TYPING:{method:"POST",path:"/chat/conversations/:id/typing",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_ADD_PARTICIPANTS:{method:"POST",path:"/chat/conversations/:id/participants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_REMOVE_PARTICIPANT:{method:"DELETE",path:"/chat/conversations/:id/participants/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_EDIT_MESSAGE:{method:"PATCH",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_DELETE_MESSAGE:{method:"DELETE",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MONITORING_ENDPOINTS={MONITORING_HEALTH_CHECK:{method:"GET",path:"/monitoring/health",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_SETTINGS:{method:"GET",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_CHANGE_SETTINGS:{method:"PATCH",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_LOGS:{method:"GET",path:"/monitoring/logs",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},PAYMENT_ENDPOINTS={PAYMENT_INITIALIZE:{method:"POST",path:"/payments/initialize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTIONS:{method:"GET",path:"/payments/transactions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTION_DETAIL:{method:"GET",path:"/payments/transactions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_BIN_QUERY:{method:"POST",path:"/payments/bin-query",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DETAIL:{method:"POST",path:"/payments/payment-detail",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REFUND:{method:"POST",path:"/payments/refund",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SAVE_CARD:{method:"POST",path:"/payments/cards/save",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CARDS:{method:"GET",path:"/payments/cards",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CARD:{method:"DELETE",path:"/payments/cards/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SYNC_CARDS:{method:"POST",path:"/payments/cards/sync",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REGISTER_SUB_MERCHANT:{method:"POST",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUB_MERCHANT:{method:"PUT",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUB_MERCHANTS:{method:"GET",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUB_MERCHANT:{method:"GET",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SPLITS:{method:"GET",path:"/payments/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_APPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DISAPPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/disapprove",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRODUCT:{method:"POST",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRODUCT:{method:"PUT",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRODUCTS:{method:"GET",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRODUCT:{method:"GET",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRODUCT:{method:"DELETE",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRICE:{method:"POST",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRICE:{method:"PUT",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRICES:{method:"GET",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRICE:{method:"GET",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRICE:{method:"DELETE",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_CUSTOMER:{method:"POST",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_CUSTOMER:{method:"PUT",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CUSTOMERS:{method:"GET",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_CUSTOMER:{method:"GET",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CUSTOMER:{method:"DELETE",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUBSCRIPTION:{method:"PUT",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUBSCRIPTIONS:{method:"GET",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUBSCRIPTION:{method:"GET",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REPORT_USAGE:{method:"POST",path:"/payments/usage-records",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_USAGE_SUMMARIES:{method:"GET",path:"/payments/usage-records/:subscriptionItemId/summaries",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_INVOICE:{method:"POST",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_FINALIZE_INVOICE:{method:"POST",path:"/payments/invoices/:id/finalize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SEND_INVOICE:{method:"POST",path:"/payments/invoices/:id/send",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_VOID_INVOICE:{method:"POST",path:"/payments/invoices/:id/void",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_PAY_INVOICE:{method:"POST",path:"/payments/invoices/:id/pay",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_INVOICES:{method:"GET",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_INVOICE:{method:"GET",path:"/payments/invoices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_BALANCE:{method:"GET",path:"/payments/balance",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PAYOUT:{method:"POST",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PAYOUTS:{method:"GET",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PAYOUT:{method:"GET",path:"/payments/payouts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_PAYOUT:{method:"POST",path:"/payments/payouts/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_TRANSFER:{method:"POST",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_TRANSFERS:{method:"GET",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},TENANT_ENDPOINTS={TENANT_CHECK_SUBDOMAIN:{method:"GET",path:"/tenants/check-subdomain/:subdomain",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},TENANT_PROVISION:{method:"POST",path:"/tenants/provision",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_LIST:{method:"GET",path:"/tenants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_DETAIL:{method:"GET",path:"/tenants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SUSPEND:{method:"POST",path:"/tenants/:id/suspend",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_REACTIVATE:{method:"POST",path:"/tenants/:id/reactivate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SELF_SIGNUP:{method:"POST",path:"/tenants/self-signup",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}},DOMAIN_ENDPOINTS={DOMAIN_RESOLVE:{method:"GET",path:"/domains/resolve",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_HOSTNAME:{method:"POST",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_HOSTNAMES:{method:"GET",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_HOSTNAME:{method:"GET",path:"/domains/hostnames/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_HOSTNAME_INSTRUCTIONS:{method:"GET",path:"/domains/hostnames/:id/instructions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_VERIFY_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/verify",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_ACTIVATE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/activate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_DISABLE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/disable",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_MAKE_PRIMARY:{method:"POST",path:"/domains/hostnames/:id/make-primary",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_REFRESH_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/refresh-status",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_REGISTRATION:{method:"POST",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_REGISTRATIONS:{method:"GET",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_REGISTRATION:{method:"GET",path:"/domains/registrations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CANCEL_REGISTRATION:{method:"POST",path:"/domains/registrations/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_TRANSFER_OUT:{method:"POST",path:"/domains/registrations/:id/transfer-out",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MARKETPLACE_ENDPOINTS={PAYMENT_MARKETPLACE_RECORD_SPLIT:{method:"POST",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_SPLITS:{method:"GET",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_BALANCE:{method:"GET",path:"/payment/marketplace/balance/:ownerId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RELEASE_RESERVE:{method:"POST",path:"/payment/marketplace/reserves/:id/release",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_SETTLEMENT_POLICY:{method:"GET",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_UPSERT_SETTLEMENT_POLICY:{method:"POST",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REQUEST_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_PAYOUTS:{method:"GET",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_PAYOUT:{method:"GET",path:"/payment/marketplace/payout-requests/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_APPROVE_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REJECT_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/reject",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_OPEN_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_DISPUTES:{method:"GET",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RESOLVE_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes/:id/resolve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},COHORT_ENDPOINTS={ADMIN_LIST_COHORTS:{method:"GET",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_GET_COHORT:{method:"GET",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_COHORT:{method:"POST",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UPDATE_COHORT:{method:"PATCH",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_DELETE_COHORT:{method:"DELETE",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_BULK_CREATE:{method:"POST",path:"/auth/admin/cohorts/:id/bulk-create",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DEACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/deactivate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_ACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/activate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DELETE_USERS:{method:"POST",path:"/auth/admin/cohorts/:id/delete-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_EXPORT:{method:"GET",path:"/auth/admin/cohorts/:id/export",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}};var SYSTEM_TABLE_NAMES=["profiles","addresses","phones","files","users","roles","claims","user_roles","role_claims","audit_logs","monitoring_metrics","integration_sources","integration_endpoints","integration_mappings","integration_runs","integration_run_items"],systemTables=system_tables_default.tables.filter((t)=>SYSTEM_TABLE_NAMES.includes(t.table_name));function toUpperSnakeCase(str){return str.replace(/([a-z])([A-Z])/g,"$1_$2").replace(/[\s-]+/g,"_").toUpperCase()}function snakeToCamelCase(str){return str.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function singularize(str){if(str.endsWith("ies"))return`${str.slice(0,-3)}y`;if(str.endsWith("ses"))return`${str.slice(0,-2)}`;if(str.endsWith("s"))return str.slice(0,-1);return str}function generateEntityEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName),singularName=toUpperSnakeCase(singularize(tableName));switch(method){case"GET":return`GET_${upperName}`;case"POST":return`ADD_${singularName}`;case"PUT":return`UPDATE_${singularName}`;case"PATCH":return`PATCH_${singularName}`;case"DELETE":return`DELETE_${singularName}`}}function generateBulkEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName);switch(method){case"POST":return`BULK_ADD_${upperName}`;case"PUT":return`BULK_UPDATE_${upperName}`;case"DELETE":return`BULK_DELETE_${upperName}`}}function isMethodExcluded(table,method){if(!table.excluded_methods)return!1;let methodMap={GET:"GET",POST:"POST",PUT:"PUT",PATCH:"PATCH",DELETE:"DELETE"};return table.excluded_methods.includes(methodMap[method])}function generateEndpointsFromConfig(config){let endpoints={};for(let table of config.entities){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,sid=table.serviceId;if(!isMethodExcluded(table,"GET")){endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0},endpoints[`GET_${toUpperSnakeCase(tableName)}_DISTINCT`]={method:"GET",path:`${basePath}/distinct/:field`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}if(!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:table.is_public?.POST??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:table.is_public?.PUT??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:table.is_public?.PATCH??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled){if(!isMethodExcluded(table,"POST"))endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:table.is_public?.POST??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:table.is_public?.PUT??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}}return endpoints}function generateAuthEndpoints(config){let endpoints={},auth=config.authentication;if(!auth?.enabled)return endpoints;for(let[featureKey,endpointConfig]of Object.entries(AUTH_ENDPOINT_CONFIGS)){let feature=auth[featureKey];if(!feature?.enabled)continue;let feat=feature,baseRoute=feat.route||endpointConfig.defaultRoute,isPublic=feat.isPublic??endpointConfig.defaultIsPublic;if("subEndpoints"in endpointConfig&&endpointConfig.subEndpoints)for(let sub of endpointConfig.subEndpoints){let subRoute="routeKey"in sub&&sub.routeKey&&feature[sub.routeKey]?String(feature[sub.routeKey]):("defaultRoute"in sub)&&sub.defaultRoute?String(sub.defaultRoute):`${baseRoute}${sub.suffix}`,subIsPublic="isPublic"in sub&&typeof sub.isPublic==="boolean"?sub.isPublic:isPublic;endpoints[sub.key]={method:sub.method,path:subRoute,isPublic:subIsPublic,_payload:sub._payload,_success:sub._success,_error:sub._error}}else if("_payload"in endpointConfig)endpoints[endpointConfig.key]={method:endpointConfig.method,path:baseRoute,isPublic,_payload:endpointConfig._payload,_success:endpointConfig._success,_error:endpointConfig._error}}return endpoints}function generateSystemTableEndpoints(){let endpoints={};for(let table of systemTables){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,isFormData=tableName==="files";endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));if(endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled)endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}}return endpoints}function generateMonitoringEndpoints(config){if(!config.liveMonitoring?.enabled)return{};return{...MONITORING_ENDPOINTS}}function generateAdminEndpoints(config){let endpoints={};if(!config.authentication?.enabled)return endpoints;return endpoints.ADMIN_IMPERSONATE={method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_IMPERSONATE_STOP={method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CHANGE_USER_ID={method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CREATE_USER={method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_HARD_DELETE_USER={method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_LOCK_USER={method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_UNLOCK_USER={method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_MARK_EMAIL_VERIFIED={method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generateCohortEndpoints(config){let auth=config.authentication;if(!auth?.enabled||!auth.cohorts?.enabled)return{};return{...COHORT_ENDPOINTS}}function generateVerificationEndpoints(config){let endpoints={},verification=config.verification;if(!verification?.enabled)return endpoints;let basePath=verification.endpoints?.basePath||"/verifications",flowBasePath=verification.flowEndpoints?.basePath||"/verification-flows";if(endpoints.VERIFICATION_STATUS={method:"GET",path:`${basePath}/status/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_DECIDE={method:"POST",path:`${basePath}/:entity_name/:entity_id/decide`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_CANCEL={method:"POST",path:`${basePath}/:entity_name/:entity_id/cancel`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_PENDING={method:"GET",path:`${basePath}/pending`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_HISTORY={method:"GET",path:`${basePath}/history/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START={method:"POST",path:`${basePath}/start`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START_FOR_ENTITY={method:"POST",path:`${basePath}/start-for-entity`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_ENTITY_STATUSES={method:"GET",path:`${basePath}/statuses/:entity_name`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},verification.flowEndpoints?.enabled!==!1)endpoints.FLOW_LIST={method:"GET",path:flowBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_GET={method:"GET",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_SAVE={method:"POST",path:flowBasePath,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_FEASIBILITY={method:"POST",path:`${flowBasePath}/feasibility`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_PUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/publish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_UNPUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/unpublish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_DELETE={method:"DELETE",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};return endpoints}function generateNotificationEndpoints(config){let endpoints={},notification=config.notification;if(!notification?.enabled||notification.endpoints?.enabled===!1)return endpoints;let notifBasePath=notification.endpoints?.basePath||"/notifications";return endpoints.NOTIFICATION_LIST={method:"GET",path:notifBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_UNSEEN_COUNT={method:"GET",path:`${notifBasePath}/unseen-count`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_SEEN={method:"POST",path:`${notifBasePath}/:notification_id/seen`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_ALL_SEEN={method:"POST",path:`${notifBasePath}/seen-all`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generatePaymentEndpoints(config){if(!config.payment?.enabled)return{};return{...PAYMENT_ENDPOINTS}}function generateConfigEndpoints(config){if(!config.configManagement?.enabled)return{};return{...CONFIG_ENDPOINTS}}function generateTenantEndpoints(config){if(!config.database?.isMultiTenant)return{};return{...TENANT_ENDPOINTS}}function generateChatEndpoints(config){if(!config.chat?.enabled)return{};return{...CHAT_ENDPOINTS}}function generateDomainEndpoints(config){if(!config.domains?.enabled)return{};return{...DOMAIN_ENDPOINTS}}function generateMarketplaceEndpoints(config){let payment=config.payment;if(!payment?.enabled||!payment.marketplace?.enabled)return{};return{...MARKETPLACE_ENDPOINTS}}function generateAllEndpoints(config,extraEndpoints){let entityEndpoints=generateEndpointsFromConfig(config),authEndpoints=generateAuthEndpoints(config),adminEndpoints=generateAdminEndpoints(config),cohortEndpoints=generateCohortEndpoints(config),systemEndpoints=generateSystemTableEndpoints(),monitoringEndpoints=generateMonitoringEndpoints(config),verificationEndpoints=generateVerificationEndpoints(config),chatEndpoints=generateChatEndpoints(config),tenantEndpoints=generateTenantEndpoints(config),domainEndpoints=generateDomainEndpoints(config),marketplaceEndpoints=generateMarketplaceEndpoints(config),notificationEndpoints=generateNotificationEndpoints(config),paymentEndpoints=generatePaymentEndpoints(config),configEndpoints=generateConfigEndpoints(config);return{...entityEndpoints,...authEndpoints,...adminEndpoints,...cohortEndpoints,...systemEndpoints,...monitoringEndpoints,...verificationEndpoints,...chatEndpoints,...tenantEndpoints,...domainEndpoints,...marketplaceEndpoints,...notificationEndpoints,...paymentEndpoints,...configEndpoints,...extraEndpoints??{}}}init_Logger();var DEFAULT_CONFIG2={timeout:30000,retries:0,retryDelay:1000,debug:!1};class ServerFetch{config;logger;constructor(config={}){this.config={...DEFAULT_CONFIG2,...config},this.logger=new Logger({service:"ServerFetch",prettyPrint:this.config.debug,colorize:this.config.debug,auditEnabled:!1})}buildUrl(url){if(url.startsWith("http://")||url.startsWith("https://"))return url;return this.config.baseUrl?`${this.config.baseUrl}${url}`:url}buildHeaders(customHeaders){let headers=new Headers;if(this.config.defaultHeaders)for(let[key,value]of Object.entries(this.config.defaultHeaders))headers.set(key,value);if(customHeaders)if(customHeaders instanceof Headers)customHeaders.forEach((value,key)=>{headers.set(key,value)});else if(Array.isArray(customHeaders))for(let[key,value]of customHeaders)headers.set(key,value);else for(let[key,value]of Object.entries(customHeaders))headers.set(key,value);return headers}parseResponseHeaders(headers){let result={};if(headers.forEach((value,key)=>{if(key.toLowerCase()==="set-cookie"){let existing=result[key];result[key]=existing?`${existing}, ${value}`:value}else result[key]=value}),typeof headers.getSetCookie==="function"){let setCookies=headers.getSetCookie();if(setCookies.length>0)result["set-cookie"]=setCookies.join(", ")}return result}async executeWithTimeout(promise,timeoutMs,_requestId){let controller=new AbortController,timeoutId=setTimeout(()=>controller.abort(),timeoutMs);try{return await Promise.race([promise,new Promise((_,reject)=>{controller.signal.addEventListener("abort",()=>{reject(Error(`Request timeout after ${timeoutMs}ms`))})})])}finally{clearTimeout(timeoutId)}}async fetch(options){let requestId=randomId(),startTime=performance.now(),url=this.buildUrl(options.url),headers=this.buildHeaders(options.headers),timeout=options.timeout??this.config.timeout??30000,retries=options.retries??this.config.retries??0,retryDelay=options.retryDelay??this.config.retryDelay??1000,body;if(options.body)if(typeof options.body==="object"&&!(options.body instanceof FormData)&&!(options.body instanceof URLSearchParams)&&!(options.body instanceof Blob)&&!(options.body instanceof ArrayBuffer)){if(body=JSON.stringify(options.body),!headers.has("content-type"))headers.set("content-type","application/json")}else body=options.body;this.logger.debug(`[${requestId}] ${options.method} ${url}`,{method:options.method,url,hasBody:!!body});let lastError=null,attempt=0;while(attempt<=retries)try{let response=await this.executeWithTimeout(fetch(url,{method:options.method,headers,body}),timeout,requestId),durationMs2=performance.now()-startTime,responseHeaders=this.parseResponseHeaders(response.headers),rawSetCookies=typeof response.headers.getSetCookie==="function"?response.headers.getSetCookie():[],responseData,errorData,rawText=await response.text();if(rawText)try{let json=JSON.parse(rawText);if(response.ok)responseData=json;else errorData=json}catch{if(!response.ok)errorData={message:rawText||response.statusText}}else if(!response.ok)errorData={message:response.statusText};let result={isSuccess:response.ok,response:responseData,errors:errorData,code:response.status,headers:responseHeaders,rawSetCookies,durationMs:durationMs2,requestId,createdAt:new Date};if(response.ok)this.logger.info(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2)});else this.logger.warn(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2),error:errorData});return result}catch(error){if(lastError=error instanceof Error?error:Error(String(error)),attempt++,attempt<=retries)this.logger.warn(`[${requestId}] Retry ${attempt}/${retries} after error`,{method:options.method,url,error:lastError.message,attempt,retries}),await new Promise((resolve)=>setTimeout(resolve,retryDelay))}let durationMs=performance.now()-startTime;return this.logger.error(`[${requestId}] ${options.method} ${url} failed`,lastError,{method:options.method,url,durationMs:Math.round(durationMs),attempts:attempt}),{isSuccess:!1,response:void 0,errors:{message:lastError?.message||"Unknown error"},code:null,headers:{},rawSetCookies:[],durationMs,requestId,createdAt:new Date}}async get(url,options){return this.fetch({...options,url,method:"GET"})}async post(url,body,options){return this.fetch({...options,url,method:"POST",body})}async put(url,body,options){return this.fetch({...options,url,method:"PUT",body})}async patch(url,body,options){return this.fetch({...options,url,method:"PATCH",body})}async delete(url,options){return this.fetch({...options,url,method:"DELETE"})}}var serverFetch=new ServerFetch;var RESPONSE_CONTROL_FLAGS=["requiresCaptcha","requiresApproval","attemptsRemaining","requestId","code","detail"];function serverRequestId(response){let fromBody=(value)=>{if(!value||typeof value!=="object")return;let id=value.requestId;return typeof id==="string"&&id.length>0?id:void 0};return fromBody(response.errors)??fromBody(response.response)??response.headers?.["x-request-id"]??void 0}function normalizeResponseShape(response){if(!response||typeof response!=="object"||Array.isArray(response))return response;let raw=response;if(!("success"in raw)||"data"in raw)return response;let{success,isSuccess,message,error,...rest}=raw,controlFlags={};for(let flag of RESPONSE_CONTROL_FLAGS)if(flag in rest)controlFlags[flag]=rest[flag],delete rest[flag];return{success,...isSuccess!==void 0?{isSuccess}:{},...message!==void 0?{message}:{},...error!==void 0?{error}:{},...controlFlags,...Object.keys(rest).length>0?{data:rest}:{}}}var DEFAULT_TOKEN_NAMES={accessToken:"access_token",refreshToken:"refresh_token",sessionToken:"session_token"};function splitSetCookieHeader(header){let cookies=[],current="";for(let i=0;i<header.length;i++){let char=header[i];if(char===","){let next=header.slice(i+1).trimStart();if(/^[a-zA-Z0-9_-]+=/.test(next)){cookies.push(current.trim()),current="";continue}}current+=char}if(current.trim())cookies.push(current.trim());return cookies}function buildRequestHeaders(headersStore,tokenNames){let headers={},forwardHeaders=["x-forwarded-for","x-real-ip","user-agent","accept-language","x-request-id","x-client-ip","cf-connecting-ip","true-client-ip","x-tenant-id","x-app-origin"];for(let header of forwardHeaders){let value=headersStore.get(header);if(value)headers[header]=value}if(!headers["user-agent"])headers["user-agent"]="Nucleus-ServerAction/1.0";let accessToken=headersStore.get(`x-${tokenNames.accessToken}`),refreshToken=headersStore.get(`x-${tokenNames.refreshToken}`),sessionToken=headersStore.get(`x-${tokenNames.sessionToken}`);if(accessToken)headers[`x-${tokenNames.accessToken}`]=accessToken;if(refreshToken)headers[`x-${tokenNames.refreshToken}`]=refreshToken;if(sessionToken)headers[`x-${tokenNames.sessionToken}`]=sessionToken;let cookieHeader=headersStore.get("cookie");if(cookieHeader)headers.cookie=cookieHeader;return headers}function toCamelCase(str){return str.replace(/_([a-z])/g,(_,c)=>c.toUpperCase())}function convertKeysToCamelCase(obj){let result={};for(let[key,value]of Object.entries(obj)){let camelKey=key.startsWith("_")?key:toCamelCase(key);if(value instanceof Date)result[camelKey]=value.toISOString();else if(value&&typeof value==="object"&&!Array.isArray(value))result[camelKey]=convertKeysToCamelCase(value);else result[camelKey]=value}return result}var JSON_STRINGIFY_KEYS=new Set(["filters","sort","with","searchFields","select","distinctOn"]);function appendQueryParams(url,params){let searchParams=new URLSearchParams;for(let[key,value]of Object.entries(params)){if(value===void 0||value===null)continue;if(JSON_STRINGIFY_KEYS.has(key)&&typeof value==="object"){searchParams.append(key,JSON.stringify(value));continue}if(value instanceof Date)searchParams.append(key,value.toISOString());else if(Array.isArray(value))searchParams.append(key,value.filter((v)=>v!=null).map(String).join(","));else if(typeof value==="object")searchParams.append(key,JSON.stringify(value));else searchParams.append(key,String(value))}let queryString=searchParams.toString();if(!queryString)return url;return url.includes("?")?`${url}&${queryString}`:`${url}?${queryString}`}var DEFAULT_REFRESH_EXCLUDED=["/auth/login","/auth/logout","/auth/register","/auth/refresh"];function mergeCookieHeader(existing,setCookies){let jar=new Map;for(let part of(existing??"").split(";")){let eq=part.indexOf("=");if(eq<=0)continue;jar.set(part.slice(0,eq).trim(),part.slice(eq+1).trim())}for(let raw of setCookies){let[pair]=raw.split(";");if(!pair)continue;let eq=pair.indexOf("=");if(eq<=0)continue;let name=pair.slice(0,eq).trim(),value=pair.slice(eq+1).trim();if(value===""||/max-age\s*=\s*0(?!\d)/i.test(raw))jar.delete(name);else jar.set(name,value)}return Array.from(jar,([k,v])=>`${k}=${v}`).join("; ")}function setCookiesOf(response){if(response.rawSetCookies.length>0)return response.rawSetCookies;let joined=response.headers["set-cookie"];return joined?splitSetCookieHeader(joined):[]}function createServerFactory(endpoints,config,getCookies,getHeaders){let tokenNames={...DEFAULT_TOKEN_NAMES,...config.tokenNames},serverFetch2=new ServerFetch({baseUrl:config.baseUrl,debug:config.debug,timeout:30000,retries:0});return async function(endpointKey,payload){let endpoint=endpoints[endpointKey];if(!endpoint)return{isSuccess:!1,errors:{message:`Endpoint "${endpointKey}" not found`},code:404};let cookieStore=await getCookies(),headersStore=await getHeaders(),allHeaders={};if(headersStore.forEach((value,key)=>{allHeaders[key]=value}),(endpoint.path.includes("/auth/login")||endpoint.path.includes("/auth/oauth"))&&endpoint.method==="POST")try{cookieStore.delete(tokenNames.accessToken),cookieStore.delete(tokenNames.refreshToken),cookieStore.delete(tokenNames.sessionToken)}catch(_){}let headers=buildRequestHeaders(headersStore,tokenNames),url=endpoint.path,body,pathParamNames=new Set,pathParamRegex=/:([a-zA-Z_][a-zA-Z0-9_]*)/g,paramMatch=pathParamRegex.exec(url);while(paramMatch!==null){if(paramMatch[1])pathParamNames.add(paramMatch[1]);paramMatch=pathParamRegex.exec(url)}if(payload&&typeof payload==="object"&&!(payload instanceof FormData)){let payloadObj=payload;for(let[key,value]of Object.entries(payloadObj))if(value!=null){if(pathParamNames.has(key))url=url.replace(`:${key}`,String(value));else if(key.startsWith("_")&&pathParamNames.has(key.substring(1)))url=url.replace(`:${key.substring(1)}`,String(value));else if(key==="id"&&pathParamNames.has("id"))url=url.replace(":id",String(value))}}if(endpoint.method==="GET"&&payload&&typeof payload==="object"){let queryPayload={...payload};for(let paramName of pathParamNames)delete queryPayload[paramName],delete queryPayload[`_${paramName}`];url=appendQueryParams(url,queryPayload)}else if(payload!==void 0){if(endpoint.isFormData&&payload instanceof FormData)body=payload;else if(Array.isArray(payload)){if(body=payload.map((item)=>item&&typeof item==="object"?convertKeysToCamelCase(item):item),!headers["content-type"])headers["content-type"]="application/json"}else if(body=endpoint.skipCamelCase?payload:convertKeysToCamelCase(payload),!headers["content-type"])headers["content-type"]="application/json"}let send=(requestHeaders)=>serverFetch2.fetch({url,method:endpoint.method,headers:requestHeaders,body}),response=await send(headers),refreshCfg=config.refresh;if(response.code===401&&refreshCfg?.enabled!==!1&&!(refreshCfg?.excludePaths??DEFAULT_REFRESH_EXCLUDED).some((p)=>endpoint.path.includes(p))){let refreshResponse=await serverFetch2.fetch({url:refreshCfg?.endpoint??"/auth/refresh",method:"POST",headers}),issued=setCookiesOf(refreshResponse);if(refreshResponse.isSuccess&&issued.length>0)applySetCookieHeaders(cookieStore,issued),response=await send({...headers,cookie:mergeCookieHeader(headers.cookie,issued)})}let setCookiesToProcess=response.rawSetCookies.length>0?response.rawSetCookies:response.headers["set-cookie"]?splitSetCookieHeader(response.headers["set-cookie"]):[];if(setCookiesToProcess.length>0)applySetCookieHeaders(cookieStore,setCookiesToProcess);let normalizedResponse=response.response;if(response.isSuccess)normalizedResponse=normalizeResponseShape(normalizedResponse);return{isSuccess:response.isSuccess,data:normalizedResponse,errors:response.errors,code:response.code,requestId:serverRequestId(response),message:response.isSuccess?void 0:response.errors?.message}}}function applySetCookieHeaders(cookieStore,setCookies){try{for(let cookie of setCookies){let[nameValue,...options]=cookie.split(";");if(!nameValue)continue;let eqIdx=nameValue.indexOf("=");if(eqIdx===-1)continue;let name=nameValue.substring(0,eqIdx).trim(),value=nameValue.substring(eqIdx+1).trim();if(!name)continue;let cookieOptions={},maxAge;for(let opt of options){let trimmed=opt.trim(),optEqIdx=trimmed.indexOf("="),optName=optEqIdx===-1?trimmed:trimmed.substring(0,optEqIdx),optValue=optEqIdx===-1?void 0:trimmed.substring(optEqIdx+1);if(!optName)continue;let optNameLower=optName.toLowerCase();if(optNameLower==="path")cookieOptions.path=optValue;else if(optNameLower==="domain")cookieOptions.domain=optValue;else if(optNameLower==="max-age")maxAge=Number(optValue),cookieOptions.maxAge=maxAge;else if(optNameLower==="expires"&&optValue)cookieOptions.expires=new Date(optValue);else if(optNameLower==="httponly")cookieOptions.httpOnly=!0;else if(optNameLower==="secure")cookieOptions.secure=!0;else if(optNameLower==="samesite")cookieOptions.sameSite=optValue}if(value===""||maxAge!==void 0&&maxAge<=0)cookieStore.delete(name);else cookieStore.set(name,value,cookieOptions)}}catch(cookieError){console.warn("[ServerFactory] Failed to process Set-Cookie headers:",cookieError instanceof Error?cookieError.message:String(cookieError))}}var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];import{batch as batch2,createStore as createStore2}from"h-state";var initialState={connection:{status:"disconnected",clientId:null,subscribedTopics:[],error:null,reconnectAttempt:0},events:[],maxEvents:100},{useStore:usePubSubStore}=createStore2(initialState,{setConnectionStatus:(store)=>(status)=>{store.connection.status=status},setClientId:(store)=>(clientId)=>{store.connection.clientId=clientId},setSubscribedTopics:(store)=>(topics)=>{store.connection.subscribedTopics=topics},setError:(store)=>(error)=>{store.connection.error=error},setReconnectAttempt:(store)=>(attempt)=>{store.connection.reconnectAttempt=attempt},addEvent:(store)=>(event)=>{let updated=[event,...store.events];store.events=updated.slice(0,store.maxEvents)},clearEvents:(store)=>()=>{store.events=[]},reset:(store)=>()=>{batch2(()=>{store.connection.status="disconnected",store.connection.clientId=null,store.connection.subscribedTopics=[],store.connection.error=null,store.connection.reconnectAttempt=0,store.events=[]})}});import{useEffect}from"react";var SYNTHESIZED_AUTH_HEADER="x-nucleus-auth-synthesized";function sessionEndedByProxy(response){return response.status===401&&response.headers.get("x-nucleus-auth-synthesized")==="session-ended"}var WINDOW_EVENTS=["online","focus","pageshow"];function armReturnListeners(env,onReturn){let fired=!1,timer=null,setTimer=env.setTimeout??((fn,ms)=>{let handle=setTimeout(fn,ms);return handle.unref?.(),handle}),clearTimer=env.clearTimeout??((h)=>clearTimeout(h)),disarm=()=>{for(let type of WINDOW_EVENTS)env.window.removeEventListener(type,check);if(env.document.removeEventListener("visibilitychange",check),timer!==null)clearTimer(timer),timer=null};function fire(){if(fired)return;fired=!0,disarm(),onReturn()}function check(){if(fired)return;if(env.document.visibilityState==="hidden")return;if(env.navigator?.onLine===!1)return;fire()}for(let type of WINDOW_EVENTS)env.window.addEventListener(type,check);return env.document.addEventListener("visibilitychange",check),timer=setTimer(fire,120000),()=>{fired=!0,disarm()}}function buildWsUrl(config){let path=config.wsPath||"/api/events/subscribe",topics=(config.topics||["*"]).join(","),query=`?userId=${encodeURIComponent(config.userId)}&topics=${encodeURIComponent(topics)}`;if(config.wsUrl)return`${config.wsUrl.replace(/\/$/,"")}${path}${query}`;if(typeof window>"u")return"";return`${window.location.protocol==="https:"?"wss:":"ws:"}//${window.location.host}${path}${query}`}var connections=new Map,eventIdCounter=0;function log(conn,...args){if(conn.options.debug)console.log("[usePubSub]",...args)}function clearTimers(conn){if(conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout),conn.reconnectTimeout=null;if(conn.stopWaitingForReturn)conn.stopWaitingForReturn(),conn.stopWaitingForReturn=null}function detachSocket(conn){let ws=conn.ws;if(!ws)return;if(ws.onopen=null,ws.onmessage=null,ws.onerror=null,ws.onclose=null,ws.readyState===WebSocket.OPEN||ws.readyState===WebSocket.CONNECTING)ws.close();conn.ws=null}function startHeartbeat(conn){if(conn.heartbeat)clearInterval(conn.heartbeat);conn.heartbeat=setInterval(()=>{if(conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ping"}))},conn.options.heartbeatInterval)}var HANDSHAKE_FAILURE_LIMIT=3;async function confirmSessionThenDecide(conn){let path=conn.options.sessionProbePath;if(!path){log(conn,"Handshake failing; no probe configured, continuing to reconnect"),conn.handshakeFailures=0,scheduleReconnect(conn);return}try{let res=await fetch(path,{credentials:"include",method:"GET"});if(res.status===401||res.status===403)if(res.headers.get(SYNTHESIZED_AUTH_HEADER)&&!sessionEndedByProxy(res))log(conn,"Probe 401 came from the proxy, not the API; treating as a network problem");else{conn.dispatch.setConnectionStatus("unauthorized"),conn.dispatch.setError(Error("Session is no longer valid")),log(conn,`Session probe says ${res.status}; not retrying`),waitForReturn(conn);return}else log(conn,`Session probe says ${res.status}; the session is fine, retrying`)}catch{log(conn,"Session probe could not be made; treating as a network problem")}conn.handshakeFailures=0,scheduleReconnect(conn)}function waitForReturn(conn){if(typeof window>"u"||typeof document>"u")return;if(connections.get(conn.url)!==conn)return;if(conn.stopWaitingForReturn)return;conn.stopWaitingForReturn=armReturnListeners({window,document,navigator:typeof navigator>"u"?void 0:navigator},()=>{if(connections.get(conn.url)!==conn)return;conn.stopWaitingForReturn=null,conn.reconnectAttempt=0,conn.handshakeFailures=0,log(conn,"Network or tab came back; reconnecting"),openSocket(conn)})}function scheduleReconnect(conn){if(!conn.options.autoReconnect)return;if(connections.get(conn.url)!==conn)return;if(conn.reconnectAttempt>=conn.options.maxReconnectAttempts){conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setError(Error("Max reconnection attempts reached")),log(conn,"Max reconnect attempts reached; waiting for network or tab to return"),waitForReturn(conn);return}let delay=Math.min(conn.options.reconnectBaseDelay*2**conn.reconnectAttempt,conn.options.reconnectMaxDelay);if(conn.reconnectAttempt+=1,conn.dispatch.setConnectionStatus("reconnecting"),conn.dispatch.setReconnectAttempt(conn.reconnectAttempt),log(conn,`Reconnecting in ${delay}ms (attempt ${conn.reconnectAttempt})`),conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout);conn.reconnectTimeout=setTimeout(()=>{if(connections.get(conn.url)===conn)openSocket(conn)},delay)}function handleMessage(conn,raw){let message;try{message=JSON.parse(raw)}catch{log(conn,"Failed to parse message");return}switch(message.type){case"connected":conn.reconnectAttempt=0,conn.handshakeFailures=0,conn.dispatch.setConnectionStatus("connected"),conn.dispatch.setClientId(message.clientId),conn.dispatch.setSubscribedTopics(message.subscribedTopics),conn.dispatch.setReconnectAttempt(0),conn.dispatch.setError(null),log(conn,"Connected, clientId:",message.clientId);break;case"subscribed":conn.dispatch.setSubscribedTopics(message.topics),log(conn,"Subscribed to:",message.topics);break;case"event":{if(conn.dispatch.addEvent({id:`evt_${Date.now()}_${eventIdCounter++}`,topic:message.topic,data:message.data,timestamp:message.timestamp,receivedAt:Date.now(),messageId:message.messageId,isRedelivery:message.isRedelivery}),message.messageId&&conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ack",messageId:message.messageId}));break}case"pong":break;case"error":conn.dispatch.setError(Error(message.error)),log(conn,"Server error:",message.error);break}}function openSocket(conn){if(conn.ws?.readyState===WebSocket.OPEN||conn.ws?.readyState===WebSocket.CONNECTING)return;detachSocket(conn),conn.dispatch.setConnectionStatus("connecting"),conn.dispatch.setError(null),log(conn,"Connecting to:",conn.url);let ws=new WebSocket(conn.url);conn.ws=ws;let opened=!1;ws.onopen=()=>{log(conn,"WebSocket opened"),opened=!0,startHeartbeat(conn)},ws.onmessage=(event)=>handleMessage(conn,event.data),ws.onerror=()=>{log(conn,"WebSocket error"),conn.dispatch.setError(Error("WebSocket connection error"))},ws.onclose=(event)=>{if(log(conn,"WebSocket closed",event.code,event.reason),conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null),connections.get(conn.url)!==conn)return;if(event.code===4001){log(conn,"Handshake bearer refused (4001); asking whether the session is still valid"),confirmSessionThenDecide(conn);return}if(!opened){if(conn.handshakeFailures+=1,conn.handshakeFailures>=HANDSHAKE_FAILURE_LIMIT){confirmSessionThenDecide(conn);return}}else conn.handshakeFailures=0;scheduleReconnect(conn)}}function acquire(url,dispatch,options){let conn=connections.get(url);if(!conn)conn={url,ws:null,refCount:0,reconnectAttempt:0,handshakeFailures:0,stopWaitingForReturn:null,heartbeat:null,reconnectTimeout:null,dispatch,options},connections.set(url,conn);else conn.dispatch=dispatch,conn.options=options;conn.refCount+=1,openSocket(conn)}function release(url){let conn=connections.get(url);if(!conn)return;if(conn.refCount-=1,conn.refCount>0)return;connections.delete(url),clearTimers(conn),detachSocket(conn),conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null)}function send(url,payload){let ws=connections.get(url)?.ws;if(ws?.readyState===WebSocket.OPEN)ws.send(JSON.stringify(payload))}function usePubSub(config){let store=usePubSubStore(),url=config.userId?buildWsUrl(config):"";return useEffect(()=>{if(!url)return;let dispatch={setConnectionStatus:store.setConnectionStatus,setClientId:store.setClientId,setSubscribedTopics:store.setSubscribedTopics,setError:store.setError,setReconnectAttempt:store.setReconnectAttempt,addEvent:store.addEvent},options={autoReconnect:config.autoReconnect??!0,maxReconnectAttempts:config.maxReconnectAttempts??10,sessionProbePath:config.sessionProbePath??"/auth/me",reconnectBaseDelay:config.reconnectBaseDelay??1000,reconnectMaxDelay:config.reconnectMaxDelay??30000,heartbeatInterval:config.heartbeatInterval??30000,debug:config.debug??!1};return acquire(url,dispatch,options),()=>release(url)},[url]),{isConnected:store.connection.status==="connected",isConnecting:store.connection.status==="connecting"||store.connection.status==="reconnecting",sessionExpired:store.connection.status==="unauthorized",clientId:store.connection.clientId,subscribedTopics:store.connection.subscribedTopics,events:store.events,error:store.connection.error,reconnectAttempt:store.connection.reconnectAttempt,connect:()=>{let conn=connections.get(url);if(conn)openSocket(conn)},disconnect:()=>release(url),subscribe:(topics)=>send(url,{type:"subscribe",topics}),unsubscribe:(topics)=>send(url,{type:"unsubscribe",topics}),clearEvents:store.clearEvents,getEventsByTopic:(topic)=>store.events.filter((e)=>e.topic===topic)}}function createRateWindow(windowMs=5000){let samples=[];return{push(at,bytes){let last=samples[samples.length-1];if(last&&at<=last.at){last.bytes=Math.max(last.bytes,bytes);return}samples.push({at,bytes});let cutoff=at-windowMs;while(samples.length>2&&samples[0].at<cutoff)samples.shift()},ratePerSecond(){if(samples.length<2)return null;let first=samples[0],last=samples[samples.length-1],spanMs=last.at-first.at;if(spanMs<700)return null;let delta=last.bytes-first.bytes;if(delta<=0)return null;return delta*1000/spanMs},reset(){samples.length=0}}}function uploadFraction(sentBytes,totalBytes){if(totalBytes===null||totalBytes<=0)return null;return Math.min(1,Math.max(0,sentBytes/totalBytes))}function uploadPercent(sentBytes,totalBytes){let fraction=uploadFraction(sentBytes,totalBytes);if(fraction===null)return null;if(fraction>=1)return 100;return Math.min(99,Math.floor(fraction*100))}function secondsRemaining(sentBytes,totalBytes,bytesPerSecond){if(totalBytes===null||totalBytes<=0)return null;let left=totalBytes-sentBytes;if(left<=0)return 0;if(bytesPerSecond===null||bytesPerSecond<=0)return null;return left/bytesPerSecond}function buildProgress(params){let{sentBytes,totalBytes,startedAt,now,window:window2,retrying=!1}=params;window2.push(now,sentBytes);let bytesPerSecond=window2.ratePerSecond();return{sentBytes,totalBytes,fraction:uploadFraction(sentBytes,totalBytes),percent:uploadPercent(sentBytes,totalBytes),bytesPerSecond,secondsRemaining:secondsRemaining(sentBytes,totalBytes,bytesPerSecond),elapsedMs:Math.max(0,now-startedAt),retrying}}var MIN_REPORT_INTERVAL_MS=120;function uploadWithProgress(body,options){let xhr=options.createRequest?options.createRequest():new XMLHttpRequest,window2=createRateWindow(),startedAt=Date.now(),lastReportAt=0,settled=!1,lastSent=0,lastTotal=null,report=(sentBytes,totalBytes,force)=>{if(!options.onProgress)return;let now=Date.now();if(!force&&now-lastReportAt<MIN_REPORT_INTERVAL_MS)return;lastReportAt=now,options.onProgress(buildProgress({sentBytes,totalBytes,startedAt,now,window:window2}))};return{done:new Promise((resolve)=>{let settle=(outcome)=>{if(settled)return;settled=!0,resolve(outcome)};xhr.open("POST",options.url,!0),xhr.withCredentials=options.withCredentials!==!1;for(let[key,value]of Object.entries(options.headers??{}))xhr.setRequestHeader(key,value);if(options.timeoutMs)xhr.timeout=options.timeoutMs;xhr.upload.onprogress=(event)=>{lastSent=event.loaded,lastTotal=event.lengthComputable?event.total:null,report(lastSent,lastTotal,!1)},xhr.upload.onload=()=>{report(lastTotal??lastSent,lastTotal,!0)},xhr.onload=()=>{let parsed=null;try{parsed=xhr.responseText?JSON.parse(xhr.responseText):null}catch{parsed=null}if(xhr.status<200||xhr.status>=300){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||xhr.statusText||"",cancelled:!1});return}let data=options.parse?options.parse(parsed):parsed;if(data===null||data===void 0){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||"The server accepted the upload but returned nothing usable",cancelled:!1});return}settle({ok:!0,data})},xhr.onerror=()=>{settle({ok:!1,status:null,message:"The upload could not reach the server",cancelled:!1})},xhr.ontimeout=()=>{settle({ok:!1,status:null,message:"The upload timed out",cancelled:!1})},xhr.onabort=()=>{settle({ok:!1,status:null,message:"",cancelled:!0})},xhr.send(body)}),abort:()=>{xhr.abort()}}}function serverMessage(parsed){if(!parsed||typeof parsed!=="object")return"";let body=parsed;for(let key of["message","error","detail"]){let value=body[key];if(typeof value==="string"&&value)return value}return""}import{useCallback,useRef,useState}from"react";function useUpload(options){let[progress,setProgress]=useState(null),[uploading,setUploading]=useState(!1),[outcome,setOutcome]=useState(null),handleRef=useRef(null),optionsRef=useRef(options);optionsRef.current=options;let runId=useRef(0),cancel=useCallback(()=>{handleRef.current?.abort(),handleRef.current=null},[]),reset=useCallback(()=>{setProgress(null),setOutcome(null)},[]),start=useCallback(async(body,overrides)=>{handleRef.current?.abort();let id=++runId.current;setUploading(!0),setOutcome(null),setProgress(null);let merged={...optionsRef.current,...overrides},handle=uploadWithProgress(body,{...merged,onProgress:(p)=>{if(id!==runId.current)return;setProgress(p),merged.onProgress?.(p)}});handleRef.current=handle;let result=await handle.done;if(id!==runId.current)return result;return handleRef.current=null,setUploading(!1),setOutcome(result),result},[]);return{progress,uploading,outcome,start,cancel,reset}}import{createHash as createHash8,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and35,desc as desc7,eq as eq75,lt as lt3,ne as ne7,sql as sql15}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_activeGrants();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();init_redactSecrets();var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column:column2}of ownership){let columns=required.get(table)??new Set;columns.add(column2),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column2 of columns){let entry=perTable.get(column2)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column2)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column2,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column2,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column:column2,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and13,eq as eq17,inArray as inArray4,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq17(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and13(inArray4(getCol(participants,"conversationId"),conversationIds),eq17(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and15,desc as desc3,eq as eq19,inArray as inArray6}from"drizzle-orm";import{and as and14,eq as eq18,inArray as inArray5}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and14(eq18(getCol(tables.participants,"conversationId"),conversationId),eq18(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray5(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq19(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq19(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and15(inArray6(getCol(tables.conversations,"id"),conversationIds),eq19(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray6(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq19(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq19(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and16,desc as desc4,eq as eq20,inArray as inArray7,isNull as isNull3,lt,ne as ne2,sql as sql7}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null,size=fileRow.size??input.size??null,allowedTypes=ctx.config.attachments?.allowedMimeTypes??[];if(allowedTypes.length>0&&(!mimeType||!allowedTypes.includes(mimeType)))throw new ChatError("validation",`Attachment file ${input.fileId} is a ${mimeType??"unknown"} file, which this conversation does not accept`);let maxBytes=ctx.config.attachments?.maxFileSizeBytes??null;if(maxBytes!=null&&size!=null&&size>maxBytes)throw new ChatError("validation",`Attachment file ${input.fileId} is ${size} bytes, over the ${maxBytes} byte limit for attachments`);return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq20(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq20(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql7`${getCol(tables.participants,"unreadCount")} + 1`}).where(and16(eq20(getCol(tables.participants,"conversationId"),params.conversationId),ne2(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq20(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and16(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and16(eq20(getCol(tables.messages,"id"),targetMessageId),eq20(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq20(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq20(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq20(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray7(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}import{and as and17,eq as eq21,isNotNull}from"drizzle-orm";async function isVerificationSignatureFile(args){let{db,schemaTables,fileId}=args,verifications=resolveSchemaTable(schemaTables,"verifications");if(!verifications)return!1;let signatureId=verifications.signatureId;if(!signatureId)return!1;return(await db.select().from(verifications).where(and17(isNotNull(signatureId),eq21(signatureId,fileId))).limit(1)).length>0}init_SystemCollector();init_lifecycle();init_Notification();init_profileSync();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column2){return column2.default!==void 0||column2.defaultRaw!==void 0||column2.generatedAlwaysAs!==void 0||column2.generatedAlwaysAsIdentity===!0||column2.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables2,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables2){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column2 of config.columns??[]){if(builtInNames.has(column2.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column2.notNull===!0&&column2.nullable!==!0&&!hasDbDefault(column2))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function unhonouredIsPublicDeclarations(config){let auth=config.authentication;if(!auth)return[];let notes=[],alwaysPublic=[["authentication.sessions",auth.sessions],["authentication.passwordSet",auth.passwordSet],["authentication.webauthn",auth.webauthn],["authentication.invite",auth.invite],["authentication.register.emailVerification",auth.register?.emailVerification]];for(let[name2,feature]of alwaysPublic)if(feature?.enabled&&feature.isPublic===!1)notes.push(`${name2}.isPublic is false but these routes stay public: the flow is reached without a session`);if(auth.me?.isPublic===!0)notes.push("authentication.me.isPublic is true but /auth/me is never published as public");let sessionToken=auth.sessionToken;if(sessionToken){let named=["secret","algorithm","issuer","audience"].filter((k)=>sessionToken[k]!==void 0);if(named.length>0)notes.push(`authentication.sessionToken.${named.join("/")} is set, but the session token is an opaque id looked up in the store rather than a JWT: nothing signs or verifies it`)}return notes}function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables2,basePath,schema){return buildEntityPublicRoutes(systemTables2,basePath,schema)}function buildPublicRoutes(config,systemTables2,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables2,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_ApiKey();init_activeGrants();init_GodminSetup();init_Middleware();async function resolveApiKeyPermissions(input){let{db,tables,userId,keyAllowedRoles,keyAllowedClaims,userData,logger:logger2}=input,roles=keyAllowedRoles;if(tables.userRoles&&tables.roles)roles=intersectPermissions(await readActiveRoleNames(db,tables,userId),keyAllowedRoles);let claims=keyAllowedClaims,claimScopes={};if(tables.userRoles&&tables.roleClaims&&tables.claims){let grants=await readActiveClaimGrants(db,tables,userId);claims=intersectPermissions(grantedActions(grants),keyAllowedClaims);let effective=new Set(claims),effectiveGrants=grants.filter((grant)=>effective.has(grant.action));if(effectiveGrants.some((grant)=>!!grant.scope)){let resolved=resolveClaimScopes(effectiveGrants,userData,logger2);if(claimScopes=resolved.claimScopes,resolved.dropped.length>0){let dropped=new Set(resolved.dropped);claims=claims.filter((action)=>!dropped.has(action))}}}roles=roles.filter((role)=>!isGodminRole(role));let narrowedRoles=keyAllowedRoles.length-roles.length,narrowedClaims=keyAllowedClaims.length-claims.length;if(narrowedRoles>0||narrowedClaims>0)logger2.debug("[AUTH] API key narrowed to its owner's active grants",{userId,narrowedRoles,narrowedClaims});return{roles,claims,claimScopes}}init_routeCollector();import{eq as eq24}from"drizzle-orm";init_types3();init_adminGuard();init_requireGodmin();init_passwordPolicy();import{eq as eq23}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId,roleLookup){if(!mayActAsGodmin(roleLookup.request))return!1;let user=(await db.select().from(usersTable).where(eq23(col7(usersTable,"id"),userId)).limit(1))[0];if(!user)return!1;let byColumn=Boolean(user.isGod),{rolesTable,userRolesTable,logger:logger2}=roleLookup,byRole=!byColumn&&(hasGodminRole(roleLookup.request)||(rolesTable&&userRolesTable?await userHasGodminRoleInDb(db,{[AUTHORIZATION_TABLE_KEYS.roles]:rolesTable,[AUTHORIZATION_TABLE_KEYS.userRoles]:userRolesTable},userId,logger2):!1));if(!byColumn&&!byRole)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var handleActivateUsers=(db,usersTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq24(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq26,inArray as inArray8}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2,godmin)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq26(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy,entry.email);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray8(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray8(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq27}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq27(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq28,inArray as inArray11}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray11(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray11(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray11(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq28(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq29}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq29(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq30}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq30(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
+    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql15.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function positive(value2,fallback){return typeof value2==="number"&&Number.isFinite(value2)&&value2>0?value2:fallback}function resolveFetchLimits(options={}){let retries=typeof options.retries==="number"&&Number.isFinite(options.retries)?Math.min(1,Math.max(0,Math.floor(options.retries))):DISCOVERY_FETCH_DEFAULTS.retries,retryDelayMs=typeof options.retryDelayMs==="number"&&Number.isFinite(options.retryDelayMs)&&options.retryDelayMs>=0?options.retryDelayMs:DISCOVERY_FETCH_DEFAULTS.retryDelayMs;return{timeoutMs:positive(options.timeoutMs,DISCOVERY_FETCH_DEFAULTS.timeoutMs),maxBytes:positive(options.maxBytes,DISCOVERY_FETCH_DEFAULTS.maxBytes),retries,retryDelayMs,hookTimeoutMs:positive(options.hookTimeoutMs,DISCOVERY_FETCH_DEFAULTS.hookTimeoutMs)}}function withDeadline2(work,ms,onTimeout,onExpire){return new Promise((resolve2,reject)=>{let timer=setTimeout(()=>{onExpire?.(),reject(onTimeout())},ms);work.then((value2)=>{clearTimeout(timer),resolve2(value2)},(error3)=>{clearTimeout(timer),reject(error3)})})}function discoveryUrl(baseUrl,openapiPath){let joined=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,parsed;try{parsed=new URL(joined)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined}`,!1)}if(parsed.protocol!=="http:"&&parsed.protocol!=="https:")throw new DiscoveryFetchError(`endpointDiscovery: invalid_source ${joined} (only http and https are fetched)`,!1);return joined}async function discard2(response){await response.body?.cancel().catch(()=>{return})}async function readCapped(response,maxBytes,url){let tooLarge=()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI document exceeds ${maxBytes} bytes for ${url}`,!1),advertised=Number(response.headers.get("content-length"));if(Number.isFinite(advertised)&&advertised>maxBytes)throw await discard2(response),tooLarge();let body=response.body;if(!body)return"";let reader=body.getReader(),chunks=[],size=0;while(!0){let part=await reader.read();if(part.done)break;if(size+=part.value.byteLength,size>maxBytes)throw await reader.cancel().catch(()=>{return}),tooLarge();chunks.push(part.value)}return new TextDecoder().decode(Buffer.concat(chunks,size))}async function attempt(url,fetchImpl,limits){let controller=new AbortController,work=(async()=>{let response;try{response=await fetchImpl(url,{headers:{accept:"application/json"},redirect:"manual",signal:controller.signal})}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed for ${url}: ${reason}`,!0)}if(response.type==="opaqueredirect"||REDIRECT_STATUSES.has(response.status))throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch refused a redirect (${response.status}) for ${url}`,!1);if(!response.ok)throw await discard2(response),new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch failed ${response.status} for ${url}`,response.status===429||response.status>=500);let text3;try{text3=await readCapped(response,limits.maxBytes,url)}catch(error3){if(error3 instanceof DiscoveryFetchError)throw error3;let reason=error3 instanceof Error?error3.message:String(error3);throw new DiscoveryFetchError(`endpointDiscovery: OpenAPI body read failed for ${url}: ${reason}`,!0)}try{return JSON.parse(text3)}catch{throw new DiscoveryFetchError(`endpointDiscovery: invalid_document (not JSON) for ${url}`,!1)}})();try{return await withDeadline2(work,limits.timeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: OpenAPI fetch timed out after ${limits.timeoutMs}ms for ${url}`,!0),()=>controller.abort())}finally{controller.abort()}}async function fetchDiscoveryJson(url,fetchImpl,options={}){let limits=resolveFetchLimits(options),lastError;for(let tried=0;tried<=limits.retries;tried++){if(tried>0)await Bun.sleep(limits.retryDelayMs);try{return await attempt(url,fetchImpl,limits)}catch(error3){if(lastError=error3,!(error3 instanceof DiscoveryFetchError&&error3.retryable))throw error3}}throw lastError}var DISCOVERY_FETCH_DEFAULTS,DiscoveryFetchError,REDIRECT_STATUSES;var init_fetch2=__esm(()=>{DISCOVERY_FETCH_DEFAULTS=Object.freeze({timeoutMs:5000,maxBytes:16777216,retries:1,retryDelayMs:250,hookTimeoutMs:60000});DiscoveryFetchError=class DiscoveryFetchError extends Error{retryable;constructor(message,retryable){super(message);this.name="DiscoveryFetchError",this.retryable=retryable}};REDIRECT_STATUSES=new Set([301,302,303,307,308])});function isDiscoveryHooks(value2){return typeof value2==="object"&&value2!==null&&"captureConfig"in value2&&typeof value2.captureConfig==="function"&&"fetchDocument"in value2&&typeof value2.fetchDocument==="function"&&"run"in value2&&typeof value2.run==="function"}function configureAuthorizationDiscovery(hooks){if(!isDiscoveryHooks(hooks))throw TypeError("configureAuthorizationDiscovery: captureConfig, fetchDocument and run must all be functions");return installed.set(hooks),()=>{if(installed.get()===hooks)installed.set(void 0)}}function authorizationDiscoveryHooks(){return installed.get()}function hostDiscoveryConfig(config){let view={};if(config.enabled!==void 0)view.enabled=config.enabled;if(config.runOnBoot!==void 0)view.runOnBoot=config.runOnBoot;if(config.services)view.services=config.services.map((service)=>{let copy2={id:service.id,baseUrl:service.baseUrl};if(service.openapi!==void 0)copy2.openapi=service.openapi;if(service.exclude)copy2.exclude=[...service.exclude];return copy2});return view}function hostRunCeilingMs(serviceCount,hookTimeoutMs){return(Math.max(0,serviceCount)+1)*hookTimeoutMs}function isDiscoveryResult(value2){return typeof value2==="object"&&value2!==null&&"services"in value2&&Array.isArray(value2.services)}function isThenable(value2){return typeof value2==="object"&&value2!==null&&"then"in value2&&typeof value2.then==="function"}function warnCaptureFailed(logger2,error3){logger2.warn("[Discovery] Host captureConfig hook failed",{error:error3 instanceof Error?error3.message:String(error3)})}function captureDiscoveryConfig(config,logger2){let hooks=authorizationDiscoveryHooks();if(!hooks)return;let returned;try{returned=hooks.captureConfig(hostDiscoveryConfig(config))}catch(error3){warnCaptureFailed(logger2,error3);return}if(isThenable(returned))Promise.resolve(returned).then(void 0,(error3)=>warnCaptureFailed(logger2,error3))}var installed;var init_hooks=__esm(()=>{installed=processRegistry("nucleus-core-ts.authorizationDiscovery.hooks.v1",isDiscoveryHooks)});var utf8;var init_routePath=__esm(()=>{utf8=new TextDecoder("utf-8",{ignoreBOM:!0})});var init_routeMatch=__esm(()=>{init_routePath()});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}function isRecord2(value2){return typeof value2==="object"&&value2!==null&&!Array.isArray(value2)}function toOperation(value2){let operation={};if(Array.isArray(value2.tags))operation.tags=value2.tags.filter((tag)=>typeof tag==="string");if(typeof value2.operationId==="string")operation.operationId=value2.operationId;if(typeof value2.summary==="string")operation.summary=value2.summary;if(typeof value2.description==="string")operation.description=value2.description;return operation}function toOpenApiDoc(value2){if(!isRecord2(value2))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (not a JSON object)",!1);if(value2.paths===void 0)return{};if(!isRecord2(value2.paths))throw new DiscoveryFetchError("endpointDiscovery: invalid_document (paths is not an object)",!1);return{paths:Object.fromEntries(Object.entries(value2.paths).flatMap(([path7,item])=>isRecord2(item)?[[path7,operationsOf(item)]]:[]))}}function operationsOf(item){return Object.fromEntries(Object.entries(item).flatMap(([method,operation])=>isRecord2(operation)?[[method,toOperation(operation)]]:[]))}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(hooks){let{hookTimeoutMs}=resolveFetchLimits(options),document2=await withDeadline2(Promise.resolve().then(()=>hooks.fetchDocument(baseUrl,openapiPath,fetchImpl)),hookTimeoutMs,()=>new DiscoveryFetchError(`endpointDiscovery: host fetchDocument hook timed out after ${hookTimeoutMs}ms`,!0));return toOpenApiDoc(document2)}let url=discoveryUrl(baseUrl,openapiPath);return toOpenApiDoc(await fetchDiscoveryJson(url,fetchImpl,options))}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{init_routeMatch();init_fetch2();init_hooks();HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest,EMPTY_CATALOG_ERROR:()=>EMPTY_CATALOG_ERROR});import{eq as eq72,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){if(specs.length===0)throw Error(EMPTY_CATALOG_ERROR);let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq72(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq72(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch,options={}){let hooks=authorizationDiscoveryHooks();if(!hooks)return reconcileServices(db,schemaTables,config,logger2,fetchImpl,options);let services=config.services??[],execute=(serviceIds)=>reconcileServices(db,schemaTables,serviceIds?{...config,services:services.filter((svc)=>serviceIds.includes(svc.id))}:config,logger2,fetchImpl,options),ceilingMs=hostRunCeilingMs(services.length,resolveFetchLimits(options).hookTimeoutMs);logger2.info("[Discovery] Running through the host discovery hooks",{services:services.map((svc)=>svc.id),ceilingMs});let returned=await withDeadline2(Promise.resolve().then(()=>hooks.run(hostDiscoveryConfig(config),execute)),ceilingMs,()=>Error(`endpointDiscovery: host run hook timed out after ${ceilingMs}ms`));if(!isDiscoveryResult(returned))throw Error("endpointDiscovery: host run hook returned no DiscoveryResult");return returned}async function reconcileServices(db,schemaTables,config,logger2,fetchImpl,options){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl,options),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var EMPTY_CATALOG_ERROR="endpointDiscovery: empty_catalog";var init_seed=__esm(()=>{init_fetch2();init_hooks();init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord3(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord3(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord3(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord3(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord3(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});function covers(prefix,claim){return claim===prefix||claim.startsWith(`${prefix}.`)}function dotPrefixes(action,maxLength=action.length){let prefixes=[];for(let dot=action.indexOf(".");dot>=0&&dot<=maxLength;)prefixes.push(action.slice(0,dot)),dot=action.indexOf(".",dot+1);if(action.length<=maxLength)prefixes.push(action);return prefixes}function roleGrants(list2){let grants=new Set(list2.filter((grant)=>grant!=="")),above=new Set;for(let grant of grants){if(grant.endsWith(".*"))continue;for(let prefix of dotPrefixes(grant).slice(0,-1))above.add(prefix)}return{grants,above}}function catalogActions(catalog){return[...new Set(catalog)].filter((action)=>action!==""&&!action.endsWith(".*")).sort()}function family(guard4){if(guard4.valueType!=="int"||typeof guard4.threshold!=="number")return null;if(!Number.isFinite(guard4.threshold))return null;if(guard4.op==="gt"||guard4.op==="gte")return"upper";if(guard4.op==="lt"||guard4.op==="lte")return"lower";return null}function permissiveness(guard4){let threshold=typeof guard4.threshold==="number"?guard4.threshold:0;if(guard4.op==="gt"||guard4.op==="gte")return[threshold,guard4.op==="gt"?1:0];return[-threshold,guard4.op==="lt"?1:0]}function compare2(a,b){return a[0]!==b[0]?a[0]-b[0]:a[1]-b[1]}function keptCover(node,actions,dropped,catalog){let droppedHere=actions.filter((action)=>dropped.has(action)).length;if(droppedHere===0)return[node];if(droppedHere===actions.length)return[];if(catalog.has(node)&&!dropped.has(node))return[node];let children=new Map;for(let action of actions){if(action===node)continue;let rest3=action.slice(node.length+1),dot=rest3.indexOf("."),child=`${node}.${dot>=0?rest3.slice(0,dot):rest3}`,under=children.get(child);if(under)under.push(action);else children.set(child,[action])}return[...children].flatMap(([child,under])=>keptCover(child,under,dropped,catalog))}function decideAction(action,guards,roles,held,longestHeld){let prefixes=dotPrefixes(action,longestHeld),granting=new Set,partial3=new Set;for(let[roleId,role]of roles)if(prefixes.some((prefix)=>role.grants.has(prefix)))granting.add(roleId);else if(role.above.has(action))partial3.add(roleId);let heldPrefix=prefixes.find((prefix)=>held.has(prefix)),onAction=guards.map((guard4,index)=>({guard:guard4,index})).filter(({guard:guard4})=>granting.has(guard4.roleId)&&guard4.invalidates.some((entry)=>covers(entry,action))),guarded=new Set(onAction.map(({guard:guard4})=>guard4.roleId)),unlimited=[...granting].some((roleId)=>!guarded.has(roleId)),winners=new Map;if(unlimited)return{granting,partial:partial3,heldPrefix,unlimited,winners};let strictest=new Map;for(let entry of onAction){let kind=family(entry.guard);if(!kind)continue;let group=`${kind}:${entry.guard.key}`,byRole=strictest.get(group)??new Map;strictest.set(group,byRole);let known=byRole.get(entry.guard.roleId);if(!known||compare2(permissiveness(entry.guard),permissiveness(known.guard))<0)byRole.set(entry.guard.roleId,entry)}for(let[group,byRole]of strictest){let best;for(let candidate of byRole.values()){let order=best?compare2(permissiveness(candidate.guard),permissiveness(best.guard)):1;if(!best||order>0||order===0&&candidate.index<best.index)best=candidate}if(best)winners.set(group,best.guard.roleId)}return{granting,partial:partial3,heldPrefix,unlimited,winners}}function stillLimits(guard4,decision){if(!decision.granting.has(guard4.roleId)){if(!decision.partial.has(guard4.roleId))return!0;return decision.granting.size===0&&decision.heldPrefix!==void 0}if(decision.unlimited)return!1;let kind=family(guard4);if(!kind)return!0;return decision.winners.get(`${kind}:${guard4.key}`)===guard4.roleId}function suppressEntries(invalidates,limited,decide){let suppress=new Set(invalidates);for(let action of limited){let claim=decide(action).heldPrefix;if(claim!==void 0&&!dotPrefixes(claim).some((prefix)=>suppress.has(prefix)))suppress.add(claim)}return[...suppress]}function mostGenerousTargets(input){let{guards}=input,roles=new Map;for(let[roleId,grants]of input.grantsByRole)roles.set(roleId,roleGrants(grants));let held=new Set([...roles.values()].flatMap(({grants})=>[...grants]));for(let claim of input.heldWithoutGrant??[])if(claim!=="")held.add(claim);let heldList=[...held],longestHeld=heldList.reduce((longest,claim)=>Math.max(longest,claim.length),0),reached=(entry)=>heldList.some((claim)=>covers(entry,claim)||covers(claim,entry)),actions=catalogActions(input.catalog),actionSet=new Set(actions),decisions=new Map,decide=(action)=>{let known=decisions.get(action);if(known)return known;let decision=decideAction(action,guards,roles,held,longestHeld);return decisions.set(action,decision),decision};return guards.map((guard4)=>{let invalidates=new Set,limited=new Set;for(let target2 of guard4.invalidates){let under=actions.filter((action)=>covers(target2,action)),targetActions=under.length>0?under:[target2],dropped=new Set(targetActions.filter((action)=>!stillLimits(guard4,decide(action))));for(let entry of keptCover(target2,targetActions,dropped,actionSet))if(entry===target2||reached(entry))invalidates.add(entry);for(let action of targetActions)if(!dropped.has(action)&&actionSet.has(action))limited.add(action)}return{invalidates:[...invalidates],suppress:suppressEntries([...invalidates],[...limited],decide)}})}async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map,grantActionByClaimId=new Map,inactiveActionByClaimId=new Map;for(let c of claimRows){let action=String(c.action??""),policy=parseGuardPolicy(c.policy);if(c.isActive===!1){if(action)inactiveActionByClaimId.set(String(c.id),action)}else if(policy)guardByClaimId.set(String(c.id),{action,policy});else if(action)grantActionByClaimId.set(String(c.id),action)}if(guardByClaimId.size===0)return EMPTY;let mine=(await db.select().from(userRolesTable)).filter((r)=>String(r.userId??r.user_id)===userId),roleIds=new Set(mine.filter((r)=>r.isActive!==!1).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let assignedRoleIds=new Set(mine.map((r)=>String(r.roleId??r.role_id))),rcRows=(await db.select().from(roleClaimsTable)).filter((rc)=>assignedRoleIds.has(String(rc.roleId??rc.role_id))).map((row)=>({row,key:assignmentKey(row)})).sort((a,b)=>a.key<b.key?-1:a.key>b.key?1:0).map(({row})=>row),assignments=[],grantsByRole=new Map,heldWithoutGrant=[];for(let rc of rcRows){let roleId=String(rc.roleId??rc.role_id),claimId=String(rc.claimId??rc.claim_id),inactive=inactiveActionByClaimId.get(claimId);if(inactive){heldWithoutGrant.push(inactive);continue}let grant=grantActionByClaimId.get(claimId);if(rc.isActive===!1||!roleIds.has(roleId)){let action=grant??guardByClaimId.get(claimId)?.action;if(action)heldWithoutGrant.push(action);continue}if(grant){if(!countsAsGrant(rc.scope)){heldWithoutGrant.push(grant);continue}let held=grantsByRole.get(roleId);if(held)held.push(grant);else grantsByRole.set(roleId,[grant]);continue}let guard4=guardByClaimId.get(claimId);if(!guard4)continue;if(guard4.action)heldWithoutGrant.push(guard4.action);let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;assignments.push({roleId,action:guard4.action,policy:guard4.policy,condition})}if(assignments.length===0)return EMPTY;let keyOf=(a)=>resolveGuardKey(a.policy.keyTemplate,{userId,tenant:ctx.tenant}),targets=mostGenerousTargets({guards:assignments.map((a)=>({roleId:a.roleId,key:keyOf(a),valueType:a.policy.valueType,op:a.condition.op,threshold:a.condition.value,invalidates:a.condition.invalidates})),grantsByRole,heldWithoutGrant,catalog:[...grantActionByClaimId.values()]}),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let[index,assignment]of assignments.entries()){let invalidates=targets[index]?.invalidates??[],suppress=targets[index]?.suppress??invalidates;if(invalidates.length===0&&assignment.condition.invalidates.length>0)continue;let{policy,condition}=assignment,key2=keyOf(assignment),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,policy.valueType,condition),current=normalizeCurrent(value2,policy.valueType);if(guards.push({action:assignment.action,key:key2,valueType:policy.valueType,op:condition.op,threshold:condition.value,current,invalidates,holds,roleId:assignment.roleId}),holds&&suppress.length>0){for(let a of suppress)suppressed.add(a);firedGuards.push({action:assignment.action,key:key2,invalidates:suppress})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function countsAsGrant(scope){return!(typeof scope==="string"&&scope.includes("="))}function assignmentKey(row){return[row.roleId??row.role_id,row.claimId??row.claim_id,row.scope,row.id].map((value2)=>value2==null?"":typeof value2==="string"?value2:JSON.stringify(value2)).join("\x00")}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq73}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq73(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq73(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and34,eq as eq74,isNull as isNull9}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and34(eq74(col17(table,"challenge"),challenge),eq74(col17(table,"challengeType"),challengeType),isNull9(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq74(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq74(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq74(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and34(eq74(col17(table,"credentialId"),credentialId),eq74(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard3(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard3(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard3,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual5}from"crypto";function tokensMatch3(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual5(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg;captureDiscoveryConfig(discovery,logger2);let token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch3(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},serviceGuardsHandler=async({request,query,set:set2})=>{if(!token)return fail6(set2,503,"Usage limits are off: no discovery token is configured");let presented=request.headers.get("x-discovery-token"),internal=request.headers.get("x-internal-identity-token"),identity=discovery.guardReadToken||process.env.IDENTITY_INTERNAL_TOKEN;if(!(presented?tokensMatch3(presented,token):Boolean(internal&&identity&&tokensMatch3(internal,identity))))return fail6(set2,403,"Forbidden: a valid x-discovery-token or x-internal-identity-token required");let userId=String(query.userId??"");if(!SERVICE_GUARD_SUBJECT.test(userId))return fail6(set2,400,"userId must be a UUID");let godmin=await userHasGodminRoleInDb(db,schemaTables,userId,logger2);if(!readState)return{success:!0,data:{userId,godmin,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,userId,readState,{}),names2=new Map,rolesTable=schemaTables.roles;if(guards.length>0&&rolesTable)for(let row of await db.select().from(rolesTable))names2.set(String(row.id),String(row.name??""));return{success:!0,data:{userId,godmin,guards:guards.map((guard4)=>({...guard4,role:names2.get(guard4.roleId)??null}))}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards/service",handler:serviceGuardsHandler}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var SERVICE_GUARD_SUBJECT,fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_hooks();init_seed();init_routeCollector();init_adminGuard();SERVICE_GUARD_SUBJECT=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{batch,createStore}from"h-state";import{useEffectEvent}from"react";function createInitialState(endpoints){let state={};for(let key of Object.keys(endpoints))state[key]={isPending:!1,data:null,error:null,code:null};return state}function createActionsFacade(endpoints,buildAction){let cache=new Map;return new Proxy({},{get(_target,property){if(typeof property!=="string")return;if(!Object.hasOwn(endpoints,property))return;if(cache.has(property))return cache.get(property);let action=buildAction(property);return cache.set(property,action),action},has(_target,property){return typeof property==="string"&&Object.hasOwn(endpoints,property)},ownKeys(){return Object.keys(endpoints)},getOwnPropertyDescriptor(){return{enumerable:!0,configurable:!0}}})}function applyResponse(response,fallbackError){if(response.isSuccess&&response.data!==void 0)return{data:response.data,error:null,code:response.code??null};return{data:null,error:response.errors??fallbackError??null,code:response.code??null}}function createApiHook(endpoints,factory){let{useStore}=createStore(createInitialState(endpoints),{_callEndpoint:(store)=>async(endpointKey,options)=>{if(!store[endpointKey])return;batch(()=>{store[endpointKey].isPending=!0,store[endpointKey].error=null});try{let response=await factory(endpointKey,options.payload);if(batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].code=response.code??null;let applied=applyResponse(response);store[endpointKey].data=applied.data,store[endpointKey].error=applied.error}),response.isSuccess)options.onAfterHandle?.(response.data??response);else options.onErrorHandle?.(response.errors??{message:"Request failed"},response.code,response.requestId)}catch(err){batch(()=>{store[endpointKey].isPending=!1,store[endpointKey].data=null,store[endpointKey].error={message:err instanceof Error?err.message:"Unknown error"}}),options.onErrorHandle?.({message:err instanceof Error?err.message:"Unknown error"},null)}}});return function(){let store=useStore(),callEndpoint=useEffectEvent((endpointKey,options)=>{store._callEndpoint(endpointKey,options)});return createActionsFacade(endpoints,(property)=>{let key=property;return{state:store[key],start:(options)=>{callEndpoint(key,options)}}})}}var system_tables_default={$schema:"../schemas/nucleus.tables.schema.json",tables:[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}]};function deriveAuthEndpoints(configs){let out={};for(let config of Object.values(configs)){let subs=config.subEndpoints??[{key:config.key,method:config.method,suffix:""}];for(let sub of subs){let base=sub.defaultRoute??config.defaultRoute,entry={method:sub.method??config.method,path:`${base}${sub.suffix??""}`},isPublic=sub.isPublic??config.defaultIsPublic;if(isPublic!==void 0)entry.isPublic=isPublic;entry._payload=sub._payload??config._payload,entry._success=sub._success??config._success,entry._error=sub._error??config._error,out[sub.key]=entry}}return out}var AUTH_ENDPOINT_CONFIGS={login:{key:"LOGIN",method:"POST",defaultRoute:"/auth/login",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},register:{key:"REGISTER",method:"POST",defaultRoute:"/auth/register",defaultIsPublic:!0,_payload:void 0,_success:void 0,_error:void 0},logout:{key:"LOGOUT",method:"POST",defaultRoute:"/auth/logout",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},refresh:{key:"REFRESH",method:"POST",defaultRoute:"/auth/refresh",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},me:{key:"ME",method:"GET",defaultRoute:"/auth/me",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordChange:{key:"PASSWORD_CHANGE",method:"POST",defaultRoute:"/auth/password-change",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordSet:{key:"PASSWORD_SET",method:"POST",defaultRoute:"/auth/password-set",defaultIsPublic:!1,_payload:void 0,_success:void 0,_error:void 0},passwordReset:{key:"PASSWORD_RESET_REQUEST",method:"POST",defaultRoute:"/auth/password-reset",defaultIsPublic:!0,subEndpoints:[{key:"PASSWORD_RESET_REQUEST",method:"POST",suffix:"/request",_payload:void 0,_success:void 0,_error:void 0},{key:"PASSWORD_RESET_CONFIRM",method:"POST",suffix:"/confirm",_payload:void 0,_success:void 0,_error:void 0}]},sessions:{key:"SESSIONS",method:"GET",defaultRoute:"/auth/sessions",defaultIsPublic:!1,subEndpoints:[{key:"SESSIONS",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_CURRENT",method:"GET",suffix:"/current",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_STATS",method:"GET",suffix:"/stats",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_PENDING",method:"GET",suffix:"/pending",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE",method:"DELETE",suffix:"/:sessionId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REVOKE_ALL",method:"DELETE",suffix:"/all",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_LIST",method:"GET",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_ADMIN_REVOKE",method:"DELETE",suffix:"/admin/:userId",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_APPROVE",method:"POST",suffix:"/approve",_payload:void 0,_success:void 0,_error:void 0},{key:"SESSIONS_REJECT",method:"POST",suffix:"/reject",_payload:void 0,_success:void 0,_error:void 0}]},magicLink:{key:"MAGIC_LINK",method:"POST",defaultRoute:"/auth/magic-link",defaultIsPublic:!0,subEndpoints:[{key:"MAGIC_LINK",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"MAGIC_LINK_VERIFY",method:"GET",suffix:"/verify",routeKey:"verifyRoute",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},invite:{key:"INVITE",method:"POST",defaultRoute:"/auth/invite",defaultIsPublic:!1,subEndpoints:[{key:"INVITE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"INVITE_VERIFY",method:"POST",suffix:"/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}]},emailVerification:{key:"VERIFY_EMAIL",method:"GET",defaultRoute:"/verify-email",defaultIsPublic:!0,subEndpoints:[{key:"VERIFY_EMAIL",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"RESEND_VERIFICATION",method:"POST",suffix:"",routeKey:"resendRoute",defaultRoute:"/resend-verification",_payload:void 0,_success:void 0,_error:void 0}]},captcha:{key:"CAPTCHA",method:"GET",defaultRoute:"/auth/captcha",defaultIsPublic:!0,subEndpoints:[{key:"CAPTCHA_GENERATE",method:"GET",suffix:"/generate",_payload:void 0,_success:void 0,_error:void 0},{key:"CAPTCHA_VALIDATE",method:"POST",suffix:"/validate",_payload:void 0,_success:void 0,_error:void 0}]},oauth:{key:"OAUTH_PROVIDERS",method:"GET",defaultRoute:"/auth/oauth",defaultIsPublic:!0,subEndpoints:[{key:"OAUTH_PROVIDERS",method:"GET",suffix:"/providers",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_REDIRECT",method:"GET",suffix:"/:provider",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_ACCOUNTS",method:"GET",suffix:"/accounts",_payload:void 0,_success:void 0,_error:void 0},{key:"OAUTH_UNLINK",method:"DELETE",suffix:"/unlink/:provider",_payload:void 0,_success:void 0,_error:void 0}]},webauthn:{key:"WEBAUTHN",method:"POST",defaultRoute:"/auth/webauthn",defaultIsPublic:!1,subEndpoints:[{key:"WEBAUTHN_REGISTER_OPTIONS",method:"POST",suffix:"/register/options",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REGISTER_VERIFY",method:"POST",suffix:"/register/verify",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_OPTIONS",method:"POST",suffix:"/authenticate/options",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_AUTH_VERIFY",method:"POST",suffix:"/authenticate/verify",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_LIST",method:"GET",suffix:"/credentials",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_REVOKE",method:"DELETE",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0},{key:"WEBAUTHN_RENAME",method:"PATCH",suffix:"/credentials/:credentialId",_payload:void 0,_success:void 0,_error:void 0}]},apiKeys:{key:"API_KEYS",method:"GET",defaultRoute:"/auth/api-keys",defaultIsPublic:!1,subEndpoints:[{key:"API_KEYS_CREATE",method:"POST",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_LIST",method:"GET",suffix:"",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_DETAIL",method:"GET",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_UPDATE",method:"PATCH",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0},{key:"API_KEYS_REVOKE",method:"DELETE",suffix:"/:id",_payload:void 0,_success:void 0,_error:void 0}]}},ADMIN_ENDPOINTS={ADMIN_IMPERSONATE:{method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_IMPERSONATE_STOP:{method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CHANGE_USER_ID:{method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_USER:{method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_HARD_DELETE_USER:{method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_LOCK_USER:{method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UNLOCK_USER:{method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_MARK_EMAIL_VERIFIED:{method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},UNPUBLISHED_AUTH_KEYS=[];function publishedAuthEndpoints(){let all=deriveAuthEndpoints(AUTH_ENDPOINT_CONFIGS),excluded=new Set(UNPUBLISHED_AUTH_KEYS);return Object.fromEntries(Object.entries(all).filter(([key])=>!excluded.has(key)))}var AUTH_ENDPOINTS={...publishedAuthEndpoints(),...ADMIN_ENDPOINTS},CONFIG_ENDPOINTS={CONFIG_GET:{method:"GET",path:"/nucleus/config",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTIONS:{method:"GET",path:"/nucleus/config/sections",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_GET:{method:"GET",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_SECTION_UPDATE:{method:"PATCH",path:"/nucleus/config/:section",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_ENV:{method:"GET",path:"/nucleus/config/env",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_GET:{method:"GET",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_OVERRIDES_CLEAR:{method:"DELETE",path:"/nucleus/config/overrides",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CONFIG_RESTART:{method:"POST",path:"/nucleus/config/restart",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},VERIFICATION_ENDPOINTS={VERIFICATION_STATUS:{method:"GET",path:"/verification/status/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_DECIDE:{method:"POST",path:"/verification/decide/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_CANCEL:{method:"POST",path:"/verification/:entity_name/:entity_id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_PENDING:{method:"GET",path:"/verification/pending",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_HISTORY:{method:"GET",path:"/verification/history/:entity_name/:entity_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START:{method:"POST",path:"/verification/start",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_START_FOR_ENTITY:{method:"POST",path:"/verification/start-for-entity",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},VERIFICATION_ENTITY_STATUSES:{method:"GET",path:"/verification/entity-statuses/:entity_name",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_LIST:{method:"GET",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_GET:{method:"GET",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_SAVE:{method:"POST",path:"/verification/flows",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_FEASIBILITY:{method:"POST",path:"/verification/flows/feasibility",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_PUBLISH:{method:"POST",path:"/verification/flows/:flow_id/publish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_UNPUBLISH:{method:"POST",path:"/verification/flows/:flow_id/unpublish",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},FLOW_DELETE:{method:"DELETE",path:"/verification/flows/:flow_id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_LIST:{method:"GET",path:"/notifications",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_UNSEEN_COUNT:{method:"GET",path:"/notifications/unseen-count",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_SEEN:{method:"POST",path:"/notifications/:notification_id/seen",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},NOTIFICATION_MARK_ALL_SEEN:{method:"POST",path:"/notifications/seen-all",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},CHAT_ENDPOINTS={CHAT_LIST_CONVERSATIONS:{method:"GET",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_CREATE_CONVERSATION:{method:"POST",path:"/chat/conversations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_CONVERSATION:{method:"GET",path:"/chat/conversations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_GET_MESSAGES:{method:"GET",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_SEND_MESSAGE:{method:"POST",path:"/chat/conversations/:id/messages",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_MARK_READ:{method:"POST",path:"/chat/conversations/:id/read",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_TYPING:{method:"POST",path:"/chat/conversations/:id/typing",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_ADD_PARTICIPANTS:{method:"POST",path:"/chat/conversations/:id/participants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_REMOVE_PARTICIPANT:{method:"DELETE",path:"/chat/conversations/:id/participants/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_EDIT_MESSAGE:{method:"PATCH",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},CHAT_DELETE_MESSAGE:{method:"DELETE",path:"/chat/messages/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MONITORING_ENDPOINTS={MONITORING_HEALTH_CHECK:{method:"GET",path:"/monitoring/health",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_SETTINGS:{method:"GET",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_CHANGE_SETTINGS:{method:"PATCH",path:"/monitoring/settings",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},MONITORING_GET_LOGS:{method:"GET",path:"/monitoring/logs",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},PAYMENT_ENDPOINTS={PAYMENT_INITIALIZE:{method:"POST",path:"/payments/initialize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTIONS:{method:"GET",path:"/payments/transactions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_TRANSACTION_DETAIL:{method:"GET",path:"/payments/transactions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_BIN_QUERY:{method:"POST",path:"/payments/bin-query",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DETAIL:{method:"POST",path:"/payments/payment-detail",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REFUND:{method:"POST",path:"/payments/refund",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SAVE_CARD:{method:"POST",path:"/payments/cards/save",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CARDS:{method:"GET",path:"/payments/cards",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CARD:{method:"DELETE",path:"/payments/cards/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SYNC_CARDS:{method:"POST",path:"/payments/cards/sync",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REGISTER_SUB_MERCHANT:{method:"POST",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUB_MERCHANT:{method:"PUT",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUB_MERCHANTS:{method:"GET",path:"/payments/sub-merchants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUB_MERCHANT:{method:"GET",path:"/payments/sub-merchants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SPLITS:{method:"GET",path:"/payments/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_APPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DISAPPROVE_SPLIT:{method:"POST",path:"/payments/splits/:splitId/disapprove",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRODUCT:{method:"POST",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRODUCT:{method:"PUT",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRODUCTS:{method:"GET",path:"/payments/products",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRODUCT:{method:"GET",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRODUCT:{method:"DELETE",path:"/payments/products/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PRICE:{method:"POST",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_PRICE:{method:"PUT",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PRICES:{method:"GET",path:"/payments/prices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PRICE:{method:"GET",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_ARCHIVE_PRICE:{method:"DELETE",path:"/payments/prices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_CUSTOMER:{method:"POST",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_CUSTOMER:{method:"PUT",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_CUSTOMERS:{method:"GET",path:"/payments/customers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_CUSTOMER:{method:"GET",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_DELETE_CUSTOMER:{method:"DELETE",path:"/payments/customers/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_UPDATE_SUBSCRIPTION:{method:"PUT",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_SUBSCRIPTION:{method:"POST",path:"/payments/subscriptions/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_SUBSCRIPTIONS:{method:"GET",path:"/payments/subscriptions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_SUBSCRIPTION:{method:"GET",path:"/payments/subscriptions/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_REPORT_USAGE:{method:"POST",path:"/payments/usage-records",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_USAGE_SUMMARIES:{method:"GET",path:"/payments/usage-records/:subscriptionItemId/summaries",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_INVOICE:{method:"POST",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_FINALIZE_INVOICE:{method:"POST",path:"/payments/invoices/:id/finalize",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_SEND_INVOICE:{method:"POST",path:"/payments/invoices/:id/send",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_VOID_INVOICE:{method:"POST",path:"/payments/invoices/:id/void",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_PAY_INVOICE:{method:"POST",path:"/payments/invoices/:id/pay",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_INVOICES:{method:"GET",path:"/payments/invoices",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_INVOICE:{method:"GET",path:"/payments/invoices/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_BALANCE:{method:"GET",path:"/payments/balance",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_PAYOUT:{method:"POST",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_PAYOUTS:{method:"GET",path:"/payments/payouts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_GET_PAYOUT:{method:"GET",path:"/payments/payouts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CANCEL_PAYOUT:{method:"POST",path:"/payments/payouts/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_CREATE_TRANSFER:{method:"POST",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_LIST_TRANSFERS:{method:"GET",path:"/payments/transfers",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},TENANT_ENDPOINTS={TENANT_CHECK_SUBDOMAIN:{method:"GET",path:"/tenants/check-subdomain/:subdomain",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},TENANT_PROVISION:{method:"POST",path:"/tenants/provision",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_LIST:{method:"GET",path:"/tenants",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_DETAIL:{method:"GET",path:"/tenants/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SUSPEND:{method:"POST",path:"/tenants/:id/suspend",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_REACTIVATE:{method:"POST",path:"/tenants/:id/reactivate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},TENANT_SELF_SIGNUP:{method:"POST",path:"/tenants/self-signup",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0}},DOMAIN_ENDPOINTS={DOMAIN_RESOLVE:{method:"GET",path:"/domains/resolve",isPublic:!0,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_HOSTNAME:{method:"POST",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_HOSTNAMES:{method:"GET",path:"/domains/hostnames",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_HOSTNAME:{method:"GET",path:"/domains/hostnames/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_HOSTNAME_INSTRUCTIONS:{method:"GET",path:"/domains/hostnames/:id/instructions",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_VERIFY_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/verify",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_ACTIVATE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/activate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_DISABLE_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/disable",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_MAKE_PRIMARY:{method:"POST",path:"/domains/hostnames/:id/make-primary",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_REFRESH_HOSTNAME:{method:"POST",path:"/domains/hostnames/:id/refresh-status",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CREATE_REGISTRATION:{method:"POST",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_LIST_REGISTRATIONS:{method:"GET",path:"/domains/registrations",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_GET_REGISTRATION:{method:"GET",path:"/domains/registrations/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_CANCEL_REGISTRATION:{method:"POST",path:"/domains/registrations/:id/cancel",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},DOMAIN_TRANSFER_OUT:{method:"POST",path:"/domains/registrations/:id/transfer-out",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},MARKETPLACE_ENDPOINTS={PAYMENT_MARKETPLACE_RECORD_SPLIT:{method:"POST",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_SPLITS:{method:"GET",path:"/payment/marketplace/splits",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_BALANCE:{method:"GET",path:"/payment/marketplace/balance/:ownerId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RELEASE_RESERVE:{method:"POST",path:"/payment/marketplace/reserves/:id/release",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_SETTLEMENT_POLICY:{method:"GET",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_UPSERT_SETTLEMENT_POLICY:{method:"POST",path:"/payment/marketplace/settlement-policy",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REQUEST_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_PAYOUTS:{method:"GET",path:"/payment/marketplace/payout-requests",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_GET_PAYOUT:{method:"GET",path:"/payment/marketplace/payout-requests/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_APPROVE_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/approve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_REJECT_PAYOUT:{method:"POST",path:"/payment/marketplace/payout-requests/:id/reject",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_OPEN_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_LIST_DISPUTES:{method:"GET",path:"/payment/marketplace/disputes",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},PAYMENT_MARKETPLACE_RESOLVE_DISPUTE:{method:"POST",path:"/payment/marketplace/disputes/:id/resolve",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}},COHORT_ENDPOINTS={ADMIN_LIST_COHORTS:{method:"GET",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_GET_COHORT:{method:"GET",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_CREATE_COHORT:{method:"POST",path:"/auth/admin/cohorts",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_UPDATE_COHORT:{method:"PATCH",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_DELETE_COHORT:{method:"DELETE",path:"/auth/admin/cohorts/:id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_BULK_CREATE:{method:"POST",path:"/auth/admin/cohorts/:id/bulk-create",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DEACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/deactivate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_ACTIVATE:{method:"POST",path:"/auth/admin/cohorts/:id/activate-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_DELETE_USERS:{method:"POST",path:"/auth/admin/cohorts/:id/delete-users",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},ADMIN_COHORT_EXPORT:{method:"GET",path:"/auth/admin/cohorts/:id/export",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}};var SYSTEM_TABLE_NAMES=["profiles","addresses","phones","files","users","roles","claims","user_roles","role_claims","audit_logs","monitoring_metrics","integration_sources","integration_endpoints","integration_mappings","integration_runs","integration_run_items"],systemTables=system_tables_default.tables.filter((t)=>SYSTEM_TABLE_NAMES.includes(t.table_name));function toUpperSnakeCase(str){return str.replace(/([a-z])([A-Z])/g,"$1_$2").replace(/[\s-]+/g,"_").toUpperCase()}function snakeToCamelCase(str){return str.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function singularize(str){if(str.endsWith("ies"))return`${str.slice(0,-3)}y`;if(str.endsWith("ses"))return`${str.slice(0,-2)}`;if(str.endsWith("s"))return str.slice(0,-1);return str}function generateEntityEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName),singularName=toUpperSnakeCase(singularize(tableName));switch(method){case"GET":return`GET_${upperName}`;case"POST":return`ADD_${singularName}`;case"PUT":return`UPDATE_${singularName}`;case"PATCH":return`PATCH_${singularName}`;case"DELETE":return`DELETE_${singularName}`}}function generateBulkEndpointKey(tableName,method){let upperName=toUpperSnakeCase(tableName);switch(method){case"POST":return`BULK_ADD_${upperName}`;case"PUT":return`BULK_UPDATE_${upperName}`;case"DELETE":return`BULK_DELETE_${upperName}`}}function isMethodExcluded(table,method){if(!table.excluded_methods)return!1;let methodMap={GET:"GET",POST:"POST",PUT:"PUT",PATCH:"PATCH",DELETE:"DELETE"};return table.excluded_methods.includes(methodMap[method])}function generateEndpointsFromConfig(config){let endpoints={};for(let table of config.entities){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,sid=table.serviceId;if(!isMethodExcluded(table,"GET")){endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0},endpoints[`GET_${toUpperSnakeCase(tableName)}_DISTINCT`]={method:"GET",path:`${basePath}/distinct/:field`,isPublic:table.is_public?.GET??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}if(!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:table.is_public?.POST??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:table.is_public?.PUT??!1,isFormData:table.is_form_data,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:table.is_public?.PATCH??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled){if(!isMethodExcluded(table,"POST"))endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:table.is_public?.POST??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:table.is_public?.PUT??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:table.is_public?.DELETE??!1,serviceId:sid,_payload:void 0,_success:void 0,_error:void 0}}}return endpoints}function generateAuthEndpoints(config){let endpoints={},auth=config.authentication;if(!auth?.enabled)return endpoints;for(let[featureKey,endpointConfig]of Object.entries(AUTH_ENDPOINT_CONFIGS)){let feature=auth[featureKey];if(!feature?.enabled)continue;let feat=feature,baseRoute=feat.route||endpointConfig.defaultRoute,isPublic=feat.isPublic??endpointConfig.defaultIsPublic;if("subEndpoints"in endpointConfig&&endpointConfig.subEndpoints)for(let sub of endpointConfig.subEndpoints){let subRoute="routeKey"in sub&&sub.routeKey&&feature[sub.routeKey]?String(feature[sub.routeKey]):("defaultRoute"in sub)&&sub.defaultRoute?String(sub.defaultRoute):`${baseRoute}${sub.suffix}`,subIsPublic="isPublic"in sub&&typeof sub.isPublic==="boolean"?sub.isPublic:isPublic;endpoints[sub.key]={method:sub.method,path:subRoute,isPublic:subIsPublic,_payload:sub._payload,_success:sub._success,_error:sub._error}}else if("_payload"in endpointConfig)endpoints[endpointConfig.key]={method:endpointConfig.method,path:baseRoute,isPublic,_payload:endpointConfig._payload,_success:endpointConfig._success,_error:endpointConfig._error}}return endpoints}function generateSystemTableEndpoints(){let endpoints={};for(let table of systemTables){let tableName=table.table_name,basePath=`/${snakeToCamelCase(tableName)}`,isFormData=tableName==="files";endpoints[generateEntityEndpointKey(tableName,"GET")]={method:"GET",path:basePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};let singularName=toUpperSnakeCase(singularize(tableName));if(endpoints[`GET_${singularName}_BY_ID`]={method:"GET",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},!isMethodExcluded(table,"POST"))endpoints[generateEntityEndpointKey(tableName,"POST")]={method:"POST",path:basePath,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PUT"))endpoints[generateEntityEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/:id`,isPublic:!1,isFormData,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"PATCH"))endpoints[generateEntityEndpointKey(tableName,"PATCH")]={method:"PATCH",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(!isMethodExcluded(table,"DELETE"))endpoints[generateEntityEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/:id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};if(table.bulk_endpoints_enabled)endpoints[generateBulkEndpointKey(tableName,"POST")]={method:"POST",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"PUT")]={method:"PUT",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints[generateBulkEndpointKey(tableName,"DELETE")]={method:"DELETE",path:`${basePath}/bulk`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0}}return endpoints}function generateMonitoringEndpoints(config){if(!config.liveMonitoring?.enabled)return{};return{...MONITORING_ENDPOINTS}}function generateAdminEndpoints(config){let endpoints={};if(!config.authentication?.enabled)return endpoints;return endpoints.ADMIN_IMPERSONATE={method:"POST",path:"/auth/admin/impersonate",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_IMPERSONATE_STOP={method:"POST",path:"/auth/admin/impersonate/stop",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CHANGE_USER_ID={method:"POST",path:"/auth/admin/change-user-id",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_CREATE_USER={method:"POST",path:"/auth/admin/create-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_HARD_DELETE_USER={method:"DELETE",path:"/auth/admin/hard-delete/:userId",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_LOCK_USER={method:"POST",path:"/auth/admin/lock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_UNLOCK_USER={method:"POST",path:"/auth/admin/unlock-user",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.ADMIN_MARK_EMAIL_VERIFIED={method:"POST",path:"/auth/admin/mark-email-verified",isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generateCohortEndpoints(config){let auth=config.authentication;if(!auth?.enabled||!auth.cohorts?.enabled)return{};return{...COHORT_ENDPOINTS}}function generateVerificationEndpoints(config){let endpoints={},verification=config.verification;if(!verification?.enabled)return endpoints;let basePath=verification.endpoints?.basePath||"/verifications",flowBasePath=verification.flowEndpoints?.basePath||"/verification-flows";if(endpoints.VERIFICATION_STATUS={method:"GET",path:`${basePath}/status/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_DECIDE={method:"POST",path:`${basePath}/:entity_name/:entity_id/decide`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_CANCEL={method:"POST",path:`${basePath}/:entity_name/:entity_id/cancel`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_PENDING={method:"GET",path:`${basePath}/pending`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_HISTORY={method:"GET",path:`${basePath}/history/:entity_name/:entity_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START={method:"POST",path:`${basePath}/start`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_START_FOR_ENTITY={method:"POST",path:`${basePath}/start-for-entity`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.VERIFICATION_ENTITY_STATUSES={method:"GET",path:`${basePath}/statuses/:entity_name`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},verification.flowEndpoints?.enabled!==!1)endpoints.FLOW_LIST={method:"GET",path:flowBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_GET={method:"GET",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_SAVE={method:"POST",path:flowBasePath,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_FEASIBILITY={method:"POST",path:`${flowBasePath}/feasibility`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_PUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/publish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_UNPUBLISH={method:"POST",path:`${flowBasePath}/:flow_id/unpublish`,isPublic:!1,skipCamelCase:!0,_payload:void 0,_success:void 0,_error:void 0},endpoints.FLOW_DELETE={method:"DELETE",path:`${flowBasePath}/:flow_id`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0};return endpoints}function generateNotificationEndpoints(config){let endpoints={},notification=config.notification;if(!notification?.enabled||notification.endpoints?.enabled===!1)return endpoints;let notifBasePath=notification.endpoints?.basePath||"/notifications";return endpoints.NOTIFICATION_LIST={method:"GET",path:notifBasePath,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_UNSEEN_COUNT={method:"GET",path:`${notifBasePath}/unseen-count`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_SEEN={method:"POST",path:`${notifBasePath}/:notification_id/seen`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints.NOTIFICATION_MARK_ALL_SEEN={method:"POST",path:`${notifBasePath}/seen-all`,isPublic:!1,_payload:void 0,_success:void 0,_error:void 0},endpoints}function generatePaymentEndpoints(config){if(!config.payment?.enabled)return{};return{...PAYMENT_ENDPOINTS}}function generateConfigEndpoints(config){if(!config.configManagement?.enabled)return{};return{...CONFIG_ENDPOINTS}}function generateTenantEndpoints(config){if(!config.database?.isMultiTenant)return{};return{...TENANT_ENDPOINTS}}function generateChatEndpoints(config){if(!config.chat?.enabled)return{};return{...CHAT_ENDPOINTS}}function generateDomainEndpoints(config){if(!config.domains?.enabled)return{};return{...DOMAIN_ENDPOINTS}}function generateMarketplaceEndpoints(config){let payment=config.payment;if(!payment?.enabled||!payment.marketplace?.enabled)return{};return{...MARKETPLACE_ENDPOINTS}}function generateAllEndpoints(config,extraEndpoints){let entityEndpoints=generateEndpointsFromConfig(config),authEndpoints=generateAuthEndpoints(config),adminEndpoints=generateAdminEndpoints(config),cohortEndpoints=generateCohortEndpoints(config),systemEndpoints=generateSystemTableEndpoints(),monitoringEndpoints=generateMonitoringEndpoints(config),verificationEndpoints=generateVerificationEndpoints(config),chatEndpoints=generateChatEndpoints(config),tenantEndpoints=generateTenantEndpoints(config),domainEndpoints=generateDomainEndpoints(config),marketplaceEndpoints=generateMarketplaceEndpoints(config),notificationEndpoints=generateNotificationEndpoints(config),paymentEndpoints=generatePaymentEndpoints(config),configEndpoints=generateConfigEndpoints(config);return{...entityEndpoints,...authEndpoints,...adminEndpoints,...cohortEndpoints,...systemEndpoints,...monitoringEndpoints,...verificationEndpoints,...chatEndpoints,...tenantEndpoints,...domainEndpoints,...marketplaceEndpoints,...notificationEndpoints,...paymentEndpoints,...configEndpoints,...extraEndpoints??{}}}init_Logger();var DEFAULT_CONFIG2={timeout:30000,retries:0,retryDelay:1000,debug:!1};class ServerFetch{config;logger;constructor(config={}){this.config={...DEFAULT_CONFIG2,...config},this.logger=new Logger({service:"ServerFetch",prettyPrint:this.config.debug,colorize:this.config.debug,auditEnabled:!1})}buildUrl(url){if(url.startsWith("http://")||url.startsWith("https://"))return url;return this.config.baseUrl?`${this.config.baseUrl}${url}`:url}buildHeaders(customHeaders){let headers=new Headers;if(this.config.defaultHeaders)for(let[key,value]of Object.entries(this.config.defaultHeaders))headers.set(key,value);if(customHeaders)if(customHeaders instanceof Headers)customHeaders.forEach((value,key)=>{headers.set(key,value)});else if(Array.isArray(customHeaders))for(let[key,value]of customHeaders)headers.set(key,value);else for(let[key,value]of Object.entries(customHeaders))headers.set(key,value);return headers}parseResponseHeaders(headers){let result={};if(headers.forEach((value,key)=>{if(key.toLowerCase()==="set-cookie"){let existing=result[key];result[key]=existing?`${existing}, ${value}`:value}else result[key]=value}),typeof headers.getSetCookie==="function"){let setCookies=headers.getSetCookie();if(setCookies.length>0)result["set-cookie"]=setCookies.join(", ")}return result}async executeWithTimeout(promise,timeoutMs,_requestId){let controller=new AbortController,timeoutId=setTimeout(()=>controller.abort(),timeoutMs);try{return await Promise.race([promise,new Promise((_,reject)=>{controller.signal.addEventListener("abort",()=>{reject(Error(`Request timeout after ${timeoutMs}ms`))})})])}finally{clearTimeout(timeoutId)}}async fetch(options){let requestId=randomId(),startTime=performance.now(),url=this.buildUrl(options.url),headers=this.buildHeaders(options.headers),timeout=options.timeout??this.config.timeout??30000,retries=options.retries??this.config.retries??0,retryDelay=options.retryDelay??this.config.retryDelay??1000,body;if(options.body)if(typeof options.body==="object"&&!(options.body instanceof FormData)&&!(options.body instanceof URLSearchParams)&&!(options.body instanceof Blob)&&!(options.body instanceof ArrayBuffer)){if(body=JSON.stringify(options.body),!headers.has("content-type"))headers.set("content-type","application/json")}else body=options.body;this.logger.debug(`[${requestId}] ${options.method} ${url}`,{method:options.method,url,hasBody:!!body});let lastError=null,attempt=0;while(attempt<=retries)try{let response=await this.executeWithTimeout(fetch(url,{method:options.method,headers,body}),timeout,requestId),durationMs2=performance.now()-startTime,responseHeaders=this.parseResponseHeaders(response.headers),rawSetCookies=typeof response.headers.getSetCookie==="function"?response.headers.getSetCookie():[],responseData,errorData,rawText=await response.text();if(rawText)try{let json=JSON.parse(rawText);if(response.ok)responseData=json;else errorData=json}catch{if(!response.ok)errorData={message:rawText||response.statusText}}else if(!response.ok)errorData={message:response.statusText};let result={isSuccess:response.ok,response:responseData,errors:errorData,code:response.status,headers:responseHeaders,rawSetCookies,durationMs:durationMs2,requestId,createdAt:new Date};if(response.ok)this.logger.info(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2)});else this.logger.warn(`[${requestId}] ${options.method} ${url} ${response.status}`,{method:options.method,url,statusCode:response.status,durationMs:Math.round(durationMs2),error:errorData});return result}catch(error){if(lastError=error instanceof Error?error:Error(String(error)),attempt++,attempt<=retries)this.logger.warn(`[${requestId}] Retry ${attempt}/${retries} after error`,{method:options.method,url,error:lastError.message,attempt,retries}),await new Promise((resolve)=>setTimeout(resolve,retryDelay))}let durationMs=performance.now()-startTime;return this.logger.error(`[${requestId}] ${options.method} ${url} failed`,lastError,{method:options.method,url,durationMs:Math.round(durationMs),attempts:attempt}),{isSuccess:!1,response:void 0,errors:{message:lastError?.message||"Unknown error"},code:null,headers:{},rawSetCookies:[],durationMs,requestId,createdAt:new Date}}async get(url,options){return this.fetch({...options,url,method:"GET"})}async post(url,body,options){return this.fetch({...options,url,method:"POST",body})}async put(url,body,options){return this.fetch({...options,url,method:"PUT",body})}async patch(url,body,options){return this.fetch({...options,url,method:"PATCH",body})}async delete(url,options){return this.fetch({...options,url,method:"DELETE"})}}var serverFetch=new ServerFetch;var RESPONSE_CONTROL_FLAGS=["requiresCaptcha","requiresApproval","attemptsRemaining","requestId","code","detail"];function serverRequestId(response){let fromBody=(value)=>{if(!value||typeof value!=="object")return;let id=value.requestId;return typeof id==="string"&&id.length>0?id:void 0};return fromBody(response.errors)??fromBody(response.response)??response.headers?.["x-request-id"]??void 0}function normalizeResponseShape(response){if(!response||typeof response!=="object"||Array.isArray(response))return response;let raw=response;if(!("success"in raw)||"data"in raw)return response;let{success,isSuccess,message,error,...rest}=raw,controlFlags={};for(let flag of RESPONSE_CONTROL_FLAGS)if(flag in rest)controlFlags[flag]=rest[flag],delete rest[flag];return{success,...isSuccess!==void 0?{isSuccess}:{},...message!==void 0?{message}:{},...error!==void 0?{error}:{},...controlFlags,...Object.keys(rest).length>0?{data:rest}:{}}}var DEFAULT_TOKEN_NAMES={accessToken:"access_token",refreshToken:"refresh_token",sessionToken:"session_token"};function splitSetCookieHeader(header){let cookies=[],current="";for(let i=0;i<header.length;i++){let char=header[i];if(char===","){let next=header.slice(i+1).trimStart();if(/^[a-zA-Z0-9_-]+=/.test(next)){cookies.push(current.trim()),current="";continue}}current+=char}if(current.trim())cookies.push(current.trim());return cookies}function buildRequestHeaders(headersStore,tokenNames){let headers={},forwardHeaders=["x-forwarded-for","x-real-ip","user-agent","accept-language","x-request-id","x-client-ip","cf-connecting-ip","true-client-ip","x-tenant-id","x-app-origin"];for(let header of forwardHeaders){let value=headersStore.get(header);if(value)headers[header]=value}if(!headers["user-agent"])headers["user-agent"]="Nucleus-ServerAction/1.0";let accessToken=headersStore.get(`x-${tokenNames.accessToken}`),refreshToken=headersStore.get(`x-${tokenNames.refreshToken}`),sessionToken=headersStore.get(`x-${tokenNames.sessionToken}`);if(accessToken)headers[`x-${tokenNames.accessToken}`]=accessToken;if(refreshToken)headers[`x-${tokenNames.refreshToken}`]=refreshToken;if(sessionToken)headers[`x-${tokenNames.sessionToken}`]=sessionToken;let cookieHeader=headersStore.get("cookie");if(cookieHeader)headers.cookie=cookieHeader;return headers}function toCamelCase(str){return str.replace(/_([a-z])/g,(_,c)=>c.toUpperCase())}function convertKeysToCamelCase(obj){let result={};for(let[key,value]of Object.entries(obj)){let camelKey=key.startsWith("_")?key:toCamelCase(key);if(value instanceof Date)result[camelKey]=value.toISOString();else if(value&&typeof value==="object"&&!Array.isArray(value))result[camelKey]=convertKeysToCamelCase(value);else result[camelKey]=value}return result}var JSON_STRINGIFY_KEYS=new Set(["filters","sort","with","searchFields","select","distinctOn"]);function appendQueryParams(url,params){let searchParams=new URLSearchParams;for(let[key,value]of Object.entries(params)){if(value===void 0||value===null)continue;if(JSON_STRINGIFY_KEYS.has(key)&&typeof value==="object"){searchParams.append(key,JSON.stringify(value));continue}if(value instanceof Date)searchParams.append(key,value.toISOString());else if(Array.isArray(value))searchParams.append(key,value.filter((v)=>v!=null).map(String).join(","));else if(typeof value==="object")searchParams.append(key,JSON.stringify(value));else searchParams.append(key,String(value))}let queryString=searchParams.toString();if(!queryString)return url;return url.includes("?")?`${url}&${queryString}`:`${url}?${queryString}`}var DEFAULT_REFRESH_EXCLUDED=["/auth/login","/auth/logout","/auth/register","/auth/refresh"];function mergeCookieHeader(existing,setCookies){let jar=new Map;for(let part of(existing??"").split(";")){let eq=part.indexOf("=");if(eq<=0)continue;jar.set(part.slice(0,eq).trim(),part.slice(eq+1).trim())}for(let raw of setCookies){let[pair]=raw.split(";");if(!pair)continue;let eq=pair.indexOf("=");if(eq<=0)continue;let name=pair.slice(0,eq).trim(),value=pair.slice(eq+1).trim();if(value===""||/max-age\s*=\s*0(?!\d)/i.test(raw))jar.delete(name);else jar.set(name,value)}return Array.from(jar,([k,v])=>`${k}=${v}`).join("; ")}function setCookiesOf(response){if(response.rawSetCookies.length>0)return response.rawSetCookies;let joined=response.headers["set-cookie"];return joined?splitSetCookieHeader(joined):[]}function createServerFactory(endpoints,config,getCookies,getHeaders){let tokenNames={...DEFAULT_TOKEN_NAMES,...config.tokenNames},serverFetch2=new ServerFetch({baseUrl:config.baseUrl,debug:config.debug,timeout:30000,retries:0});return async function(endpointKey,payload){let endpoint=endpoints[endpointKey];if(!endpoint)return{isSuccess:!1,errors:{message:`Endpoint "${endpointKey}" not found`},code:404};let cookieStore=await getCookies(),headersStore=await getHeaders(),allHeaders={};if(headersStore.forEach((value,key)=>{allHeaders[key]=value}),(endpoint.path.includes("/auth/login")||endpoint.path.includes("/auth/oauth"))&&endpoint.method==="POST")try{cookieStore.delete(tokenNames.accessToken),cookieStore.delete(tokenNames.refreshToken),cookieStore.delete(tokenNames.sessionToken)}catch(_){}let headers=buildRequestHeaders(headersStore,tokenNames),url=endpoint.path,body,pathParamNames=new Set,pathParamRegex=/:([a-zA-Z_][a-zA-Z0-9_]*)/g,paramMatch=pathParamRegex.exec(url);while(paramMatch!==null){if(paramMatch[1])pathParamNames.add(paramMatch[1]);paramMatch=pathParamRegex.exec(url)}if(payload&&typeof payload==="object"&&!(payload instanceof FormData)){let payloadObj=payload;for(let[key,value]of Object.entries(payloadObj))if(value!=null){if(pathParamNames.has(key))url=url.replace(`:${key}`,String(value));else if(key.startsWith("_")&&pathParamNames.has(key.substring(1)))url=url.replace(`:${key.substring(1)}`,String(value));else if(key==="id"&&pathParamNames.has("id"))url=url.replace(":id",String(value))}}if(endpoint.method==="GET"&&payload&&typeof payload==="object"){let queryPayload={...payload};for(let paramName of pathParamNames)delete queryPayload[paramName],delete queryPayload[`_${paramName}`];url=appendQueryParams(url,queryPayload)}else if(payload!==void 0){if(endpoint.isFormData&&payload instanceof FormData)body=payload;else if(Array.isArray(payload)){if(body=payload.map((item)=>item&&typeof item==="object"?convertKeysToCamelCase(item):item),!headers["content-type"])headers["content-type"]="application/json"}else if(body=endpoint.skipCamelCase?payload:convertKeysToCamelCase(payload),!headers["content-type"])headers["content-type"]="application/json"}let send=(requestHeaders)=>serverFetch2.fetch({url,method:endpoint.method,headers:requestHeaders,body}),response=await send(headers),refreshCfg=config.refresh;if(response.code===401&&refreshCfg?.enabled!==!1&&!(refreshCfg?.excludePaths??DEFAULT_REFRESH_EXCLUDED).some((p)=>endpoint.path.includes(p))){let refreshResponse=await serverFetch2.fetch({url:refreshCfg?.endpoint??"/auth/refresh",method:"POST",headers}),issued=setCookiesOf(refreshResponse);if(refreshResponse.isSuccess&&issued.length>0)applySetCookieHeaders(cookieStore,issued),response=await send({...headers,cookie:mergeCookieHeader(headers.cookie,issued)})}let setCookiesToProcess=response.rawSetCookies.length>0?response.rawSetCookies:response.headers["set-cookie"]?splitSetCookieHeader(response.headers["set-cookie"]):[];if(setCookiesToProcess.length>0)applySetCookieHeaders(cookieStore,setCookiesToProcess);let normalizedResponse=response.response;if(response.isSuccess)normalizedResponse=normalizeResponseShape(normalizedResponse);return{isSuccess:response.isSuccess,data:normalizedResponse,errors:response.errors,code:response.code,requestId:serverRequestId(response),message:response.isSuccess?void 0:response.errors?.message}}}function applySetCookieHeaders(cookieStore,setCookies){try{for(let cookie of setCookies){let[nameValue,...options]=cookie.split(";");if(!nameValue)continue;let eqIdx=nameValue.indexOf("=");if(eqIdx===-1)continue;let name=nameValue.substring(0,eqIdx).trim(),value=nameValue.substring(eqIdx+1).trim();if(!name)continue;let cookieOptions={},maxAge;for(let opt of options){let trimmed=opt.trim(),optEqIdx=trimmed.indexOf("="),optName=optEqIdx===-1?trimmed:trimmed.substring(0,optEqIdx),optValue=optEqIdx===-1?void 0:trimmed.substring(optEqIdx+1);if(!optName)continue;let optNameLower=optName.toLowerCase();if(optNameLower==="path")cookieOptions.path=optValue;else if(optNameLower==="domain")cookieOptions.domain=optValue;else if(optNameLower==="max-age")maxAge=Number(optValue),cookieOptions.maxAge=maxAge;else if(optNameLower==="expires"&&optValue)cookieOptions.expires=new Date(optValue);else if(optNameLower==="httponly")cookieOptions.httpOnly=!0;else if(optNameLower==="secure")cookieOptions.secure=!0;else if(optNameLower==="samesite")cookieOptions.sameSite=optValue}if(value===""||maxAge!==void 0&&maxAge<=0)cookieStore.delete(name);else cookieStore.set(name,value,cookieOptions)}}catch(cookieError){console.warn("[ServerFactory] Failed to process Set-Cookie headers:",cookieError instanceof Error?cookieError.message:String(cookieError))}}var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending","resubmitted"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_node_id",type:"varchar",length:100},{name:"content_fingerprint",type:"varchar",length:64,comment:"Promoted out of diff jsonb because the stale-content guard needs it as a WHERE clause. Still written into diff.entity_fingerprint for one minor, and the guard reads the column with a jsonb fallback: pre-migration rows have NULL here and without the fallback the guard silently stops guarding in-flight chains."}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected","superseded","cancelled"]},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"]},{name:"slot_index",type:"integer",notNull:!0,default:1}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb",comment:"NOT IMPLEMENTED. saveFlow persists it; startIfTriggered matches on trigger_on alone, so a field list here changes nothing. Do not author against it until onEntityWritten carries the changed columns."},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"},{name:"model_version",type:"integer",notNull:!0,default:1,comment:"1 = the legacy node/edge graph. 2 = authored step rows. Defaults to 1 so every existing row, and every flow written by an older editor, keeps the legacy reader."},{name:"max_passes",type:"integer",notNull:!0,default:3,comment:"How many times a chain may re-enter after a rejection that loops back. The author picks 1..20; the engine refuses to open a pass beyond this."}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"},{name:"kind",type:"varchar",length:20,notNull:!0,default:"approval",enumValues:["approval","revision"],comment:"A revision step is where a rejected chain sends the author. It is a real step with its own requirement row and queue card, not a gap in the chain."},{name:"approval_mode",type:"varchar",length:20,notNull:!0,default:"all_assignees",enumValues:["all_assignees","any_assignee"],comment:"Whether every assignee slot must decide or any one of them closes the step."},{name:"on_approved",type:"varchar",length:20,notNull:!0,default:"next",enumValues:["next","complete","goto_step"],comment:"Where an approval sends the chain."},{name:"on_approved_step_node_id",type:"varchar",length:100,comment:"The target when on_approved is goto_step."},{name:"on_rejected",type:"varchar",length:20,notNull:!0,default:"end",enumValues:["end","goto_step"],comment:"Where a rejection sends the chain. goto_step is the loop the author asked for: reddedilince su adima don."},{name:"on_rejected_step_node_id",type:"varchar",length:100,comment:"The target when on_rejected is goto_step."}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"},{name:"pass_no",type:"integer",notNull:!0,default:1,comment:"Which lap this chain is on."},{name:"end_reason",type:"varchar",length:50,comment:"Why the chain ended, when it did not simply complete."}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"verificationStepVerifiers",comment:"Model 2: who must decide a step. One row per assignee slot. Replaces verificationVerifierConfigs, which carried the same facts on a node that only an edge connected to a step.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"slot_index",type:"integer",notNull:!0,default:1},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["role","user","entity_author"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"role_quorum",type:"varchar",length:10,notNull:!0,default:"one",enumValues:["one","all"]},{name:"legacy_node_id",type:"varchar",length:100,comment:"The old verifier node id, kept on flows converted from model 1 so a historical chain can still be explained."}],indexes:[{columns:["flow_id"]},{columns:["flow_id","step_node_id"]},{columns:["flow_id","step_node_id","slot_index"],unique:!0},{columns:["verifier_role"]},{columns:["verifier_user_id"]}]},{table_name:"verificationActions",comment:"Model 2: what happens, and when. One row per action. Sending a notification is one action_type; the column exists so a new one is a registration rather than a migration.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,comment:"NULL means flow scope. The trigger decides the scope and saveFlow asserts the two agree."},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed","on_flow_rejected","on_resubmitted"]},{name:"action_type",type:"varchar",length:50,notNull:!0,default:"notify"},{name:"action_order",type:"integer",notNull:!0,default:1},{name:"is_enabled",type:"boolean",notNull:!0,default:!0},{name:"fires_on_pass",type:"varchar",length:10,notNull:!0,default:"every",enumValues:["every","first","repeat"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"config",type:"jsonb",comment:"A new action type's own knobs. Anything publish validates or a human reads gets its own column instead."}],indexes:[{columns:["flow_id","trigger"]},{columns:["flow_id","step_node_id"]},{columns:["action_type"]}]},{table_name:"verificationActionRecipients",comment:"Model 2: who an action reaches. Many rows per action, which the model-1 path could not express.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["action_id"]},{columns:["recipient_type"]}]},{table_name:"verificationActionChannels",comment:"Model 2: how an action is delivered. A channel the install cannot deliver on is refused in the editor rather than dropped in silence at send time.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"action_id",type:"uuid",notNull:!0,references:{table:"verificationActions",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["action_id"]},{columns:["action_id","channel"],unique:!0}]},{table_name:"verificationPasses",comment:"Model 2: the loop's audit spine. One row per lap, so a regulator can tell lap 1 from lap 2 and see which bytes each lap's signatures were given for.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"pass_no",type:"integer",notNull:!0},{name:"opened_at",type:"timestamptz",notNull:!0,default:"now()"},{name:"opened_from_step_node_id",type:"varchar",length:100,comment:"NULL on pass 1."},{name:"opened_by",type:"uuid",comment:"The reviewer whose rejection opened this pass."},{name:"opened_fingerprint",type:"varchar",length:64,comment:"Content at the moment of the rejection. Refuses a no-op resubmit while the author can still act on it."},{name:"baseline_fingerprint",type:"varchar",length:64,comment:"The bytes this pass's signatures are given for. Re-set on resubmit."},{name:"closed_at",type:"timestamptz"},{name:"outcome",type:"varchar",length:20,enumValues:["looped","approved","rejected","cancelled"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","pass_no"],unique:!0}]},{table_name:"verificationActionRuns",comment:"Model 2: what was actually sent. 'Did the reviewer get told' is unanswerable today; a delivery that failed and one that was skipped read identically.",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"action_id",type:"uuid",comment:"Nullable: a legacy model-1 rule has no action row."},{name:"pass_no",type:"integer",notNull:!0,default:1},{name:"step_order",type:"integer"},{name:"trigger",type:"varchar",length:50,notNull:!0},{name:"action_type",type:"varchar",length:50,notNull:!0},{name:"outcome",type:"varchar",length:20,notNull:!0,enumValues:["sent","skipped","failed","dropped"]},{name:"detail",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["action_id"]},{columns:["outcome"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];import{batch as batch2,createStore as createStore2}from"h-state";var initialState={connection:{status:"disconnected",clientId:null,subscribedTopics:[],error:null,reconnectAttempt:0},events:[],maxEvents:100},{useStore:usePubSubStore}=createStore2(initialState,{setConnectionStatus:(store)=>(status)=>{store.connection.status=status},setClientId:(store)=>(clientId)=>{store.connection.clientId=clientId},setSubscribedTopics:(store)=>(topics)=>{store.connection.subscribedTopics=topics},setError:(store)=>(error)=>{store.connection.error=error},setReconnectAttempt:(store)=>(attempt)=>{store.connection.reconnectAttempt=attempt},addEvent:(store)=>(event)=>{let updated=[event,...store.events];store.events=updated.slice(0,store.maxEvents)},clearEvents:(store)=>()=>{store.events=[]},reset:(store)=>()=>{batch2(()=>{store.connection.status="disconnected",store.connection.clientId=null,store.connection.subscribedTopics=[],store.connection.error=null,store.connection.reconnectAttempt=0,store.events=[]})}});import{useEffect}from"react";var SYNTHESIZED_AUTH_HEADER="x-nucleus-auth-synthesized";function sessionEndedByProxy(response){return response.status===401&&response.headers.get("x-nucleus-auth-synthesized")==="session-ended"}var WINDOW_EVENTS=["online","focus","pageshow"];function armReturnListeners(env,onReturn){let fired=!1,timer=null,setTimer=env.setTimeout??((fn,ms)=>{let handle=setTimeout(fn,ms);return handle.unref?.(),handle}),clearTimer=env.clearTimeout??((h)=>clearTimeout(h)),disarm=()=>{for(let type of WINDOW_EVENTS)env.window.removeEventListener(type,check);if(env.document.removeEventListener("visibilitychange",check),timer!==null)clearTimer(timer),timer=null};function fire(){if(fired)return;fired=!0,disarm(),onReturn()}function check(){if(fired)return;if(env.document.visibilityState==="hidden")return;if(env.navigator?.onLine===!1)return;fire()}for(let type of WINDOW_EVENTS)env.window.addEventListener(type,check);return env.document.addEventListener("visibilitychange",check),timer=setTimer(fire,120000),()=>{fired=!0,disarm()}}function buildWsUrl(config){let path=config.wsPath||"/api/events/subscribe",topics=(config.topics||["*"]).join(","),query=`?userId=${encodeURIComponent(config.userId)}&topics=${encodeURIComponent(topics)}`;if(config.wsUrl)return`${config.wsUrl.replace(/\/$/,"")}${path}${query}`;if(typeof window>"u")return"";return`${window.location.protocol==="https:"?"wss:":"ws:"}//${window.location.host}${path}${query}`}var connections=new Map,eventIdCounter=0;function log(conn,...args){if(conn.options.debug)console.log("[usePubSub]",...args)}function clearTimers(conn){if(conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout),conn.reconnectTimeout=null;if(conn.stopWaitingForReturn)conn.stopWaitingForReturn(),conn.stopWaitingForReturn=null}function detachSocket(conn){let ws=conn.ws;if(!ws)return;if(ws.onopen=null,ws.onmessage=null,ws.onerror=null,ws.onclose=null,ws.readyState===WebSocket.OPEN||ws.readyState===WebSocket.CONNECTING)ws.close();conn.ws=null}function startHeartbeat(conn){if(conn.heartbeat)clearInterval(conn.heartbeat);conn.heartbeat=setInterval(()=>{if(conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ping"}))},conn.options.heartbeatInterval)}var HANDSHAKE_FAILURE_LIMIT=3;async function confirmSessionThenDecide(conn){let path=conn.options.sessionProbePath;if(!path){log(conn,"Handshake failing; no probe configured, continuing to reconnect"),conn.handshakeFailures=0,scheduleReconnect(conn);return}try{let res=await fetch(path,{credentials:"include",method:"GET"});if(res.status===401||res.status===403)if(res.headers.get(SYNTHESIZED_AUTH_HEADER)&&!sessionEndedByProxy(res))log(conn,"Probe 401 came from the proxy, not the API; treating as a network problem");else{conn.dispatch.setConnectionStatus("unauthorized"),conn.dispatch.setError(Error("Session is no longer valid")),log(conn,`Session probe says ${res.status}; not retrying`),waitForReturn(conn);return}else log(conn,`Session probe says ${res.status}; the session is fine, retrying`)}catch{log(conn,"Session probe could not be made; treating as a network problem")}conn.handshakeFailures=0,scheduleReconnect(conn)}function waitForReturn(conn){if(typeof window>"u"||typeof document>"u")return;if(connections.get(conn.url)!==conn)return;if(conn.stopWaitingForReturn)return;conn.stopWaitingForReturn=armReturnListeners({window,document,navigator:typeof navigator>"u"?void 0:navigator},()=>{if(connections.get(conn.url)!==conn)return;conn.stopWaitingForReturn=null,conn.reconnectAttempt=0,conn.handshakeFailures=0,log(conn,"Network or tab came back; reconnecting"),openSocket(conn)})}function scheduleReconnect(conn){if(!conn.options.autoReconnect)return;if(connections.get(conn.url)!==conn)return;if(conn.reconnectAttempt>=conn.options.maxReconnectAttempts){conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setError(Error("Max reconnection attempts reached")),log(conn,"Max reconnect attempts reached; waiting for network or tab to return"),waitForReturn(conn);return}let delay=Math.min(conn.options.reconnectBaseDelay*2**conn.reconnectAttempt,conn.options.reconnectMaxDelay);if(conn.reconnectAttempt+=1,conn.dispatch.setConnectionStatus("reconnecting"),conn.dispatch.setReconnectAttempt(conn.reconnectAttempt),log(conn,`Reconnecting in ${delay}ms (attempt ${conn.reconnectAttempt})`),conn.reconnectTimeout)clearTimeout(conn.reconnectTimeout);conn.reconnectTimeout=setTimeout(()=>{if(connections.get(conn.url)===conn)openSocket(conn)},delay)}function handleMessage(conn,raw){let message;try{message=JSON.parse(raw)}catch{log(conn,"Failed to parse message");return}switch(message.type){case"connected":conn.reconnectAttempt=0,conn.handshakeFailures=0,conn.dispatch.setConnectionStatus("connected"),conn.dispatch.setClientId(message.clientId),conn.dispatch.setSubscribedTopics(message.subscribedTopics),conn.dispatch.setReconnectAttempt(0),conn.dispatch.setError(null),log(conn,"Connected, clientId:",message.clientId);break;case"subscribed":conn.dispatch.setSubscribedTopics(message.topics),log(conn,"Subscribed to:",message.topics);break;case"event":{if(conn.dispatch.addEvent({id:`evt_${Date.now()}_${eventIdCounter++}`,topic:message.topic,data:message.data,timestamp:message.timestamp,receivedAt:Date.now(),messageId:message.messageId,isRedelivery:message.isRedelivery}),message.messageId&&conn.ws?.readyState===WebSocket.OPEN)conn.ws.send(JSON.stringify({type:"ack",messageId:message.messageId}));break}case"pong":break;case"error":conn.dispatch.setError(Error(message.error)),log(conn,"Server error:",message.error);break}}function openSocket(conn){if(conn.ws?.readyState===WebSocket.OPEN||conn.ws?.readyState===WebSocket.CONNECTING)return;detachSocket(conn),conn.dispatch.setConnectionStatus("connecting"),conn.dispatch.setError(null),log(conn,"Connecting to:",conn.url);let ws=new WebSocket(conn.url);conn.ws=ws;let opened=!1;ws.onopen=()=>{log(conn,"WebSocket opened"),opened=!0,startHeartbeat(conn)},ws.onmessage=(event)=>handleMessage(conn,event.data),ws.onerror=()=>{log(conn,"WebSocket error"),conn.dispatch.setError(Error("WebSocket connection error"))},ws.onclose=(event)=>{if(log(conn,"WebSocket closed",event.code,event.reason),conn.heartbeat)clearInterval(conn.heartbeat),conn.heartbeat=null;if(conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null),connections.get(conn.url)!==conn)return;if(event.code===4001){log(conn,"Handshake bearer refused (4001); asking whether the session is still valid"),confirmSessionThenDecide(conn);return}if(!opened){if(conn.handshakeFailures+=1,conn.handshakeFailures>=HANDSHAKE_FAILURE_LIMIT){confirmSessionThenDecide(conn);return}}else conn.handshakeFailures=0;scheduleReconnect(conn)}}function acquire(url,dispatch,options){let conn=connections.get(url);if(!conn)conn={url,ws:null,refCount:0,reconnectAttempt:0,handshakeFailures:0,stopWaitingForReturn:null,heartbeat:null,reconnectTimeout:null,dispatch,options},connections.set(url,conn);else conn.dispatch=dispatch,conn.options=options;conn.refCount+=1,openSocket(conn)}function release(url){let conn=connections.get(url);if(!conn)return;if(conn.refCount-=1,conn.refCount>0)return;connections.delete(url),clearTimers(conn),detachSocket(conn),conn.dispatch.setConnectionStatus("disconnected"),conn.dispatch.setClientId(null)}function send(url,payload){let ws=connections.get(url)?.ws;if(ws?.readyState===WebSocket.OPEN)ws.send(JSON.stringify(payload))}function usePubSub(config){let store=usePubSubStore(),url=config.userId?buildWsUrl(config):"";return useEffect(()=>{if(!url)return;let dispatch={setConnectionStatus:store.setConnectionStatus,setClientId:store.setClientId,setSubscribedTopics:store.setSubscribedTopics,setError:store.setError,setReconnectAttempt:store.setReconnectAttempt,addEvent:store.addEvent},options={autoReconnect:config.autoReconnect??!0,maxReconnectAttempts:config.maxReconnectAttempts??10,sessionProbePath:config.sessionProbePath??"/auth/me",reconnectBaseDelay:config.reconnectBaseDelay??1000,reconnectMaxDelay:config.reconnectMaxDelay??30000,heartbeatInterval:config.heartbeatInterval??30000,debug:config.debug??!1};return acquire(url,dispatch,options),()=>release(url)},[url]),{isConnected:store.connection.status==="connected",isConnecting:store.connection.status==="connecting"||store.connection.status==="reconnecting",sessionExpired:store.connection.status==="unauthorized",clientId:store.connection.clientId,subscribedTopics:store.connection.subscribedTopics,events:store.events,error:store.connection.error,reconnectAttempt:store.connection.reconnectAttempt,connect:()=>{let conn=connections.get(url);if(conn)openSocket(conn)},disconnect:()=>release(url),subscribe:(topics)=>send(url,{type:"subscribe",topics}),unsubscribe:(topics)=>send(url,{type:"unsubscribe",topics}),clearEvents:store.clearEvents,getEventsByTopic:(topic)=>store.events.filter((e)=>e.topic===topic)}}function createRateWindow(windowMs=5000){let samples=[];return{push(at,bytes){let last=samples[samples.length-1];if(last&&at<=last.at){last.bytes=Math.max(last.bytes,bytes);return}samples.push({at,bytes});let cutoff=at-windowMs;while(samples.length>2&&samples[0].at<cutoff)samples.shift()},ratePerSecond(){if(samples.length<2)return null;let first=samples[0],last=samples[samples.length-1],spanMs=last.at-first.at;if(spanMs<700)return null;let delta=last.bytes-first.bytes;if(delta<=0)return null;return delta*1000/spanMs},reset(){samples.length=0}}}function uploadFraction(sentBytes,totalBytes){if(totalBytes===null||totalBytes<=0)return null;return Math.min(1,Math.max(0,sentBytes/totalBytes))}function uploadPercent(sentBytes,totalBytes){let fraction=uploadFraction(sentBytes,totalBytes);if(fraction===null)return null;if(fraction>=1)return 100;return Math.min(99,Math.floor(fraction*100))}function secondsRemaining(sentBytes,totalBytes,bytesPerSecond){if(totalBytes===null||totalBytes<=0)return null;let left=totalBytes-sentBytes;if(left<=0)return 0;if(bytesPerSecond===null||bytesPerSecond<=0)return null;return left/bytesPerSecond}function buildProgress(params){let{sentBytes,totalBytes,startedAt,now,window:window2,retrying=!1}=params;window2.push(now,sentBytes);let bytesPerSecond=window2.ratePerSecond();return{sentBytes,totalBytes,fraction:uploadFraction(sentBytes,totalBytes),percent:uploadPercent(sentBytes,totalBytes),bytesPerSecond,secondsRemaining:secondsRemaining(sentBytes,totalBytes,bytesPerSecond),elapsedMs:Math.max(0,now-startedAt),retrying}}var MIN_REPORT_INTERVAL_MS=120;function uploadWithProgress(body,options){let xhr=options.createRequest?options.createRequest():new XMLHttpRequest,window2=createRateWindow(),startedAt=Date.now(),lastReportAt=0,settled=!1,lastSent=0,lastTotal=null,report=(sentBytes,totalBytes,force)=>{if(!options.onProgress)return;let now=Date.now();if(!force&&now-lastReportAt<MIN_REPORT_INTERVAL_MS)return;lastReportAt=now,options.onProgress(buildProgress({sentBytes,totalBytes,startedAt,now,window:window2}))};return{done:new Promise((resolve)=>{let settle=(outcome)=>{if(settled)return;settled=!0,resolve(outcome)};xhr.open("POST",options.url,!0),xhr.withCredentials=options.withCredentials!==!1;for(let[key,value]of Object.entries(options.headers??{}))xhr.setRequestHeader(key,value);if(options.timeoutMs)xhr.timeout=options.timeoutMs;xhr.upload.onprogress=(event)=>{lastSent=event.loaded,lastTotal=event.lengthComputable?event.total:null,report(lastSent,lastTotal,!1)},xhr.upload.onload=()=>{report(lastTotal??lastSent,lastTotal,!0)},xhr.onload=()=>{let parsed=null;try{parsed=xhr.responseText?JSON.parse(xhr.responseText):null}catch{parsed=null}if(xhr.status<200||xhr.status>=300){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||xhr.statusText||"",cancelled:!1});return}let data=options.parse?options.parse(parsed):parsed;if(data===null||data===void 0){settle({ok:!1,status:xhr.status,message:serverMessage(parsed)||"The server accepted the upload but returned nothing usable",cancelled:!1});return}settle({ok:!0,data})},xhr.onerror=()=>{settle({ok:!1,status:null,message:"The upload could not reach the server",cancelled:!1})},xhr.ontimeout=()=>{settle({ok:!1,status:null,message:"The upload timed out",cancelled:!1})},xhr.onabort=()=>{settle({ok:!1,status:null,message:"",cancelled:!0})},xhr.send(body)}),abort:()=>{xhr.abort()}}}function serverMessage(parsed){if(!parsed||typeof parsed!=="object")return"";let body=parsed;for(let key of["message","error","detail"]){let value=body[key];if(typeof value==="string"&&value)return value}return""}import{useCallback,useRef,useState}from"react";function useUpload(options){let[progress,setProgress]=useState(null),[uploading,setUploading]=useState(!1),[outcome,setOutcome]=useState(null),handleRef=useRef(null),optionsRef=useRef(options);optionsRef.current=options;let runId=useRef(0),cancel=useCallback(()=>{handleRef.current?.abort(),handleRef.current=null},[]),reset=useCallback(()=>{setProgress(null),setOutcome(null)},[]),start=useCallback(async(body,overrides)=>{handleRef.current?.abort();let id=++runId.current;setUploading(!0),setOutcome(null),setProgress(null);let merged={...optionsRef.current,...overrides},handle=uploadWithProgress(body,{...merged,onProgress:(p)=>{if(id!==runId.current)return;setProgress(p),merged.onProgress?.(p)}});handleRef.current=handle;let result=await handle.done;if(id!==runId.current)return result;return handleRef.current=null,setUploading(!1),setOutcome(result),result},[]);return{progress,uploading,outcome,start,cancel,reset}}import{createHash as createHash8,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and35,desc as desc7,eq as eq75,lt as lt3,ne as ne7,sql as sql15}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_activeGrants();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();init_redactSecrets();var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column:column2}of ownership){let columns=required.get(table)??new Set;columns.add(column2),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column2 of columns){let entry=perTable.get(column2)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column2)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column2,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column2,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column:column2,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and13,eq as eq17,inArray as inArray4,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq17(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and13(inArray4(getCol(participants,"conversationId"),conversationIds),eq17(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and15,desc as desc3,eq as eq19,inArray as inArray6}from"drizzle-orm";import{and as and14,eq as eq18,inArray as inArray5}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and14(eq18(getCol(tables.participants,"conversationId"),conversationId),eq18(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray5(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq19(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq19(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq19(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and15(inArray6(getCol(tables.conversations,"id"),conversationIds),eq19(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray6(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq19(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq19(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and16,desc as desc4,eq as eq20,inArray as inArray7,isNull as isNull3,lt,ne as ne2,sql as sql7}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null,size=fileRow.size??input.size??null,allowedTypes=ctx.config.attachments?.allowedMimeTypes??[];if(allowedTypes.length>0&&(!mimeType||!allowedTypes.includes(mimeType)))throw new ChatError("validation",`Attachment file ${input.fileId} is a ${mimeType??"unknown"} file, which this conversation does not accept`);let maxBytes=ctx.config.attachments?.maxFileSizeBytes??null;if(maxBytes!=null&&size!=null&&size>maxBytes)throw new ChatError("validation",`Attachment file ${input.fileId} is ${size} bytes, over the ${maxBytes} byte limit for attachments`);return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq20(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq20(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql7`${getCol(tables.participants,"unreadCount")} + 1`}).where(and16(eq20(getCol(tables.participants,"conversationId"),params.conversationId),ne2(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq20(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and16(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and16(eq20(getCol(tables.messages,"id"),targetMessageId),eq20(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq20(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq20(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq20(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq20(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq20(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray7(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray7(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray7(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}import{and as and17,eq as eq21,isNotNull}from"drizzle-orm";async function isVerificationSignatureFile(args){let{db,schemaTables,fileId}=args,verifications=resolveSchemaTable(schemaTables,"verifications");if(!verifications)return!1;let signatureId=verifications.signatureId;if(!signatureId)return!1;return(await db.select().from(verifications).where(and17(isNotNull(signatureId),eq21(signatureId,fileId))).limit(1)).length>0}init_SystemCollector();init_lifecycle();init_Notification();init_profileSync();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column2){return column2.default!==void 0||column2.defaultRaw!==void 0||column2.generatedAlwaysAs!==void 0||column2.generatedAlwaysAsIdentity===!0||column2.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables2,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables2){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column2 of config.columns??[]){if(builtInNames.has(column2.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column2.notNull===!0&&column2.nullable!==!0&&!hasDbDefault(column2))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column2.name,message:`"${system.table_name}.${column2.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function unhonouredIsPublicDeclarations(config){let auth=config.authentication;if(!auth)return[];let notes=[],alwaysPublic=[["authentication.sessions",auth.sessions],["authentication.passwordSet",auth.passwordSet],["authentication.webauthn",auth.webauthn],["authentication.invite",auth.invite],["authentication.register.emailVerification",auth.register?.emailVerification]];for(let[name2,feature]of alwaysPublic)if(feature?.enabled&&feature.isPublic===!1)notes.push(`${name2}.isPublic is false but these routes stay public: the flow is reached without a session`);if(auth.me?.isPublic===!0)notes.push("authentication.me.isPublic is true but /auth/me is never published as public");let sessionToken=auth.sessionToken;if(sessionToken){let named=["secret","algorithm","issuer","audience"].filter((k)=>sessionToken[k]!==void 0);if(named.length>0)notes.push(`authentication.sessionToken.${named.join("/")} is set, but the session token is an opaque id looked up in the store rather than a JWT: nothing signs or verifies it`)}return notes}function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables2,basePath,schema){return buildEntityPublicRoutes(systemTables2,basePath,schema)}function buildPublicRoutes(config,systemTables2,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables2,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/guards/service",method:"GET",source:"system"})}let notificationRoutes=[];if(config.notification?.enabled&&config.notification.endpoints?.enabled!==!1){let notificationBasePath=config.notification.endpoints?.basePath||"/notifications";notificationRoutes.push({path:`${notificationBasePath}/send/service`,method:"POST",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...notificationRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_ApiKey();init_activeGrants();init_GodminSetup();init_Middleware();async function resolveApiKeyPermissions(input){let{db,tables,userId,keyAllowedRoles,keyAllowedClaims,userData,logger:logger2}=input,roles=keyAllowedRoles;if(tables.userRoles&&tables.roles)roles=intersectPermissions(await readActiveRoleNames(db,tables,userId),keyAllowedRoles);let claims=keyAllowedClaims,claimScopes={};if(tables.userRoles&&tables.roleClaims&&tables.claims){let grants=await readActiveClaimGrants(db,tables,userId);claims=intersectPermissions(grantedActions(grants),keyAllowedClaims);let effective=new Set(claims),effectiveGrants=grants.filter((grant)=>effective.has(grant.action));if(effectiveGrants.some((grant)=>!!grant.scope)){let resolved=resolveClaimScopes(effectiveGrants,userData,logger2);if(claimScopes=resolved.claimScopes,resolved.dropped.length>0){let dropped=new Set(resolved.dropped);claims=claims.filter((action)=>!dropped.has(action))}}}roles=roles.filter((role)=>!isGodminRole(role));let narrowedRoles=keyAllowedRoles.length-roles.length,narrowedClaims=keyAllowedClaims.length-claims.length;if(narrowedRoles>0||narrowedClaims>0)logger2.debug("[AUTH] API key narrowed to its owner's active grants",{userId,narrowedRoles,narrowedClaims});return{roles,claims,claimScopes}}init_routeCollector();import{eq as eq24}from"drizzle-orm";init_types3();init_adminGuard();init_requireGodmin();init_passwordPolicy();import{eq as eq23}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId,roleLookup){if(!mayActAsGodmin(roleLookup.request))return!1;let user=(await db.select().from(usersTable).where(eq23(col7(usersTable,"id"),userId)).limit(1))[0];if(!user)return!1;let byColumn=Boolean(user.isGod),{rolesTable,userRolesTable,logger:logger2}=roleLookup,byRole=!byColumn&&(hasGodminRole(roleLookup.request)||(rolesTable&&userRolesTable?await userHasGodminRoleInDb(db,{[AUTHORIZATION_TABLE_KEYS.roles]:rolesTable,[AUTHORIZATION_TABLE_KEYS.userRoles]:userRolesTable},userId,logger2):!1));if(!byColumn&&!byRole)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var handleActivateUsers=(db,usersTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq24(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq26,inArray as inArray8}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2,godmin)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq26(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy,entry.email);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray8(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray8(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq27}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq27(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq28,inArray as inArray11}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray11(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray11(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray11(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq28(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq29}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq29(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq30}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq30(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
 `)};var handleListCohorts=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable);return{success:!0,data:{items:rows,meta:{totalItems:rows.length}}}};import{eq as eq31}from"drizzle-orm";var handleDeleteCohort=(db,usersTable,cohortsTable,logger2,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};return await db.update(usersTable).set({cohortId:null,updatedAt:new Date}).where(eq31(col7(usersTable,"cohortId"),ctx.params.id)),await db.delete(cohortsTable).where(eq31(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE",userId,summary:`Deleted cohort ${ctx.params.id}`}),{success:!0,data:null}};import{eq as eq32}from"drizzle-orm";var handleUpdateCohort=(db,usersTable,cohortsTable,godmin)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId,{...godmin,request:ctx.request}))return ctx.set.status=403,{success:!1,message:"Forbidden"};let updates={updatedAt:new Date};if(ctx.body.name!==void 0)updates.name=ctx.body.name;if(ctx.body.description!==void 0)updates.description=ctx.body.description;if(ctx.body.expiresAt!==void 0)updates.expiresAt=ctx.body.expiresAt?new Date(ctx.body.expiresAt):null;if(ctx.body.metadata!==void 0)updates.metadata=ctx.body.metadata;if(ctx.body.isActive!==void 0)updates.isActive=ctx.body.isActive;let updated=await db.update(cohortsTable).set(updates).where(eq32(col7(cohortsTable,"id"),ctx.params.id)).returning();if(updated.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};return{success:!0,data:updated[0]}};init_esm3();var CohortBodySchema=Type.Object({name:Type.String({minLength:1,maxLength:255}),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.String()),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown()))}),CohortUpdateSchema=Type.Object({name:Type.Optional(Type.String({minLength:1,maxLength:255})),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.Union([Type.String(),Type.Null()])),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown())),isActive:Type.Optional(Type.Boolean())}),BulkCreateUserItem=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),profile:Type.Optional(Type.Object({firstName:Type.Optional(Type.String()),lastName:Type.Optional(Type.String())}))}),BulkCreateSchema=Type.Object({users:Type.Optional(Type.Array(BulkCreateUserItem)),emailPrefix:Type.Optional(Type.String()),emailDomain:Type.Optional(Type.String()),sharedPassword:Type.Optional(Type.String({minLength:8})),count:Type.Optional(Type.Integer({minimum:1,maximum:500})),roleIds:Type.Optional(Type.Array(Type.String()))});function createCohortRoutes(config){let{db,logger:logger2,cohortsTable,usersTable,userRolesTable,profilesTable,basePath}=config;if(!db||!cohortsTable||!usersTable)return logger2.warn("[Cohort] Skipped \u2014 missing tables",{hasDb:!!db,hasCohortsTable:!!cohortsTable,hasUsersTable:!!usersTable}),collectRoutes();let godmin={rolesTable:config.rolesTable??null,userRolesTable:userRolesTable??null,logger:logger2},declared=[defineRoute({method:"GET",path:"/",handler:handleListCohorts(db,usersTable,cohortsTable,godmin)}),defineRoute({method:"GET",path:"/:id",handler:handleGetCohort(db,usersTable,cohortsTable,godmin)}),defineRoute({method:"POST",path:"/",body:CohortBodySchema,handler:handleCreateCohort(db,usersTable,cohortsTable,logger2,godmin)}),defineRoute({method:"PATCH",path:"/:id",body:CohortUpdateSchema,handler:handleUpdateCohort(db,usersTable,cohortsTable,godmin)}),defineRoute({method:"DELETE",path:"/:id",handler:handleDeleteCohort(db,usersTable,cohortsTable,logger2,godmin)}),defineRoute({method:"POST",path:"/:id/bulk-create",body:BulkCreateSchema,handler:handleBulkCreateUsers(config,logger2,godmin)}),defineRoute({method:"POST",path:"/:id/deactivate-users",handler:handleDeactivateUsers(db,usersTable,logger2,config.sessionsTable??null,godmin)}),defineRoute({method:"POST",path:"/:id/activate-users",handler:handleActivateUsers(db,usersTable,logger2,godmin)}),defineRoute({method:"POST",path:"/:id/delete-users",handler:handleDeleteUsers(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2,godmin)}),defineRoute({method:"GET",path:"/:id/export",handler:handleExportUsers(db,usersTable,godmin)})];return collectRoutes([{prefix:basePath,routes:declared}])}init_deviceInfo();function shouldNotifyDevice(question){if(question.isImpersonationLogin)return!1;if(!question.emailAvailable)return!1;if(question.requiresApproval)return!0;if(question.trustScore<question.lowTrustThreshold)return!0;return question.notifyOnNewDevice&&question.isNewDevice}init_sessionPools();init_routeCollector();init_storage2();init_esm3();init_routeCollector();init_adminGuard();function getUserId(request){return request.headers.get("x-user-id")}function isChatModerator(request,moderatorRoles){if(hasGodminRole(request))return!0;let roles=decodeHeaderList(request.headers.get("x-user-roles"));if(moderatorRoles.length===0)return!1;let allowed=new Set(moderatorRoles.map((role)=>role.toLowerCase()));return roles.some((role)=>allowed.has(role.toLowerCase()))}function chatErrorStatus(code){switch(code){case"forbidden":return 403;case"not_found":return 404;case"validation":return 400;case"conflict":return 409;case"disabled":return 409;default:return 400}}async function guard3(set2,logger2,fn){try{return{success:!0,data:await fn()}}catch(err){if(err instanceof ChatError)return set2.status=chatErrorStatus(err.code),{success:!1,message:err.message};return logger2.error("[Chat] Unhandled route error",{error:err instanceof Error?err.message:String(err)}),set2.status=500,{success:!1,message:"Internal server error"}}}function unauthorized(set2){return set2.status=401,{success:!1,message:"Authentication required"}}function createConversationRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations",handler:({request,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.listConversations(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0}))},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"List my conversations"}}),defineRoute({method:"POST",path:"/conversations",handler:({request,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>{if(input.type==="group"){if(!input.title)throw new ChatError("validation","A group title is required");return service.createGroup({creatorId:userId,title:input.title,description:input.description,avatarFileId:input.avatarFileId,participantIds:input.participantIds??[]})}if(!input.targetUserId)throw new ChatError("validation","targetUserId is required for a direct conversation");return service.getOrCreateDirect(userId,input.targetUserId)})},body:Type.Object({type:Type.Optional(Type.Union([Type.Literal("direct"),Type.Literal("group")])),targetUserId:Type.Optional(Type.String()),title:Type.Optional(Type.String()),description:Type.Optional(Type.String()),avatarFileId:Type.Optional(Type.String()),participantIds:Type.Optional(Type.Array(Type.String()))}),detail:{tags:["Chat"],summary:"Create or open a conversation"}}),defineRoute({method:"GET",path:"/conversations/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getConversation(params.id,userId))},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Get a conversation"}}),defineRoute({method:"POST",path:"/conversations/:id/participants",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{userIds}=body;return guard3(set2,logger2,()=>service.addParticipants(params.id,userId,userIds))},params:Type.Object({id:Type.String()}),body:Type.Object({userIds:Type.Array(Type.String())}),detail:{tags:["Chat"],summary:"Add group participants"}}),defineRoute({method:"DELETE",path:"/conversations/:id/participants/:userId",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,async()=>{return await service.removeParticipant(params.id,userId,params.userId),{removed:params.userId}})},params:Type.Object({id:Type.String(),userId:Type.String()}),detail:{tags:["Chat"],summary:"Remove a participant / leave group"}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}init_esm3();init_esm3();function FileSchema(){return Type.Object({size:Type.Number(),type:Type.String()},{format:"binary",additionalProperties:!0})}function FilesSchema(){return Type.Union([FileSchema(),Type.Array(FileSchema())])}init_routeCollector();init_storage2();var CONTENT_TYPE_SCHEMA=Type.Optional(Type.Union([Type.Literal("text"),Type.Literal("image"),Type.Literal("file"),Type.Literal("video"),Type.Literal("audio")]));function createMessageRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations/:id/messages",handler:({request,params,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getMessages({conversationId:params.id,userId,limit:query.limit?Number(query.limit):void 0,before:query.before||void 0}))},params:Type.Object({id:Type.String()}),query:Type.Object({limit:Type.Optional(Type.String()),before:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Get conversation messages (newest first)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>service.sendMessage({conversationId:params.id,senderId:userId,content:input.content,contentType:input.contentType,replyToId:input.replyToId,clientMessageId:input.clientMessageId,attachments:input.attachmentIds?.map((fileId)=>({fileId})),metadata:input.metadata}))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.Optional(Type.String()),contentType:CONTENT_TYPE_SCHEMA,replyToId:Type.Optional(Type.String()),clientMessageId:Type.Optional(Type.String()),attachmentIds:Type.Optional(Type.Array(Type.String())),metadata:Type.Optional(Type.Any())}),detail:{tags:["Chat"],summary:"Send a message (link pre-uploaded attachments)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages/upload",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);if(!deps.attachmentsAvailable)return set2.status=409,{success:!1,message:"File attachments require storage and CDN to be enabled"};let{service,schemaTables}=getService(request);return guard3(set2,logger2,async()=>{let filesTable=resolveSchemaTable(schemaTables,"files",logger2);if(!filesTable)throw new ChatError("disabled","Files table unavailable in this schema");let{data,files}=parseFormDataBody(body,deps.storageConfig);if(files.length===0)throw new ChatError("validation","At least one file is required");let{records,failed}=await persistUploadedFiles({db:deps.db,filesTable,files,storageConfig:deps.storageConfig,subFolder:"chat",userId});if(records.length===0)throw new ChatError("validation",failed[0]?.error??"File upload failed");if(deps.cdnMedia)scheduleUploadMediaProcessing(records,{storagePath:deps.storageConfig.basePath,media:deps.cdnMedia,logger:logger2});let content=typeof data.content==="string"?data.content:void 0,replyToId=typeof data.replyToId==="string"?data.replyToId:void 0,clientMessageId=typeof data.clientMessageId==="string"?data.clientMessageId:void 0;return service.sendMessage({conversationId:params.id,senderId:userId,content,replyToId,clientMessageId,attachments:records.map((record3)=>({fileId:record3.id,originalName:record3.originalName,mimeType:record3.mimeType,size:record3.size}))})})},type:"formdata",params:Type.Object({id:Type.String()}),body:Type.Object({[deps.storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[deps.storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:["Chat"],summary:"Send a message with uploaded file attachments"}}),defineRoute({method:"POST",path:"/conversations/:id/read",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{messageId}=body;return guard3(set2,logger2,()=>service.markRead(params.id,userId,messageId))},params:Type.Object({id:Type.String()}),body:Type.Object({messageId:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Mark a conversation as read"}}),defineRoute({method:"POST",path:"/conversations/:id/typing",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{isTyping}=body;return guard3(set2,logger2,async()=>{return await service.setTyping(params.id,userId,isTyping??!0),{ok:!0}})},params:Type.Object({id:Type.String()}),body:Type.Object({isTyping:Type.Optional(Type.Boolean())}),detail:{tags:["Chat"],summary:"Broadcast a typing indicator"}}),defineRoute({method:"PATCH",path:"/messages/:id",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{content}=body;return guard3(set2,logger2,()=>service.editMessage(params.id,userId,content))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.String()}),detail:{tags:["Chat"],summary:"Edit a message"}}),defineRoute({method:"DELETE",path:"/messages/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),asModerator=isChatModerator(request,deps.config.moderatorRoles??[]);return guard3(set2,logger2,async()=>{if(await service.deleteMessage(params.id,userId,asModerator),asModerator)logger2.warn("[CHAT] Message deleted by a moderator",{actorId:userId,messageId:params.id});return{deleted:params.id}})},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Delete a message",description:"Sender-only, unless the caller is godmin or holds a role from chat.moderatorRoles \u2014 then any message, and `deletionEnabled` does not apply."}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}function createChatRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,broadcaster,tenantRegistry,storageConfig,attachmentsAvailable,cdnBasePath,cdnMedia}=routeConfig,buildService=(tables)=>new ChatService({db,schemaTables:tables,config,logger:logger2,broadcaster,cdnBasePath,attachmentsAvailable,deleteStoredFile:(file)=>deleteFile(file.path,file.name,storageConfig.basePath)}),defaultService=buildService(schemaTables),deps={db,config,logger:logger2,storageConfig,attachmentsAvailable,getService:(request)=>{if(!tenantRegistry)return{service:defaultService,schemaTables};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{service:defaultService,schemaTables};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{service:defaultService,schemaTables};return{service:buildService(ctx.schemaTables),schemaTables:ctx.schemaTables}},cdnMedia},routes=collectRoutes();return routes.use(createConversationRoutes(deps)),routes.use(createMessageRoutes(deps)),logger2.info(`[Chat] Routes registered at ${config.basePath}`,{attachmentsAvailable,groupsEnabled:config.groupsEnabled}),{routes,chatService:defaultService}}init_esm3();init_routeCollector();init_godminGuard();init_helpers4();function createConfigRoutes(routeConfig){let{logger:logger2,resolvedOptions,configFilePath,basePath,onConfigUpdate,db,schemaTables,getRedis}=routeConfig,guard4=createGodminGuard2({logger:logger2,db:db??null,schemaTables,area:"config management"});logger2.info(`[ConfigManagement] Routes enabled at ${basePath}`);let declared=[defineRoute({method:"GET",path:"/",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions));return{isSuccess:!0,message:"Current running configuration",data:{config:maskSensitiveFields(configCopy),configFilePath,sections:buildSectionsMeta(resolvedOptions)}}},detail:{tags:["Config Management"],summary:"Get full running configuration",description:"Returns the full running configuration with sensitive fields masked."}}),defineRoute({method:"GET",path:"/sections",handler:()=>({isSuccess:!0,message:"Config section metadata",data:{sections:buildSectionsMeta(resolvedOptions)}}),detail:{tags:["Config Management"],summary:"List all config sections with metadata",description:"Section list is derived at runtime from the config object \u2014 no hardcoding."}}),defineRoute({method:"GET",path:"/env",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions)),declared2=scanEnvVars(configCopy),declaredNames=new Set(declared2.map((e)=>e.envName)),undeclared=scanUndeclaredEnv(declaredNames),entries=[...declared2,...undeclared],resolvedCount=entries.filter((e)=>e.resolved).length,missingCount=entries.length-resolvedCount,unrecognizedCount=undeclared.length;return{isSuccess:!0,message:`Found ${entries.length} env vars (${resolvedCount} resolved, ${missingCount} missing, ${unrecognizedCount} unrecognized)`,data:{entries,totalCount:entries.length,resolvedCount,missingCount,unrecognizedCount}}},detail:{tags:["Config Management"],summary:"Get environment variables (declared + undeclared)",description:"Surfaces both (a) DECLARED env vars \u2014 UPPER_SNAKE_CASE references found in the config tree (recognized:true) \u2014 and (b) UNDECLARED env vars actually present in process.env but not declared (recognized:false), minus Kubernetes service-link and OS/interpreter infra noise, so orphaned / junk config surfaces for cleanup. Sensitive values are masked; AI-provider *_API_KEY vars are never surfaced."}}),defineRoute({method:"GET",path:"/overrides",handler:async()=>{let redis=getRedis();if(!redis)return{isSuccess:!0,message:"Redis not available \u2014 no overrides stored",data:{overrides:null,sectionCount:0,sections:[]}};let overrides=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),sections=overrides?Object.keys(overrides).filter((k)=>{let v=overrides[k];return v!==void 0&&v!==null&&(typeof v!=="object"||Object.keys(v).length>0)}):[];return{isSuccess:!0,message:sections.length>0?`${sections.length} section override(s) stored in Redis`:"No overrides in Redis",data:{overrides:overrides?maskSensitiveFields(overrides):null,sectionCount:sections.length,sections}}},detail:{tags:["Config Management"],summary:"View Redis config overrides",description:"Returns overrides stored in Redis that will be merged on next restart."}}),defineRoute({method:"DELETE",path:"/overrides",handler:async(ctx)=>{let redis=getRedis();if(!redis)return ctx.set.status=503,{isSuccess:!1,message:"Redis not available",data:null};let existing=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),clearedSections=existing?Object.keys(existing):[];return await clearOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),logger2.info("[ConfigManagement] Redis overrides cleared",{clearedSections}),{isSuccess:!0,message:clearedSections.length>0?`Cleared ${clearedSections.length} override(s) from Redis. Restart to revert to config.json defaults.`:"No overrides to clear.",data:{message:"Redis overrides cleared",clearedSections}}},detail:{tags:["Config Management"],summary:"Clear all Redis config overrides",description:"Removes all stored overrides from Redis. Restart to revert to config.json defaults."}}),defineRoute({method:"GET",path:"/:section",handler:({params,set:set2})=>{let{section}=params;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};let sectionValue=extractSection(resolvedOptions,section),restart=isRestartRequired(section),maskedValue=sectionValue;if(typeof sectionValue==="object"&&sectionValue!==null&&!Array.isArray(sectionValue))maskedValue=maskSensitiveFields({[section]:sectionValue})[section];return{isSuccess:!0,message:`Config section: ${section}`,data:{section,config:maskedValue??null,restartRequired:restart}}},params:Type.Object({section:Type.String()}),detail:{tags:["Config Management"],summary:"Get a specific config section",description:"Returns a specific config section with sensitive fields masked."}}),defineRoute({method:"PATCH",path:"/:section",handler:async({params,body,set:set2})=>{let{section}=params,payload=body;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};if(!payload.config||typeof payload.config!=="object")return set2.status=400,{isSuccess:!1,message:'Request body must contain a "config" object',data:null};let restart=isRestartRequired(section),currentValue=extractSection(resolvedOptions,section),submitted=Array.isArray(currentValue)||currentValue===void 0||typeof currentValue==="string"||typeof currentValue==="number"||typeof currentValue==="boolean"?payload.config.value!==void 0?payload.config.value:payload.config:payload.config,incoming=restoreMaskedEchoes(section,currentValue,submitted),newValue;if(typeof currentValue==="object"&&currentValue!==null&&!Array.isArray(currentValue))newValue=deepMerge(currentValue,incoming);else newValue=incoming;if(applySectionUpdate(resolvedOptions,section,newValue),!restart)onConfigUpdate(section,newValue);let persistMethod="memory-only",persistWarning=null;if(configFilePath)try{await persistConfigToDisk(configFilePath,resolvedOptions),persistMethod="disk",logger2.info(`[ConfigManagement] Section "${section}" persisted to disk`)}catch(diskErr){let diskMsg=diskErr instanceof Error?diskErr.message:String(diskErr);logger2.warn(`[ConfigManagement] Disk persist failed: ${diskMsg}`);let redis=getRedis();if(redis)try{await persistSectionToRedis(redis,resolvedOptions.appId||"nucleus",section,newValue),persistMethod="redis",logger2.info(`[ConfigManagement] Section "${section}" persisted to Redis (disk unavailable)`)}catch(redisErr){let redisMsg=redisErr instanceof Error?redisErr.message:String(redisErr);logger2.error(`[ConfigManagement] Redis persist also failed: ${redisMsg}`),persistWarning=`Disk: ${diskMsg}. Redis: ${redisMsg}. Changes are in-memory only and will be lost on restart.`}else persistWarning=`Disk: ${diskMsg}. Redis not available. Changes are in-memory only and will be lost on restart.`}logger2.info(`[ConfigManagement] Section "${section}" updated (persist: ${persistMethod}, restart-required: ${restart})`);let updatedValue=extractSection(resolvedOptions,section),maskedUpdated=updatedValue;if(typeof updatedValue==="object"&&updatedValue!==null&&!Array.isArray(updatedValue))maskedUpdated=maskSensitiveFields({[section]:updatedValue})[section];let baseMsg=restart?`Config section "${section}" saved (${persistMethod}). Restart required for changes to take effect.`:`Config section "${section}" updated and applied (${persistMethod}).`;return{isSuccess:!0,message:persistWarning?`${baseMsg} Warning: ${persistWarning}`:baseMsg,data:{section,applied:!restart,restartRequired:restart,config:maskedUpdated}}},params:Type.Object({section:Type.String()}),body:Type.Object({config:Type.Record(Type.String(),Type.Unknown())}),detail:{tags:["Config Management"],summary:"Update a config section",description:"Deep-merges the payload into the section. Hot-reloadable sections apply immediately. Restart-required sections are saved to disk only."}}),defineRoute({method:"POST",path:"/restart",handler:({body})=>{let delayMs=body.delayMs??1000;logger2.info(`[ConfigManagement] Restart scheduled in ${delayMs}ms`);let scheduledAt=new Date().toISOString();return setTimeout(()=>{logger2.info("[ConfigManagement] Restarting process..."),process.exit(0)},delayMs),{isSuccess:!0,message:`Server restart scheduled in ${delayMs}ms`,data:{message:`Process will exit in ${delayMs}ms. Orchestrator (K8s/PM2/systemd) will restart it.`,scheduledAt}}},body:Type.Optional(Type.Object({delayMs:Type.Optional(Type.Number())})),detail:{tags:["Config Management"],summary:"Restart the server process",description:"Triggers a graceful process exit after a configurable delay. The orchestrator (K8s, PM2, systemd) is expected to restart the process automatically."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}init_routeMount();init_esm3();init_routeCollector();init_adminGuard();var requireAuth=(ctx)=>ctx.request.headers.get("x-user-id"),fail=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin=(ctx)=>hasGodminRole(ctx.request),ownsHostname=(ctx,record3)=>{if(isGodmin(ctx))return!0;let caller=callerSchemaOf(ctx);return record3.schemaName!=null&&record3.schemaName===caller};function createHostnameRoutes(config){let base=config.basePath,declared=[defineRoute({method:"POST",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let body=ctx.body,callerSchema=callerSchemaOf(ctx),schemaName=body.schemaName??null,tenantId=body.tenantId??null;if(!hasGodminRole(ctx.request)){if(schemaName&&schemaName!==callerSchema)return fail(ctx,403,"Cannot bind a hostname to another tenant's schema");schemaName=callerSchema;let ownTenantId=config.resolveTenantIdForSchema?.(callerSchema)??null;if(tenantId&&tenantId!==ownTenantId)return fail(ctx,403,"Cannot bind a hostname to another tenant");tenantId=ownTenantId}try{let result=await service.createHostname({hostname:body.hostname,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,schemaName,isPrimary:body.isPrimary});return{success:!0,message:"Custom hostname created",data:{hostname:result.hostname,instructions:result.instructions}}}catch(err){return fail(ctx,400,err instanceof Error?err.message:"Failed to create hostname")}},body:Type.Object({hostname:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),schemaName:Type.Optional(Type.String()),isPrimary:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Create custom hostname"}}),defineRoute({method:"GET",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin(ctx))items=await service.listHostnames({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let ownTenantId=config.resolveTenantIdForSchema?.(callerSchemaOf(ctx))??null;items=ownTenantId?await service.listHostnames({tenantId:ownTenantId}):[]}return{success:!0,message:`Found ${items.length} hostnames`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let record3=await service.getHostname(ctx.params.id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"Hostname found",data:record3}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id/instructions`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"DNS instructions",data:{instructions:await service.getInstructions(id)}}}})],svc=(ctx)=>{let s=config.getDomainService();if(!s)return ctx.set.status=503,null;return s},lifecycle2=(suffix,run,summary)=>{declared.push(defineRoute({method:"POST",path:`${base}/hostnames/:id/${suffix}`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");try{let data=await run(service,id);if(!data)return fail(ctx,404,"Hostname not found");return{success:!0,message:summary,data}}catch(err){return fail(ctx,400,err instanceof Error?err.message:summary)}}}))};return lifecycle2("verify",(s,id)=>s.verifyHostname(id),"Verification processed"),lifecycle2("activate",(s,id)=>s.activateHostname(id),"Hostname activated"),lifecycle2("disable",(s,id)=>s.disableHostname(id),"Hostname disabled"),lifecycle2("make-primary",(s,id)=>s.makePrimary(id),"Primary hostname set"),lifecycle2("refresh-status",(s,id)=>s.refreshStatus(id),"Status refreshed"),collectRoutes([{routes:declared}])}init_esm3();init_routeCollector();init_adminGuard();var requireAuth2=(ctx)=>ctx.request.headers.get("x-user-id"),fail2=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf2=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin2=(ctx)=>hasGodminRole(ctx.request);function createRegistrationRoutes(config){let base=config.basePath,svc=(ctx)=>{let s=config.getRegistrationService();if(!s)return ctx.set.status=503,null;return s},ownTenantId=(ctx)=>config.resolveTenantIdForSchema?.(callerSchemaOf2(ctx))??null,ownsRegistration=(ctx,record3)=>{if(isGodmin2(ctx))return!0;let own=ownTenantId(ctx);return record3.tenantId!=null&&own!=null&&record3.tenantId===own},declared=[defineRoute({method:"POST",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let body=ctx.body,tenantId=body.tenantId??null,registrantOwnerType=body.registrantOwnerType;if(!isGodmin2(ctx)){let own=ownTenantId(ctx);if(tenantId&&tenantId!==own)return fail2(ctx,403,"Cannot register a domain for another tenant");if(tenantId=own,registrantOwnerType==="platform")return fail2(ctx,403,"Only a platform admin may register as 'platform'");registrantOwnerType="customer"}try{return{success:!0,message:"Registration requested",data:await service.createRequest({requestedDomain:body.requestedDomain,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,registrantOwnerType,termsVersion:body.termsVersion,termsAccepted:body.termsAccepted,autoRenew:body.autoRenew})}}catch(err){return fail2(ctx,400,err instanceof Error?err.message:"Failed to request registration")}},body:Type.Object({requestedDomain:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),registrantOwnerType:Type.Optional(Type.Union([Type.Literal("customer"),Type.Literal("platform")])),termsVersion:Type.String(),termsAccepted:Type.Boolean(),autoRenew:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Request managed domain registration"}}),defineRoute({method:"GET",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin2(ctx))items=await service.listRegistrations({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let own=ownTenantId(ctx);items=own?await service.listRegistrations({tenantId:own}):[]}return{success:!0,message:`Found ${items.length} registrations`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/registrations/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let record3=await service.getRegistration(ctx.params.id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration found",data:record3}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/cancel`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let cancelled=await service.cancel(id);if(!cancelled)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration cancelled",data:cancelled}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/transfer-out`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let out=await service.requestTransferOut(id);if(!out)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Transfer-out requested",data:out}}})];return collectRoutes([{routes:declared}])}init_routeCollector();function createResolveRoute(config){let base=config.basePath,declared=[defineRoute({method:"GET",path:`${base}/resolve`,isPublic:!0,handler:async(ctx)=>{let service=config.getDomainService();if(!service)return ctx.set.status=503,{success:!1,message:"Domains not available",data:null};let hostname=new URL(ctx.request.url).searchParams.get("hostname")||ctx.request.headers.get("host")||"";if(!hostname)return ctx.set.status=400,{success:!1,message:"hostname is required",data:null};let match=await service.resolveHostname(hostname);if(!match)return ctx.set.status=404,{success:!1,message:"No active hostname matched",data:null};return{success:!0,message:"Resolved",data:match}},detail:{tags:["Domains"],summary:"Resolve hostname to tenant",description:"Public."}})];return collectRoutes([{routes:declared}])}function createDomainRoutes(app,config){return useRoutes(app,createResolveRoute(config)),useRoutes(app,createHostnameRoutes(config)),useRoutes(app,createRegistrationRoutes(config)),app}init_esm3();import{and as and22,arrayContains,arrayOverlaps,asc as asc2,createTableRelationsHelpers,desc as desc5,eq as eq36,getTableName,gt,gte,ilike,inArray as inArray14,isNotNull as isNotNull2,isNull as isNull5,like,lt as lt2,lte,ne as ne4,notInArray,or as or5,sql as sql9}from"drizzle-orm";import{drizzle}from"drizzle-orm/node-postgres";init_AccountLink();init_Authorization();init_routeMount();init_utils5();init_revokeUserSessions();function decideRoleAssign(params){let{callerIsGod,callerRoleNames,allowRoles,targetRoleName,subjectIsGodmin,godminRoleName}=params,callerIsGodmin=callerIsGod||callerRoleNames.includes(godminRoleName);if(!(callerIsGodmin||callerRoleNames.some((name2)=>allowRoles.includes(name2))))return{allowed:!1,status:403,reason:"not_privileged"};if(targetRoleName===godminRoleName&&!callerIsGodmin)return{allowed:!1,status:403,reason:"godmin_assignment_forbidden"};if(subjectIsGodmin&&!callerIsGodmin)return{allowed:!1,status:403,reason:"target_is_godmin"};return{allowed:!0,callerIsGodmin}}var ROLE_ASSIGN_REFUSALS={not_privileged:"You are not allowed to assign roles.",godmin_assignment_forbidden:"Only a system administrator can grant this role.",target_is_godmin:"This person\u2019s roles can only be changed by a system administrator."};init_adminGuard();init_apiKeyCeiling();init_sensitiveColumns();var snakeToCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SENSITIVE_SYSTEM_TABLE_SNAKE=["domain_hostnames","domain_registrations","domain_provider_records","domain_verification_challenges","domain_events","payment_sub_merchants","payment_invoices","payment_subscriptions","payment_customers","payment_transactions","payment_methods","payment_products","payment_prices","payment_commission_splits","payment_splits","payment_reserves","payment_ledger_entries","payment_payout_requests","payment_settlement_policies","payment_disputes","payment_webhook_logs","verifications","verification_requirements","verification_instances","verification_flows","verification_steps","verification_edges","verification_verifier_configs","verification_notification_rules","verification_notification_recipients","verification_notification_channels","verification_step_verifiers","verification_actions","verification_action_recipients","verification_action_channels","verification_passes","verification_action_runs","api_keys","magic_link_tokens","user_sessions","trusted_devices","integration_sources","integration_endpoints","integration_mappings"],SENSITIVE_SYSTEM_TABLES=new Set(SENSITIVE_SYSTEM_TABLE_SNAKE.flatMap((name2)=>[name2,snakeToCamel2(name2)]));function isSensitiveSystemTable(tableName){return SENSITIVE_SYSTEM_TABLES.has(tableName)}init_sessionOnly();function delegatedWriteRoles(question){if(question.isRbacTable)return new Set;let roles=(question.featureSet??[]).flatMap((feature)=>question.featureAdminRoles?.[feature]??[]);return new Set(roles.map((role)=>role.toLowerCase()))}function isFeatureAdmin(question){let allowed=delegatedWriteRoles(question);if(allowed.size===0)return!1;return question.callerRoles.some((role)=>allowed.has(role.toLowerCase()))}init_storage2();import{and as and20,eq as eq34,inArray as inArray12}from"drizzle-orm";async function activeVerificationExists(db,schemaTables,entityName,entityId){let instancesTable=schemaTables.verificationInstances;if(!instancesTable)return!1;let cols=instancesTable;if(!cols.entityName||!cols.entityId||!cols.status)return!1;try{return(await db.select().from(instancesTable).where(and20(inArray12(cols.entityName,bothSpellings(entityName)),eq34(cols.entityId,entityId),eq34(cols.status,"active"))).limit(1)).length>0}catch{return!1}}async function verifierAwaitedByVerification(db,schemaTables,who){if(!who.role&&!who.userId)return!1;let{verificationRequirements:reqTable,verificationInstances:instTable}=schemaTables;if(!reqTable||!instTable)return!1;let r=reqTable,i=instTable;if(!r.status||!i.status||!i.id||!r.instanceId)return!1;try{let match=who.role?eq34(r.verifierRole,who.role):eq34(r.verifierUserId,who.userId);if(who.role&&!r.verifierRole)return!1;if(who.userId&&!r.verifierUserId)return!1;return(await db.select().from(reqTable).innerJoin(instTable,eq34(r.instanceId,i.id)).where(and20(eq34(r.status,"pending"),eq34(i.status,"active"),match)).limit(1)).length>0}catch{return!1}}async function assignmentAwaitedByVerification(db,schemaTables,assignment){let{verificationRequirements:reqTable,verificationInstances:instTable,userRoles:userRolesTable,roles:rolesTable}=schemaTables;if(!reqTable||!instTable)return!1;let r=reqTable,i=instTable;if(!r.status||!i.status||!i.id||!r.instanceId)return!1;if(!r.verifierRole)return!1;try{if(r.verifierUserId){if((await db.select().from(reqTable).innerJoin(instTable,eq34(r.instanceId,i.id)).where(and20(eq34(r.status,"pending"),eq34(i.status,"active"),eq34(r.verifierUserId,assignment.userId),eq34(r.verifierRole,assignment.roleName))).limit(1)).length>0)return!0}if((await db.select().from(reqTable).innerJoin(instTable,eq34(r.instanceId,i.id)).where(and20(eq34(r.status,"pending"),eq34(i.status,"active"),eq34(r.verifierRole,assignment.roleName))).limit(1)).length===0)return!1;if(!userRolesTable||!rolesTable)return!1;let ur=userRolesTable,ro=rolesTable,usersTable=schemaTables.users,us=usersTable,base=db.select({user_id:ur.userId}).from(userRolesTable).innerJoin(rolesTable,eq34(ur.roleId,ro.id));return(await((us?.id)?base.innerJoin(usersTable,eq34(ur.userId,us.id)).where(and20(eq34(ro.name,assignment.roleName),eq34(ur.isActive,!0),eq34(ro.isActive,!0),eq34(us.isActive,!0))):base.where(and20(eq34(ro.name,assignment.roleName),eq34(ur.isActive,!0)))).limit(50)).filter((m)=>m.user_id!==assignment.userId).length===0}catch{return!1}}function isAnonymousCreate(table,payload){let rule=table.anonymous_create;if(!rule)return!1;if(rule===!0)return!0;let column2=rule.column;if(!column2)return!1;let value2=payload[column2]??payload[toCamelCase3(column2)]??payload[toSnakeCase2(column2)];return isTruthy(value2)}function isTruthy(value2){if(typeof value2==="boolean")return value2;if(typeof value2==="number")return value2!==0;if(typeof value2==="string"){let normalized=value2.trim().toLowerCase();return normalized==="true"||normalized==="1"||normalized==="yes"||normalized==="on"}return!1}function createAuditIdentity(anonymous,userId,headers){if(anonymous)return{userId:void 0,ipAddress:"anonymous",userAgent:"anonymous"};return{userId:userId||void 0,ipAddress:headers.get("x-client-ip")?.trim()||headers.get("x-forwarded-for")?.split(",")[0]?.trim()||headers.get("x-real-ip")?.trim()||"unknown",userAgent:headers.get("user-agent")||"unknown"}}function toCamelCase3(value2){return value2.replace(/_([a-z0-9])/g,(_m,c)=>c.toUpperCase())}function toSnakeCase2(value2){return value2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`)}init_types3();var CLAIMS_CACHE_SOURCES=new Set([AUTHORIZATION_TABLE_KEYS.roles,AUTHORIZATION_TABLE_KEYS.roleClaims,AUTHORIZATION_TABLE_KEYS.claims]);function isClaimsCacheSource(tableName){return CLAIMS_CACHE_SOURCES.has(tableName)}function refreshClaimsCacheAfterWrite(deps){let{tableName,claimsCache,logger:logger2}=deps;if(!claimsCache||!isClaimsCacheSource(tableName))return;claimsCache.invalidate().catch((error3)=>{logger2.error("[Entity] Claims cache rebuild failed after a write; it serves the old map",error3,{tableName})})}var snakeToCamel3=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function forceCreateScope(payload,authResult,resolveColumn){let scopeFilters=authResult?.scopeFilters;if(!scopeFilters)return{ok:!0};for(let[field,value2]of Object.entries(scopeFilters)){if(!resolveColumn(field))return{ok:!1,field};payload[snakeToCamel3(field)]=value2}return{ok:!0}}init_Authorization();init_types3();init_adminGuard();import{eq as eq35,inArray as inArray13}from"drizzle-orm";var idText=(value2)=>{if(typeof value2==="string")return value2.length>0?value2:null;if(typeof value2==="number"&&Number.isFinite(value2))return String(value2);return null},godminHolder=(row,isGodminRoleId)=>{if(!row||row.isActive===!1||row.is_active===!1)return null;let roleId=idText(row.roleId??row.role_id);if(!roleId||!isGodminRoleId(roleId))return null;return idText(row.userId??row.user_id)};function planGodFlagSync(changes,isGodminRoleId){let grant=new Set,revoke=new Set;for(let{before,after}of changes){let was=godminHolder(before,isGodminRoleId),now=godminHolder(after,isGodminRoleId);if(was===now)continue;if(was)revoke.add(was);if(now)grant.add(now)}for(let userId of grant)revoke.delete(userId);return{grant:[...grant],revoke:[...revoke]}}var column2=(table,name2)=>table[name2];async function syncGodFlags(deps,changes){let{db,schemaTables,logger:logger2}=deps,roles=schemaTables[AUTHORIZATION_TABLE_KEYS.roles],users=schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!roles||!users)return;let roleIds=new Set;for(let{before,after}of changes)for(let row of[before,after]){let roleId=idText(row?.roleId??row?.role_id);if(roleId)roleIds.add(roleId)}if(roleIds.size===0)return;try{let roleRows=await db.select({id:column2(roles,"id"),name:column2(roles,"name")}).from(roles).where(inArray13(column2(roles,"id"),[...roleIds])),godminRoleIds=new Set(roleRows.filter((role)=>typeof role.name==="string"&&isGodminRole(role.name)).map((role)=>idText(role.id)).filter((id)=>id!==null));if(godminRoleIds.size===0)return;let plan=planGodFlagSync(changes,(id)=>godminRoleIds.has(id)),setIsGod=(userId,isGod)=>db.update(users).set({isGod}).where(eq35(column2(users,"id"),userId));for(let userId of plan.grant)await setIsGod(userId,!0);for(let userId of plan.revoke){if(await userHasGodminRoleInDb(db,schemaTables,userId,logger2))continue;await setIsGod(userId,!1)}}catch(error3){logger2.error("[Entity] users.is_god could not be synced after a user_roles write",error3)}}function decideRelationExpansion(params){let{authEnabled,targetTable,relAuth,isTargetPublicGet}=params;if(!authEnabled||!targetTable)return{expand:!0};if(relAuth===null)return isTargetPublicGet?{expand:!0}:{expand:!1};if(!relAuth.authorized)return{expand:!1};let scope=relAuth.scopeFilters;if(scope&&Object.keys(scope).length>0)return{expand:!0,scope};return{expand:!0}}function resolveRelationScopeColumn(fields,key2,toCamel5){if(Object.hasOwn(fields,key2))return fields[key2];let camel=toCamel5(key2);return Object.hasOwn(fields,camel)?fields[camel]:void 0}import{and as and21,or as or4,sql as sql8}from"drizzle-orm";var MAX_SEARCH_TOKENS=10,TURKISH_LETTERS="\u0130\u0131\u015E\u015F\u011E\u011F\xDC\xFC\xD6\xF6\xC7\xE7",ASCII_EQUIVALENTS="IiSsGgUuOoCc";function searchTokens(term){return term.split(/\s+/).filter(Boolean).slice(0,MAX_SEARCH_TOKENS)}function foldForSearch(value2){let folded="";for(let character of value2){let index=TURKISH_LETTERS.indexOf(character);folded+=index===-1?character:ASCII_EQUIVALENTS[index]}return folded.toLowerCase()}function asRegexLiteral(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,(character)=>`\\${character}`)}var WORD_START="(^|[^[:alnum:]])";function folded(column3){return sql8`lower(translate(cast(${column3} as text), ${TURKISH_LETTERS}, ${ASCII_EQUIVALENTS}))`}function buildSearchCondition(columns,term){let tokens=searchTokens(term);if(tokens.length===0||columns.length===0)return null;let perToken=tokens.map((token)=>{let pattern2=`${WORD_START}${asRegexLiteral(foldForSearch(token))}`;return or4(...columns.map((column3)=>sql8`${folded(column3)} ~ ${pattern2}`))}).filter((condition)=>condition!==void 0);if(perToken.length===0)return null;return and21(...perToken)??null}init_Authorization();init_types3();function targetFromBody(body){let record3=body??{},read2=(...keys)=>{for(let key2 of keys){let value2=record3[key2];if(typeof value2==="string"&&value2.length>0)return value2}return null};return{userId:read2("userId","user_id"),roleId:read2("roleId","role_id")}}async function readRow(db,userRolesTable,rowId,logger2){try{let{eq:eq36}=await import("drizzle-orm"),columns=userRolesTable,row=(await db.select().from(userRolesTable).where(eq36(columns.id,rowId)).limit(1))[0];if(!row)return{userId:null,roleId:null};let text2=(value2)=>typeof value2==="string"&&value2.length>0?value2:null;return{userId:text2(row.userId??row.user_id),roleId:text2(row.roleId??row.role_id)}}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the user_roles row",{error:err instanceof Error?err.message:String(err)}),{userId:null,roleId:null}}}async function roleNameOf(db,rolesTable,roleId,logger2){try{let{eq:eq36}=await import("drizzle-orm"),columns=rolesTable,name2=(await db.select({name:columns.name}).from(rolesTable).where(eq36(columns.id,roleId)).limit(1))[0]?.name;return typeof name2==="string"&&name2.length>0?name2:null}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the role name",{error:err instanceof Error?err.message:String(err)}),null}}async function isGodmin3(db,userRolesTable,rolesTable,userId,logger2){try{let{eq:eq36}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq36(ur.roleId,r.id)).where(eq36(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[UserRoleWrite] Failed to check whether the subject is a godmin",{error:err instanceof Error?err.message:String(err)}),!0}}async function resolveUserRoleSubject(deps,write){let{db,schemaTables,logger:logger2}=deps,userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!db||!userRolesTable||!rolesTable)return{targetRoleName:null,subjectIsGodmin:!0};let fromBody=targetFromBody(write.body),fromRow=write.rowId?await readRow(db,userRolesTable,write.rowId,logger2):{userId:null,roleId:null},roleIds=[fromRow.roleId,fromBody.roleId].filter((id)=>Boolean(id)),userIds=[fromRow.userId,fromBody.userId].filter((id)=>Boolean(id));if(roleIds.length===0||userIds.length===0)return{targetRoleName:null,subjectIsGodmin:!0};let names2=await Promise.all(roleIds.map((id)=>roleNameOf(db,rolesTable,id,logger2)));if(names2.some((name2)=>name2===null))return{targetRoleName:null,subjectIsGodmin:!0};let readable=names2.filter((name2)=>name2!==null),targetRoleName=readable.find((name2)=>isGodminRole(name2))??readable[0]??null,godminFlags=await Promise.all(userIds.map((id)=>isGodmin3(db,userRolesTable,rolesTable,id,logger2)));return{targetRoleName,subjectIsGodmin:godminFlags.some(Boolean)}}init_esm3();function buildBodySchemaFromEntityColumns(entityColumns){let properties={};if(!entityColumns||entityColumns.length===0)return Type.Object({},{additionalProperties:!0});for(let col8 of entityColumns)switch(col8.type?.toLowerCase()||"string"){case"integer":case"int":case"serial":case"bigserial":case"numeric":case"decimal":properties[col8.name]=col8.notNull?Type.Number():Type.Optional(Type.Number());break;case"boolean":properties[col8.name]=col8.notNull?Type.Boolean():Type.Optional(Type.Boolean());break;case"timestamp":case"timestamptz":case"date":properties[col8.name]=col8.notNull?Type.String({format:"date-time"}):Type.Optional(Type.String({format:"date-time"}));break;case"json":case"jsonb":properties[col8.name]=Type.Optional(Type.Unknown());break;case"uuid":properties[col8.name]=col8.notNull?Type.String({format:"uuid"}):Type.Optional(Type.String({format:"uuid"}));break;default:properties[col8.name]=col8.notNull?Type.String():Type.Optional(Type.String())}return Type.Object(properties,{additionalProperties:!0})}function createBulkUpdateSchema(entityColumns){return Type.Array(Type.Object({id:Type.String(),data:Type.Partial(buildBodySchemaFromEntityColumns(entityColumns))}))}var MAX_BULK_ITEMS=500;function collectFilterFields(filter,out=[]){if(filter.operator==="or"||filter.operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];for(let f of group)collectFilterFields(f,out)}else if(filter.field)out.push(String(filter.field));return out}function firstUnknownField(fields,resolveCol){for(let field of fields){let trimmed=field.trim();if(trimmed!==""&&!resolveCol(trimmed))return trimmed}return null}var FILTER_OPERATORS=new Set(["eq","neq","gt","gte","lt","lte","like","ilike","in","notIn","isNull","isNotNull","arrayOverlaps","arrayContains","arrayEmpty","or","and"]);function firstUnusableCondition(filter){let operator=filter.operator;if(typeof operator!=="string"||!FILTER_OPERATORS.has(operator))return`Unknown operator in filter: ${String(operator)}`;if(operator==="or"||operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];if(group.length===0)return`Empty "${operator}" group in filter`;for(let sub of group){let unusable=firstUnusableCondition(sub);if(unusable)return unusable}return null}if(typeof filter.field!=="string"||filter.field.trim()==="")return'A filter condition needs a "field"';return null}function buildFilterCondition(filter,resolveCol){if(filter.operator==="or"||filter.operator==="and"){let subs=(Array.isArray(filter.value)?filter.value:[]).map((f)=>buildFilterCondition(f,resolveCol)).filter((c)=>c!==null);if(subs.length===0)return null;return(filter.operator==="or"?or5(...subs):and22(...subs))??null}if(!filter.field)return null;let col8=resolveCol(filter.field);if(!col8)return null;let sqlCol=col8,dataType=col8.dataType,coerce2=(v)=>dataType==="date"&&(typeof v==="string"||typeof v==="number")?new Date(v):v,columnType=col8.columnType??"",isInt4=/^Pg(Integer|Serial|SmallInt|SmallSerial)$/.test(columnType),outOfInt4=(v)=>{if(!isInt4)return!1;let n=typeof v==="number"?v:typeof v==="string"&&v.trim()!==""?Number(v):NaN;return Number.isFinite(n)&&(n>2147483647||n<-2147483648)};if(["eq","neq","gt","gte","lt","lte"].includes(filter.operator)&&outOfInt4(filter.value))return sql9`false`;if((filter.operator==="in"||filter.operator==="notIn")&&Array.isArray(filter.value)){let inRange=filter.value.filter((v)=>!outOfInt4(v));if(inRange.length===0)return filter.operator==="in"?sql9`false`:null;filter={...filter,value:inRange}}switch(filter.operator){case"eq":return eq36(sqlCol,coerce2(filter.value));case"neq":return ne4(sqlCol,coerce2(filter.value));case"gt":return gt(sqlCol,coerce2(filter.value));case"gte":return gte(sqlCol,coerce2(filter.value));case"lt":return lt2(sqlCol,coerce2(filter.value));case"lte":return lte(sqlCol,coerce2(filter.value));case"like":return like(sqlCol,filter.value);case"ilike":return ilike(sqlCol,filter.value);case"in":return inArray14(sqlCol,filter.value);case"notIn":return notInArray(sqlCol,filter.value);case"arrayOverlaps":return arrayOverlaps(sqlCol,filter.value??[]);case"arrayContains":return arrayContains(sqlCol,filter.value??[]);case"arrayEmpty":return sql9`cardinality(${sqlCol}) = 0`;case"isNull":return isNull5(sqlCol);case"isNotNull":return isNotNull2(sqlCol);default:return null}}function describeIgnoredFields(fields){if(fields.length===0)return{};let unique=[...new Set(fields)];return{ignored_fields:unique,message:`Saved. These fields were ignored because they cannot be set this way: ${unique.join(", ")}.`}}async function discardUploads(uploaded,storageBase,log4){for(let f of uploaded?.success??[])try{await deleteFile(f.path,f.name,storageBase)}catch{log4.warn(`[Entity] Could not discard ${f.path}/${f.name} after a refused request`)}}function createEntityRoutes(app,config){let{db,schemaTables,schemaRelations,entities,logger:logger2,dbPool,storage,cdnMedia,authorization,authMode,idpUrl,featureAdminRoles}=config,getRegistry=()=>config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry??null,getReqSchema=(request)=>{let tenantRegistry=getRegistry();if(!tenantRegistry)return{tables:schemaTables,relations:schemaRelations};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{tables:schemaTables,relations:schemaRelations};let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?{tables:ctx.schemaTables,relations:ctx.schemaRelations}:{tables:schemaTables,relations:schemaRelations}},storageConfig=mergeStorageConfig(storage),warmUploadedMedia=(uploaded)=>{if(!cdnMedia||!uploaded||uploaded.success.length===0)return;scheduleUploadMediaProcessing(uploaded.success,{storagePath:storageConfig.basePath,media:cdnMedia,logger:logger2})},authEnabled=authorization?.enabled??!1,enforceFieldWrites=authEnabled&&authorization?.enforceFieldWriteClaims!==!1,isConsumerMode=authMode==="consumer",filterWritePayload=(payload,authResult)=>{if(!enforceFieldWrites||!authResult?.allowedFields)return payload;return filterResponseFields(payload,authResult.allowedFields)},auditPathContext=(request)=>{let url=new URL(request.url);return{path:url.pathname,query:url.search}},auditIdentityFor=(table,payload,userId,headers)=>createAuditIdentity(isAnonymousCreate(table,payload),userId,headers),UUID_RE=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,auditEntityId=(id)=>{let s=id==null?"":String(id);return UUID_RE.test(s)?s:null},projectWrittenRow=(row,authResult)=>{let scoped2=authEnabled&&authResult?.allowedFields?filterResponseFields(row,[...authResult.allowedFields,...authResult.allowedRelations??[]]):row;return stripUnclaimedSensitive(redactSensitiveOutput(scoped2),authResult?.allowedFields)};if(!db)return app;function snakeToCamel4(s){return s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}let{entities:mergedEntities}=resolveEntities(SYSTEM_TABLES,entities),extendedByName=new Map(mergedEntities.filter((t)=>entities.some((e)=>e.table_name===t.table_name&&e.extends===!0)).map((t)=>[t.table_name,t])),effectiveEntities=entities.map((e)=>extendedByName.get(e.table_name)??e),allTables=Object.keys(schemaTables),entityTableNames=effectiveEntities.map((e)=>snakeToCamel4(e.table_name)),systemTableNames=allTables.filter((tbl)=>!entityTableNames.includes(tbl)),systemTableDefMap=new Map(SYSTEM_TABLES.map((t)=>[snakeToCamel4(t.table_name),t])),asMeta=(def)=>def??void 0,hasUnmetRequirement=(def)=>{let requires=def?.requires;if(!requires||requires.length===0)return null;for(let req of requires)if(req==="email"&&!config.isEmailServiceAvailable?.())return"email";return null},deriveGroupName=(def,fallback)=>{if(def?.group_name)return def.group_name;let primaryFeature=def?.feature_set?.[0];if(!primaryFeature)return fallback;return primaryFeature.charAt(0).toUpperCase()+primaryFeature.slice(1)},systemTables2=systemTableNames.filter((name2)=>{let unmet=hasUnmetRequirement(asMeta(systemTableDefMap.get(name2)));if(unmet)return logger2.info(`Skipping ${name2} routes - missing required dependency: ${unmet}`),!1;return!0}).map((name2)=>{let def=systemTableDefMap.get(name2),meta=asMeta(def);return{table_name:def?.table_name??name2,group_name:deriveGroupName(meta,name2),is_form_data:def?.is_form_data===!0,bulk_endpoints_enabled:def?.bulk_endpoints_enabled??!1,excluded_methods:def?.excluded_methods?[...def.excluded_methods]:[],columns:def?.columns?[...def.columns]:void 0}}),allEntities=[...effectiveEntities,...systemTables2],publicGetEntities=new Set;for(let e of allEntities)if(e.is_public?.GET===!0)publicGetEntities.add(e.table_name),publicGetEntities.add(snakeToCamel4(e.table_name));logger2.info(`All entities: ${allEntities.map((e)=>e.table_name).join(", ")}`);for(let table of allEntities){let rawTableName=table.table_name,tableName=snakeToCamel4(rawTableName),swaggerTag=table.group_name||rawTableName,writeFields=enforceFieldWrites?table.columns?.map((c)=>c.name):void 0,defaultDrizzleTable=schemaTables[tableName];if(!defaultDrizzleTable)continue;let tableRelations=schemaRelations[`${tableName}Relations`];logger2.info(`Creating routes for table: ${tableName}`);let relationTargetTable={};{let rels=tableRelations;if(rels?.table&&typeof rels?.config==="function")try{let built=rels.config(createTableRelationsHelpers(rels.table));for(let[relName,rel]of Object.entries(built))if(rel?.referencedTable)relationTargetTable[relName]=getTableName(rel.referencedTable)}catch(err){logger2.warn(`[Authorization] Could not map relations for ${tableName}`,{error:err instanceof Error?err.message:String(err)})}}let defaultTableColumns=defaultDrizzleTable,defaultIdCol=defaultTableColumns.id,database=db,drizzleTable=defaultDrizzleTable,tableColumns=defaultTableColumns,idCol=defaultIdCol,resolveCol=(field)=>{if(Object.hasOwn(tableColumns,field))return tableColumns[field];let camel=snakeToCamel4(field);return Object.hasOwn(tableColumns,camel)?tableColumns[camel]:void 0},getTableForRequest=(request)=>{if(!getRegistry())return{drizzleTable,tableColumns,idCol,resolveCol,schemaTables,schemaRelations};let reqSchema=getReqSchema(request),reqTable=reqSchema.tables[tableName]||drizzleTable,reqCols=reqTable,reqIdCol=reqCols.id;return{drizzleTable:reqTable,tableColumns:reqCols,idCol:reqIdCol,resolveCol:(field)=>{if(Object.hasOwn(reqCols,field))return reqCols[field];let camel=snakeToCamel4(field);return Object.hasOwn(reqCols,camel)?reqCols[camel]:void 0},schemaTables:reqSchema.tables,schemaRelations:reqSchema.relations}},bulkUpdateSchema=createBulkUpdateSchema(table.columns),bulkDeleteSchema=Type.Array(Type.String()),authzLog=logger2.scoped("authorization.check"),performAuthCheck=async(request,method,reqFields,reqRelations)=>{let result=await runAuthCheck(request,method,reqFields,reqRelations);if(result){let userId=request.headers.get("x-user-id"),requestId=request.headers.get("x-request-id")||void 0;if(!result.authorized)authzLog.warn(`Denied ${method} ${table.table_name}`,{requestId,userId,entity:table.table_name,method,reason:result.reason||"no reason provided",mode:isConsumerMode?idpUrl?"idp":"jwt":"local"});else if(result.scopeFilters||result.allowedFields||result.allowedRelations)authzLog.debug(`Allowed ${method} ${table.table_name} (restricted)`,{requestId,userId,entity:table.table_name,method,scopeFilters:result.scopeFilters,allowedFieldCount:result.allowedFields?.length,allowedRelations:result.allowedRelations})}return result},scopeConditionsFor=(authResult,resolveColumn)=>{if(!authEnabled||!authResult?.scopeFilters)return[];let{conditions,unresolvedFields}=buildScopeConditions(authResult.scopeFilters,resolveColumn);if(unresolvedFields.length>0)authzLog.error(`Scope references unknown column(s) on ${table.table_name}; failing closed (0 rows)`,{entity:table.table_name,unresolvedFields});return conditions},runAuthCheck=async(request,method,reqFields,reqRelations,entityName=table.table_name)=>{let userId=request.headers.get("x-user-id");if(!authEnabled||!userId)return null;if(isConsumerMode){let userClaims=decodeHeaderList(request.headers.get("x-user-claims")),userRoles=decodeHeaderList(request.headers.get("x-user-roles")),userClaimScopes=decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes"));if(idpUrl&&authorization?.jwtClaimsMode==="resolve"){let accessToken=request.headers.get("x-access-token")||(request.headers.get("cookie")||"").match(/access_token=([^;]+)/)?.[1]||"";return checkAuthorizationViaIDP({idpUrl,accessToken,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2})}return checkAuthorizationFromJWT({userClaims,userRoles,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimScopes:userClaimScopes})}let reqCtx=getTableForRequest(request);return checkAuthorization({userId,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,db:database,schemaTables:reqCtx.schemaTables,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimCeiling:apiKeyClaimCeiling(request),getUserData:async()=>{if(!database)return;let usersTbl=reqCtx.schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!usersTbl)return;let idCol2=usersTbl.id;if(!idCol2)return;return(await database.select().from(usersTbl).where(eq36(idCol2,userId)).limit(1))[0]}})},endSessionsForDeactivated=async(request,changed)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.users)return;let userIds=changed.filter((one)=>one.after?.isActive===!1&&one.before?.isActive!==!1).map((one)=>String(one.after?.id??"").trim()).filter(Boolean);if(userIds.length===0)return;let authTables=resolveAuthTablesForRequest(request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry});await revokeUserSessions({db:database,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error("[Entity] users rows were deactivated but their open sessions were not cleared",{error:error3,userIds})},userIds)},renameStrandsVerification=async(id,payload)=>{if(!database)return null;if(tableName!==AUTHORIZATION_TABLE_KEYS.roles)return null;let newName=payload.name;if(typeof newName!=="string")return null;let oldName=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0]?.name;if(typeof oldName!=="string"||oldName===newName)return null;return await verifierAwaitedByVerification(database,schemaTables,{role:oldName})?oldName:null},deactivationStrandsVerification=async(id,payload)=>{if(!database)return null;let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return null;if(payload.isActive!==!1&&payload.is_active!==!1)return null;let row=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0];if(!row)return null;if(row.isActive===!1||row.is_active===!1)return null;let who=isRoles?{role:String(row.name??"")}:{userId:id};if(isRoles&&!who.role)return null;if(!await verifierAwaitedByVerification(database,schemaTables,who))return null;return isRoles?String(row.name):String(row.email??row.name??id)},assignmentWithdrawalStrands=async(id,payload)=>{if(!database)return null;if(tableName!==AUTHORIZATION_TABLE_KEYS.userRoles)return null;if(payload&&payload.isActive!==!1&&payload.is_active!==!1)return null;let row=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0];if(!row)return null;if(payload&&(row.isActive===!1||row.is_active===!1))return null;let userId=String(row.userId??row.user_id??""),roleId=String(row.roleId??row.role_id??"");if(!userId||!roleId)return null;let rolesTable=schemaTables.roles;if(!rolesTable)return null;let roleCols=rolesTable,roleName=(await database.select().from(rolesTable).where(eq36(roleCols.id,roleId)).limit(1))[0]?.name;if(!roleName)return null;return await assignmentAwaitedByVerification(database,schemaTables,{userId,roleName:String(roleName)})?String(roleName):null},strandsVerification=async(ids)=>{if(!database)return[];let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return[];let blocked=[];for(let id of ids){let who={userId:id};if(isRoles){let name2=(await database.select().from(drizzleTable).where(eq36(idCol,id)).limit(1))[0]?.name;if(!name2)continue;who={role:String(name2)}}if(await verifierAwaitedByVerification(database,schemaTables,who))blocked.push(id)}return blocked},announceWrite=(request,operation,rows,writtenBy)=>{if(!config.onEntityWritten)return;for(let row of Array.isArray(rows)?rows:[rows]){let id=row?.id;if(!id)continue;config.onEntityWritten({entityName:tableName,entityId:String(id),operation,userId:writtenBy||void 0,request})}},refreshClaimsCache=()=>refreshClaimsCacheAfterWrite({tableName,claimsCache:config.claimsCache,logger:logger2}),syncGodFlagsAfterWrite=async(request,changes)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.userRoles||!database)return;await syncGodFlags({db:database,schemaTables:getReqSchema(request).tables,logger:logger2},changes)},declared=[],entityGuards=[],listLog=logger2.scoped("entity.list"),isRbacTable=tableName===AUTHORIZATION_TABLE_KEYS.roles||tableName===AUTHORIZATION_TABLE_KEYS.claims||tableName===AUTHORIZATION_TABLE_KEYS.roleClaims,isUserRoleTable=tableName===AUTHORIZATION_TABLE_KEYS.userRoles,roleAssignRoles=featureAdminRoles?.authorization??[];if(new Set(["verifications","verification_instances","verification_requirements","verification_passes","verification_action_runs","verificationInstances","verificationRequirements","verificationPasses","verificationActionRuns"]).has(tableName))entityGuards.push(async({request,set:set2})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;return set2.status=403,{success:!1,message:`Forbidden: '${tableName}' is written only by the verification engine. Decisions are recorded through the /verifications routes and are not editable afterwards.`}});if(tableName===AUTHORIZATION_TABLE_KEYS.users)entityGuards.push(async({request,set:set2})=>{if(request.method.toUpperCase()!=="POST")return;return set2.status=403,{success:!1,message:"Forbidden: users cannot be created through the generic entity API \u2014 it would create an account with no password. Use POST /auth/admin/create-user."}});if(isRbacTable||isUserRoleTable||isSensitiveSystemTable(tableName)){let denyMessage=isRbacTable?"Forbidden: managing roles and claims requires godmin privileges":isUserRoleTable?"Forbidden: assigning roles requires godmin privileges":`Forbidden: writing to '${tableName}' via the generic entity API requires godmin privileges \u2014 use the dedicated route`,callerIsGodminInDb=async(request)=>mayActAsGodmin(request)&&await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2);entityGuards.push(async({request,set:set2,body,params})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;if(isUserRoleTable&&isApiKeyRequest(request))return logger2.warn("[AUTH] API key refused a user_roles write",{method,keyId:request.headers.get("x-api-key-id"),userId:request.headers.get("x-user-id")}),set2.status=403,{success:!1,message:apiKeyRefusalMessage("assigning or removing roles")};if(hasGodminRole(request))return;if(isFeatureAdmin({isRbacTable:isRbacTable||isUserRoleTable,featureSet:table.feature_set,featureAdminRoles,callerRoles:decodeHeaderList(request.headers.get("x-user-roles"))}))return;if(isUserRoleTable&&roleAssignRoles.length>0){let subject=await resolveUserRoleSubject({db,schemaTables:getReqSchema(request).tables,logger:logger2},{rowId:typeof params?.id==="string"?params.id:null,body}),decision=decideRoleAssign({callerIsGod:!1,callerRoleNames:decodeHeaderList(request.headers.get("x-user-roles")),allowRoles:roleAssignRoles,targetRoleName:subject.targetRoleName??GODMIN_ROLE_NAME,subjectIsGodmin:subject.subjectIsGodmin,godminRoleName:GODMIN_ROLE_NAME});if(decision.allowed)return;if(await callerIsGodminInDb(request))return;return set2.status=403,{success:!1,reason:decision.reason,message:ROLE_ASSIGN_REFUSALS[decision.reason]}}if(await callerIsGodminInDb(request))return;return set2.status=403,{success:!1,message:denyMessage}})}if(!table.excluded_methods?.includes("GET"))declared.push(defineRoute({method:"GET",path:"/",detail:{tags:[swaggerTag],summary:`List ${tableName}`,description:`Get paginated list of ${tableName} records with filtering, sorting, and search`},handler:async(ctx)=>{if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let{drizzleTable:drizzleTable2,resolveCol:resolveCol2,schemaRelations:schemaRelations2}=getTableForRequest(ctx.request),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=Object.keys(schemaRelations2).filter((k)=>k.startsWith(`${tableName}Relations`)).map((k)=>k.replace("Relations","")),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};let fieldQueryable=(field)=>{if(isSensitiveOutputKey(field))return!1;if(!sensitiveFieldQueryable(field,{authEnabled,allowedFields:authResult?.allowedFields}))return!1;if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(field))return!1;return!0},q=parseQueryParams(ctx.query);if(q.malformed)return ctx.set.status=400,{success:!1,message:`Malformed query parameter: ${q.malformed.join(", ")} (expected a JSON array)`};let conditions=[];if(conditions.push(...scopeConditionsFor(authResult,resolveCol2)),q.search&&!q.searchFields)return ctx.set.status=400,{success:!1,message:"A 'search' needs 'searchFields' naming the columns to search, e.g. searchFields=name,email \u2014 without it the term would be ignored and every row returned."};if(q.search&&q.searchFields){for(let f of q.searchFields)if(!fieldQueryable(f.trim()))return ctx.set.status=403,{success:!1,message:`Cannot search on field: ${f.trim()}`};let unknown3=firstUnknownField(q.searchFields,resolveCol2);if(unknown3)return ctx.set.status=400,{success:!1,message:`Unknown field in search: ${unknown3}`};let searchColumns=q.searchFields.map((f)=>resolveCol2(f.trim())).filter((c)=>c!==null),searchCondition=buildSearchCondition(searchColumns,q.search);if(searchCondition)conditions.push(searchCondition)}if(Array.isArray(q.filters))for(let filter of q.filters){let referenced=collectFilterFields(filter);for(let f of referenced)if(!fieldQueryable(f))return ctx.set.status=403,{success:!1,message:`Cannot filter on field: ${f}`};let unknownFilterField=firstUnknownField(referenced,resolveCol2);if(unknownFilterField)return ctx.set.status=400,{success:!1,message:`Unknown field in filter: ${unknownFilterField}`};let unusable=firstUnusableCondition(filter);if(unusable)return ctx.set.status=400,{success:!1,message:unusable};let cond=buildFilterCondition(filter,resolveCol2);if(cond)conditions.push(cond)}let projection;if(q.select&&q.select.length>0){let requested=[...new Set(["id",...q.select.map((f)=>f.trim())])].filter(Boolean),columns={};for(let field of requested){if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot select field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in select: ${field}`};columns[field]=col8}if(Object.keys(columns).length>0)projection=columns}let unprojected=database.select().from(drizzleTable2),baseQuery=projection?database.select(projection).from(drizzleTable2):unprojected;if(conditions.length>0){let combined=and22(...conditions);if(combined)baseQuery=baseQuery.where(combined)}if(q.sort&&q.sort.length>0){let orderClauses=[];for(let s of q.sort){let field=typeof s?.field==="string"?s.field.trim():"";if(field==="")return ctx.set.status=400,{success:!1,message:'Malformed query parameter: sort (every entry needs a "field")'};if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot sort on field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in sort: ${field}`};orderClauses.push(s.direction==="desc"?desc5(col8):asc2(col8))}if(orderClauses.length>0)baseQuery=baseQuery.orderBy(...orderClauses)}let page=q.page??1,limit=q.limit??20,offset=q.offset??(page-1)*limit;if(q.groupBy){let field=q.groupBy.trim();if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot group by field: ${field}`};let groupCol=resolveCol2(field);if(!groupCol)return ctx.set.status=400,{success:!1,message:`Unknown field in groupBy: ${field}`};let where=conditions.length>0?and22(...conditions):void 0,col8=groupCol,distinctCount=await database.select({n:sql9`count(distinct ${col8})::int`}).from(drizzleTable2).where(where),totalGroups=Number(distinctCount[0]?.n??0);return{success:!0,data:{items:(await database.select({value:col8,count:sql9`count(*)::int`}).from(drizzleTable2).where(where).groupBy(col8).orderBy(sql9`count(*) desc`,col8).limit(limit).offset(offset)).map((g)=>({value:g.value,count:Number(g.count)})),meta:buildPaginationMeta(page,limit,offset,totalGroups)}}}let queryStart=performance.now(),combinedCount=conditions.length>0?and22(...conditions):void 0,countResult=await database.select({n:sql9`count(*)::int`}).from(drizzleTable2).where(combinedCount),totalItems=Number(countResult[0]?.n??0);baseQuery=baseQuery.limit(limit).offset(offset);let items=await baseQuery,meta=buildPaginationMeta(page,limit,offset,totalItems);if(listLog.debug(`List ${rawTableName}: ${items.length}/${totalItems} rows`,{requestId:ctx.request.headers.get("x-request-id")||void 0,table:rawTableName,page,limit,totalItems,returned:items.length,conditionCount:conditions.length,search:q.search||void 0,sort:Array.isArray(q.sort)?q.sort.map((s)=>`${s.field}:${s.direction}`):void 0,queryMs:Math.round(performance.now()-queryStart)}),authEnabled&&authResult?.allowedFields)items=filterResponseFields(items,authResult.allowedFields);return{success:!0,data:{items:items.map((r)=>stripUnclaimedSensitive(redactSensitiveOutput(r),authResult?.allowedFields)),meta}}}})),declared.push(defineRoute({method:"GET",path:"/:id",detail:{tags:[swaggerTag],summary:`Get ${tableName} by ID`,description:`Get a single ${tableName} record by its ID with optional relations`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,schemaRelations:schemaRelations2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,q=parseQueryParams(ctx.query),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=q.with?.map((w)=>w.name),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(q.malformed?.includes("with"))return ctx.set.status=400,{success:!1,message:"Malformed query parameter: with (expected a JSON array)"};let getScope=scopeConditionsFor(authResult,resolveCol2),getWhere=getScope.length>0?and22(eq36(idCol2,params.id),...getScope):eq36(idCol2,params.id);if(q.with&&q.with.length>0&&tableRelations&&dbPool){let allowedWith=authEnabled&&authResult?.allowedRelations?q.with.filter((w)=>authResult.allowedRelations?.includes(w.name)??!1):q.with,dbWithRelations=drizzle(dbPool,{schema:{...schemaTables2,...schemaRelations2}}),withClause={};for(let rel of allowedWith){let targetTable=relationTargetTable[rel.name],relAuth=authEnabled&&targetTable?await runAuthCheck(ctx.request,"GET",void 0,void 0,targetTable):null,decision=decideRelationExpansion({authEnabled,targetTable,relAuth,isTargetPublicGet:targetTable?publicGetEntities.has(targetTable):!1});if(!decision.expand)continue;let relScope=decision.scope;if(relScope&&Object.keys(relScope).length>0)withClause[rel.name]={...rel.limit?{limit:rel.limit}:{},where:(fields,ops)=>{let preds=[],unresolved=!1;for(let[k,v]of Object.entries(relScope)){let col8=resolveRelationScopeColumn(fields,k,snakeToCamel4);if(col8)preds.push(ops.eq(col8,v));else unresolved=!0}if(unresolved)return sql9`1 = 0`;return preds.length>0?ops.and(...preds):void 0}};else withClause[rel.name]=rel.limit?{limit:rel.limit}:!0}let result2=await dbWithRelations.query[tableName]?.findFirst({where:getWhere,with:withClause});if(!result2)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result2=filterResponseFields(result2,[...authResult.allowedFields,...authResult.allowedRelations??[]]);if(authEnabled&&authResult?.allowedRelations)result2=filterResponseRelations(result2,authResult.allowedRelations);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result2),authResult?.allowedFields)}}let result=(await database.select().from(drizzleTable2).where(getWhere))[0]||null;if(!result)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result=filterResponseFields(result,authResult.allowedFields);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result),authResult?.allowedFields)}}})),declared.push(defineRoute({method:"GET",path:"/distinct/:field",detail:{tags:[swaggerTag],summary:`Get distinct ${tableName} values`,description:`Get distinct values for a specific field in ${tableName}`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let params=ctx.params,authResult=await performAuthCheck(ctx.request,"GET",[params.field],[]);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(isSensitiveOutputKey(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(!sensitiveFieldQueryable(params.field,{authEnabled,allowedFields:authResult?.allowedFields}))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};let col8=resolveCol2(params.field);if(!col8)return ctx.set.status=404,{success:!1,message:"Field not found"};let distinctScope=scopeConditionsFor(authResult,resolveCol2),distinctQuery=database.selectDistinct({value:col8}).from(drizzleTable2);return{success:!0,data:distinctScope.length>0?await distinctQuery.where(and22(...distinctScope)):await distinctQuery}}}));if(!table.excluded_methods?.includes("POST"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"POST",path:"/",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Create ${tableName} with files`,description:`Create a new ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let userId=ctx.request.headers.get("x-user-id"),postFormAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postFormAuthResult&&!postFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postFormAuthResult.reason||"Forbidden"};let{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,uploadedFiles=null;if(files.length>0){if(uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),uploadedFiles.failed.length>0&&uploadedFiles.success.length===0){let allRefused=uploadedFiles.failed.every((one)=>one.rejected===!0),aboutType=allRefused&&uploadedFiles.failed.some((one)=>one.error.includes("File type"));return ctx.set.status=allRefused?aboutType?415:400:500,{success:!1,message:allRefused?"File refused":"File upload failed",errors:uploadedFiles.failed}}warmUploadedMedia(uploadedFiles)}let mergeUploadedMetadata=()=>{let firstFile=uploadedFiles?.success[0];if(firstFile)payload={...payload,...buildFileRecordPayload(firstFile,userId)}},ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postFormAuthResult),mergeUploadedMetadata();else mergeUploadedMetadata();let scopedForm=forceCreateScope(payload,postFormAuthResult,resolveCol2);if(!scopedForm.ok)return await discardUploads(uploadedFiles,storageConfig.basePath,logger2),ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedForm.field}' this entity does not have`};if(table.columns){let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return await discardUploads(uploadedFiles,storageConfig.basePath,logger2),ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;let result=await database.insert(drizzleTable2).values(payload).returning();announceWrite(ctx.request,"create",result,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postFormAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));else declared.push(defineRoute({method:"POST",path:"/",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Create ${tableName}`,description:`Create a new ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let payload=ctx.body,userId=ctx.request.headers.get("x-user-id"),postAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postAuthResult&&!postAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postAuthResult.reason||"Forbidden"};let ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postAuthResult);let scoped2=forceCreateScope(payload,postAuthResult,resolveCol2);if(!scoped2.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scoped2.field}' this entity does not have`};if(table.columns){let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.userId&&payload.roleId){let cols=drizzleTable2,existing=await database.select().from(drizzleTable2).where(and22(eq36(cols.userId,payload.userId),eq36(cols.roleId,payload.roleId))).limit(1);if(existing.length>0)return{success:!0,data:existing[0]}}let result=await database.insert(drizzleTable2).values(payload).returning();if(announceWrite(ctx.request,"create",result,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{after:result[0]}]),config.onRoleChanged&&tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.roleId&&payload.userId)try{let rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles];if(rolesTable){let roleName=(await database.select().from(rolesTable).where(eq36(rolesTable.id,payload.roleId)).limit(1))[0]?.name;if(roleName)config.onRoleChanged({userId:String(payload.userId),roleName,assigned:!0,actorId:userId??void 0})}}catch(error3){logger2.warn("[Entity] Could not read the assigned role to report it",{error:error3 instanceof Error?error3.message:String(error3)})}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PUT"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"PUT",path:"/:id",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Update ${tableName} with files`,description:`Full update of ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),putFormAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putFormAuthResult&&!putFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putFormAuthResult.reason||"Forbidden"};let putFormScope=scopeConditionsFor(putFormAuthResult,resolveCol2),putFormWhere=putFormScope.length>0?and22(eq36(idCol2,params.id),...putFormScope):eq36(idCol2,params.id),{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,oldRecord=await database.select().from(drizzleTable2).where(putFormWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putFormAuthResult);let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let uploadedFiles=null;if(files.length>0)uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),warmUploadedMedia(uploadedFiles);if(Object.keys(payload).length===0){ctx.set.status=400;let dropped=ignoredFields.length>0?ignoredFields:void 0,contentType=(ctx.request.headers.get("content-type")||"").toLowerCase();if(table.is_form_data&&!contentType.includes("multipart/form-data"))return{success:!1,message:`This endpoint reads multipart/form-data: send the fields as a 'data' JSON part (and the file, if any, as '${storageConfig.formData?.filesField??"files"}'). A ${contentType||"bodyless"} request carries nothing it can read.`};return{success:!1,message:dropped?`Nothing to update: every field sent is managed by the server and cannot be set this way (${[...new Set(dropped)].join(", ")}).`:"Nothing to update: no writable field was sent.",...dropped?{ignored_fields:[...new Set(dropped)]}:{}}}let result=await database.update(drizzleTable2).set(payload).where(putFormWhere).returning();announceWrite(ctx.request,"update",result,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:{record:result[0],files:uploadedFiles?.success||[],fileErrors:uploadedFiles?.failed||[]}}}}));else declared.push(defineRoute({method:"PUT",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Update ${tableName}`,description:`Full update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),putAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putAuthResult&&!putAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putAuthResult.reason||"Forbidden"};let putScope=scopeConditionsFor(putAuthResult,resolveCol2),putWhere=putScope.length>0?and22(eq36(idCol2,params.id),...putScope):eq36(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(putWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putAuthResult);let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`};let strandedRole=await assignmentWithdrawalStrands(params.id,payload);if(strandedRole)return ctx.set.status=409,{success:!1,message:`Cannot withdraw the '${strandedRole}' role from this user: an approval chain is waiting on them to decide a step through it, and nobody else can take that step. Complete or reject that verification first, or unpublish the flow.`}}if(Object.keys(payload).length===0){ctx.set.status=400;let dropped=ignoredFields.length>0?ignoredFields:void 0,contentType=(ctx.request.headers.get("content-type")||"").toLowerCase();if(table.is_form_data&&!contentType.includes("multipart/form-data"))return{success:!1,message:`This endpoint reads multipart/form-data: send the fields as a 'data' JSON part (and the file, if any, as '${storageConfig.formData?.filesField??"files"}'). A ${contentType||"bodyless"} request carries nothing it can read.`};return{success:!1,message:dropped?`Nothing to update: every field sent is managed by the server and cannot be set this way (${[...new Set(dropped)].join(", ")}).`:"Nothing to update: no writable field was sent.",...dropped?{ignored_fields:[...new Set(dropped)]}:{}}}let result=await database.update(drizzleTable2).set(payload).where(putWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),putAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PATCH"))declared.push(defineRoute({method:"PATCH",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Patch ${tableName}`,description:`Partial update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),patchAuthResult=await performAuthCheck(ctx.request,"PATCH",writeFields);if(patchAuthResult&&!patchAuthResult.authorized)return ctx.set.status=403,{success:!1,message:patchAuthResult.reason||"Forbidden"};let patchScope=scopeConditionsFor(patchAuthResult,resolveCol2),patchWhere=patchScope.length>0?and22(eq36(idCol2,params.id),...patchScope):eq36(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(patchWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,patchAuthResult);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`};let strandedRole=await assignmentWithdrawalStrands(params.id,payload);if(strandedRole)return ctx.set.status=409,{success:!1,message:`Cannot withdraw the '${strandedRole}' role from this user: an approval chain is waiting on them to decide a step through it, and nobody else can take that step. Complete or reject that verification first, or unpublish the flow.`}}let result=await database.update(drizzleTable2).set(payload).where(patchWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"PATCH",userId:userId||void 0,summary:`Patched ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),patchAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/:id",detail:{tags:[swaggerTag],summary:`Delete ${tableName}`,description:`Delete a ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),deleteAuthResult=await performAuthCheck(ctx.request,"DELETE");if(deleteAuthResult&&!deleteAuthResult.authorized)return ctx.set.status=403,{success:!1,message:deleteAuthResult.reason||"Forbidden"};let deleteScope=scopeConditionsFor(deleteAuthResult,resolveCol2),deleteWhere=deleteScope.length>0?and22(eq36(idCol2,params.id),...deleteScope):eq36(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(deleteWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(await activeVerificationExists(database,schemaTables2,tableName,params.id))return ctx.set.status=409,{success:!1,message:`Cannot delete: this ${tableName} is in an active verification. Complete or reject it first.`};if((await strandsVerification([params.id])).length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on this ${tableName} to decide a step. Complete or reject that verification first, or reassign the step.`};{let strandedRole=await assignmentWithdrawalStrands(params.id);if(strandedRole)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on this user to decide a step through the '${strandedRole}' role, and nobody else can take it. Complete or reject that verification first, or unpublish the flow.`}}if(await database.delete(drizzleTable2).where(deleteWhere),table.is_form_data&&storageConfig.enabled&&oldRecord[0]){let rec=oldRecord[0],filePath=rec.path,fileName=rec.name;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${params.id})`)}}if(oldRecord[0]){let link=accountLinkFor(config.accountLinks,tableName),userIds=link?accountIdsIn([oldRecord[0]],link.userColumn):[];if(userIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables2[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables2.userSessions??schemaTables2.sessions,schemaTables:schemaTables2,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${tableName} ${params.id} was deleted but its account could not be closed`,{error:error3})},userIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] Account behind ${tableName} ${params.id} was deactivated but its open sessions were not cleared`)}}if(refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,[{before:oldRecord[0]}]),config.onRoleChanged&&tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&oldRecord[0])try{let deletedUserRole=oldRecord[0],rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles];if(rolesTable&&deletedUserRole.roleId&&deletedUserRole.userId){let roleName=(await database.select().from(rolesTable).where(eq36(rolesTable.id,deletedUserRole.roleId)).limit(1))[0]?.name;if(roleName)config.onRoleChanged({userId:String(deletedUserRole.userId),roleName,assigned:!1,actorId:ctx.request.headers.get("x-user-id")??void 0})}}catch(error3){logger2.warn("[Entity] Could not read the withdrawn role to report it",{error:error3 instanceof Error?error3.message:String(error3)})}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"DELETE",userId:userId||void 0,summary:`Deleted ${table.table_name} (${params.id})`,oldValues:oldRecord[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:null}}}));if(table.bulk_endpoints_enabled){if(!table.excluded_methods?.includes("POST"))declared.push(defineRoute({method:"POST",path:"/bulk",body:Type.Array(Type.Object({},{additionalProperties:!0})),detail:{tags:[swaggerTag],summary:`Bulk create ${tableName}`,description:`Create multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPostAuth=await performAuthCheck(ctx.request,"POST",writeFields);if(bulkPostAuth&&!bulkPostAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPostAuth.reason||"Forbidden"};let sanitizedItems=[];for(let raw of items){let payload=raw,ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPostAuth);let scopedItem=forceCreateScope(payload,bulkPostAuth,resolveCol2);if(!scopedItem.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedItem.field}' this entity does not have`};if(table.columns){let validationColumns=table.is_form_data?table.columns.filter((c)=>!STORAGE_MANAGED_COLUMNS.includes(c.name)):table.columns,validation=validatePayload(payload,validationColumns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(userId&&!isAnonymousCreate(table,payload))payload.createdBy=userId;sanitizedItems.push(payload)}let txResult=await database.transaction(async(tx)=>{let results=[];for(let payload of sanitizedItems){let result=await tx.insert(drizzleTable2).values(payload).returning();results.push(result[0])}return results}),auditPath=auditPathContext(ctx.request);announceWrite(ctx.request,"create",txResult,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,txResult.map((row)=>({after:row})));for(let[i,row]of txResult.entries())await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"CREATE",summary:`Bulk created ${table.table_name} (${row.id})`,newValues:row,...auditIdentityFor(table,sanitizedItems[i]??{},userId,ctx.request.headers),...auditPath});return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPostAuth))}}}));if(!table.excluded_methods?.includes("PUT"))declared.push(defineRoute({method:"PUT",path:"/bulk",body:bulkUpdateSchema,detail:{tags:[swaggerTag],summary:`Bulk update ${tableName}`,description:`Update multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPutAuth=await performAuthCheck(ctx.request,"PUT",writeFields);if(bulkPutAuth&&!bulkPutAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPutAuth.reason||"Forbidden"};let bulkPutScope=scopeConditionsFor(bulkPutAuth,resolveCol2),prepared=[];for(let item of items){let payload=item.data,ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPutAuth);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;prepared.push({id:item.id,payload})}let beforeById=new Map,txResult=await database.transaction(async(tx)=>{if(prepared.length>0){let idFilter=inArray14(idCol2,prepared.map((p)=>p.id)),beforeRows=await tx.select().from(drizzleTable2).where(bulkPutScope.length>0?and22(idFilter,...bulkPutScope):idFilter);for(let row of beforeRows)if(row.id!=null)beforeById.set(String(row.id),row)}let results=[];for(let{id,payload}of prepared){let result=await tx.update(drizzleTable2).set(payload).where(bulkPutScope.length>0?and22(eq36(idCol2,id),...bulkPutScope):eq36(idCol2,id)).returning();if(result[0])results.push(result[0])}return results});await endSessionsForDeactivated(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row}))),announceWrite(ctx.request,"update",txResult,userId),refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row})));let auditPath=auditPathContext(ctx.request);for(let row of txResult){let rowId=String(row.id);await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"UPDATE",userId:userId||void 0,summary:`Bulk updated ${table.table_name} (${rowId})`,oldValues:beforeById.get(rowId),newValues:row,...auditPath})}return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPutAuth))}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/bulk",body:bulkDeleteSchema,detail:{tags:[swaggerTag],summary:`Bulk delete ${tableName}`,description:`Delete multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let ids=ctx.body;if(!Array.isArray(ids))return{success:!1,message:"Body must be an array of ids"};if(ids.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let bulkDeleteAuth=await performAuthCheck(ctx.request,"DELETE");if(bulkDeleteAuth&&!bulkDeleteAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkDeleteAuth.reason||"Forbidden"};let bulkDeleteScope=scopeConditionsFor(bulkDeleteAuth,resolveCol2),userId=ctx.request.headers.get("x-user-id"),blocked=[];for(let id of ids)if(await activeVerificationExists(database,schemaTables,tableName,id))blocked.push(id);if(blocked.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: ${blocked.length} of these ${tableName} are in an active verification. Complete or reject it first. Blocked ids: ${blocked.join(", ")}`};let stranding=await strandsVerification(ids);if(stranding.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on ${stranding.length} of these ${tableName} to decide a step. Complete or reject those verifications first. Blocked ids: ${stranding.join(", ")}`};{let strandedAssignments=[];for(let id of ids)if(await assignmentWithdrawalStrands(id))strandedAssignments.push(id);if(strandedAssignments.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on ${strandedAssignments.length} of these role assignments to decide a step, and nobody else can take it. Complete or reject those verifications first. Blocked ids: ${strandedAssignments.join(", ")}`}}let removed=[];if(await database.transaction(async(tx)=>{for(let id of ids){let r=await tx.delete(drizzleTable2).where(bulkDeleteScope.length>0?and22(eq36(idCol2,id),...bulkDeleteScope):eq36(idCol2,id)).returning();removed.push(...r)}}),table.is_form_data&&storageConfig.enabled&&removed.length>0)for(let rec of removed){let{path:filePath,name:fileName}=rec;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${String(rec.id)})`)}}{let link=accountLinkFor(config.accountLinks,tableName),bulkUserIds=link?accountIdsIn(removed,link.userColumn):[];if(bulkUserIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${removed.length} ${tableName} rows were deleted but their accounts could not be closed`,{error:error3})},bulkUserIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] ${result.closed} account(s) behind deleted ${tableName} rows were deactivated but their open sessions were not cleared`)}}if(removed.length>0)refreshClaimsCache(),await syncGodFlagsAfterWrite(ctx.request,removed.map((row)=>({before:row})));let auditPath=auditPathContext(ctx.request);for(let row of removed)await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"DELETE",userId:userId||void 0,summary:`Bulk deleted ${table.table_name} (${row.id})`,oldValues:row,...auditPath});return{success:!0,data:{deleted:removed.length}}}}))}mountRoutes(app,[{prefix:`/${tableName}`,guards:entityGuards,routes:declared}])}return app}init_esm3();init_AccountLink();import{randomUUID as randomUUID9}from"crypto";var LOCK_TTL_SECONDS2=60,RENEW_INTERVAL_MS=20000,lockKeyFor=(mappingId)=>`integrations:run:${mappingId}`;async function acquireRunLock(store,mappingId,deps={}){let key2=lockKeyFor(mappingId),now=deps.now??Date.now,ttl=deps.ttlSeconds??LOCK_TTL_SECONDS2,token=randomUUID9(),existing=await store.read(key2);if(!existing.success)return{ok:!1,reason:"unavailable",error:existing.error};if(existing.data)return{ok:!1,reason:"held",heldSince:existing.data.acquiredAt??null};let created=await store.create(key2,{token,acquiredAt:now()},ttl);if(!created.success)return{ok:!1,reason:"unavailable",error:created.error};let readBack=await store.read(key2);if(!readBack.success)return{ok:!1,reason:"unavailable",error:readBack.error};if(readBack.data?.token!==token)return{ok:!1,reason:"held",heldSince:readBack.data?.acquiredAt??null};let held=!0,timer=setInterval(()=>{(async()=>{let current=await store.read(key2);if(!current.success)return;if(current.data?.token!==token){held=!1,clearInterval(timer),deps.logger?.warn("[Integrations] Run lock was taken over",{mappingId});return}await store.create(key2,current.data,ttl)})()},RENEW_INTERVAL_MS);return timer.unref?.(),{ok:!0,handle:{token,isHeld:()=>held,release:async()=>{if(clearInterval(timer),!held)return;held=!1;let current=await store.read(key2);if(current.success&&current.data?.token===token)await store.remove(key2)}}}}import{createHash as createHash4}from"crypto";function buildUrl(baseUrl,path7,params){let base=baseUrl.trim().replace(/\/+$/,"");if(!base)return{ok:!1,error:"The source has no base address."};let raw=(path7??"").trim();if(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)||raw.startsWith("//"))return{ok:!1,error:`The endpoint path points at another host (${raw}). A path must be relative to the source address.`};let suffix=raw===""?"":raw.startsWith("/")?raw:`/${raw}`,url;try{url=new URL(`${base}${suffix}`)}catch{return{ok:!1,error:`The source address is not a valid URL: ${baseUrl}`}}for(let[key2,value2]of Object.entries(params??{})){if(value2==null)continue;url.searchParams.set(key2,String(value2))}return{ok:!0,url}}function applyAuth(source,url){let headers={accept:"application/json",...source.extraHeaders??{}},token=source.token?.trim();if(!token)return{headers};switch(source.authType){case"bearer":case"oauth2":headers[source.authHeaderName||"Authorization"]=`Bearer ${token}`;break;case"api_key":if(source.authQueryParam)url.searchParams.set(source.authQueryParam,token);else headers[source.authHeaderName||"X-API-Key"]=token;break;case"basic":headers.Authorization=`Basic ${token}`;break;default:break}return{headers}}function describeTransportError(error3){let message=error3 instanceof Error?error3.message:String(error3),cause=error3?.cause,code=cause?.code??"",blob=`${message} ${code} ${cause?.message??""}`;if(/UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED|self.signed|CERT_|unable to verify|ERR_TLS|altnames/i.test(blob))return`Certificate verification failed (${code||"incomplete chain"}). If this server's certificate is knowingly self-signed or incomplete, turn off certificate verification for this source and try again.`;if(/ENOTFOUND|EAI_AGAIN|getaddrinfo|Unable to resolve/i.test(blob))return`The address could not be resolved (DNS${code?`: ${code}`:""}). Check the source address.`;if(/ECONNREFUSED/i.test(blob))return`The connection was refused (${code||"ECONNREFUSED"}). The address and port are reachable but nothing is listening.`;if(/ETIMEDOUT|timeout|timed out|aborted|AbortError|UND_ERR/i.test(blob))return`The connection timed out (${code||"timeout"}). Check network and firewall access to this address.`;if(/ECONNRESET|EPIPE/i.test(blob))return`The connection was closed by the other side (${code||"ECONNRESET"}).`;return`Connection error: ${message}`}async function fetchOnce(source,request,deps={}){let impl=deps.fetchImpl??fetch,headers={...request.headers},method=request.method.toUpperCase(),hasBody=request.body!==void 0&&method!=="GET"&&method!=="HEAD";if(hasBody&&!headers["content-type"]&&!headers["Content-Type"])headers["content-type"]="application/json";let init={method,headers,cache:"no-store",signal:AbortSignal.timeout(source.timeoutMs??30000),tls:{rejectUnauthorized:source.tlsVerify!==!1},...hasBody?{body:typeof request.body==="string"?request.body:JSON.stringify(request.body)}:{}},response;try{response=await impl(request.url.toString(),init)}catch(error3){return deps.logger?.warn("[Integrations] Outbound request failed",{sourceId:source.id,url:request.url.origin+request.url.pathname,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,status:0,body:null,linkHeader:null,error:describeTransportError(error3)}}let text2=await response.text().catch(()=>""),body=null;if(text2)try{body=JSON.parse(text2)}catch{body=text2}let linkHeader=response.headers.get("link");if(!response.ok){let detail=typeof body==="string"?body:body==null?"":JSON.stringify(body);return{ok:!1,status:response.status,body,linkHeader,error:`The source returned HTTP ${response.status}${detail?` \u2014 ${detail.slice(0,300)}`:""}`}}return{ok:!0,status:response.status,body,linkHeader}}var EXPIRY_SKEW_MS=5000,DEFAULT_TTL_MS=300000,DEFAULT_REFRESH_TTL_MS=1800000,FIELD_SEPARATOR="\x00";function credentialFingerprint(config){let material=[config.tokenUrl,config.grantType,config.clientId??"",config.clientSecret??"",config.username??"",config.password??"",config.scope??"",config.clientAuth??"basic"].join(FIELD_SEPARATOR);return createHash4("sha256").update(material).digest("hex").slice(0,32)}class TokenCache{entries=new Map;get(sourceId,fingerprint){let entry=this.entries.get(sourceId);if(!entry)return null;if(entry.fingerprint!==fingerprint)return this.entries.delete(sourceId),null;return entry}set(sourceId,token){this.entries.set(sourceId,token)}invalidate(sourceId){this.entries.delete(sourceId)}clear(){this.entries.clear()}}var isUsable=(token,now)=>token.expiresAt>now+EXPIRY_SKEW_MS,canRefresh=(token,now)=>Boolean(token.refreshToken)&&(token.refreshExpiresAt??0)>now+EXPIRY_SKEW_MS;function buildTokenRequest(config,form){let headers={"content-type":"application/x-www-form-urlencoded",accept:"application/json"};if(config.scope&&!form.has("scope"))form.set("scope",config.scope);let clientId=config.clientId??"",clientSecret=config.clientSecret??"";if((config.clientAuth??"basic")==="basic")headers.authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;else{if(clientId)form.set("client_id",clientId);if(clientSecret)form.set("client_secret",clientSecret)}return{headers,body:form.toString()}}async function requestToken(config,form,now,fetchImpl){let{headers,body}=buildTokenRequest(config,form),response;try{response=await fetchImpl(config.tokenUrl,{method:"POST",headers,body,cache:"no-store",signal:AbortSignal.timeout(config.timeoutMs??30000),tls:{rejectUnauthorized:config.tlsVerify!==!1}})}catch(error3){return{ok:!1,error:`Token request failed \u2014 ${describeTransportError(error3)}`}}let text2=await response.text().catch(()=>""),json={};try{json=text2?JSON.parse(text2):{}}catch{}if(!response.ok||!json.access_token){let detail=json.error_description||json.error||text2.slice(0,200);return{ok:!1,error:`Could not obtain an OAuth2 token (HTTP ${response.status})${detail?`: ${detail}`:""}`}}return{ok:!0,token:{accessToken:json.access_token,expiresAt:now+(json.expires_in?json.expires_in*1000:DEFAULT_TTL_MS),refreshToken:json.refresh_token,refreshExpiresAt:json.refresh_token?now+(json.refresh_expires_in?json.refresh_expires_in*1000:DEFAULT_REFRESH_TTL_MS):void 0,fingerprint:credentialFingerprint(config)}}}async function getAccessToken(config,cache,deps={}){let fetchImpl=deps.fetchImpl??fetch,now=deps.now?.()??Date.now();if(!config.tokenUrl?.trim())return{ok:!1,error:"No token URL is configured for this source."};let fingerprint=credentialFingerprint(config),cached=cache.get(config.sourceId,fingerprint);if(cached&&isUsable(cached,now))return{ok:!0,accessToken:cached.accessToken,fromCache:!0};if(cached&&canRefresh(cached,now)){let refreshed=await requestToken(config,new URLSearchParams({grant_type:"refresh_token",refresh_token:cached.refreshToken}),now,fetchImpl);if(refreshed.ok)return cache.set(config.sourceId,refreshed.token),{ok:!0,accessToken:refreshed.token.accessToken,fromCache:!1}}let form=new URLSearchParams({grant_type:config.grantType});if(config.grantType==="password")form.set("username",config.username??""),form.set("password",config.password??"");let minted=await requestToken(config,form,now,fetchImpl);if(!minted.ok)return{ok:!1,error:minted.error};return cache.set(config.sourceId,minted.token),{ok:!0,accessToken:minted.token.accessToken,fromCache:!1}}import{and as and23,eq as eq37,inArray as inArray15}from"drizzle-orm";var DEFAULT_IGNORED=["updatedAt","updated_at","updatedBy","updated_by"];function planRevert(input){let ignored=new Set([...DEFAULT_IGNORED,...input.ignoreColumns??[]]),ops={deletes:[],restores:[],reinserts:[],conflicts:[]};for(let image of input.preImages)switch(image.action){case"create":{if(!image.rowId)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; deleting it would discard that edit."});break}ops.deletes.push(image.rowId);break}case"update":case"deactivate":{if(!image.rowId||!image.before)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; restoring it would discard that edit."});break}ops.restores.push({id:image.rowId,row:image.before});break}case"delete":{if(!image.before)break;if(image.rowId&&input.current.has(image.rowId)){ops.conflicts.push({id:image.rowId,reason:"A record with this identifier exists again; it was not replaced."});break}ops.reinserts.push(image.before);break}default:break}return ops}function changedSince(after,now,ignored){if(!after)return!1;for(let[key2,value2]of Object.entries(after)){if(ignored.has(key2))continue;if(!sameValue(value2,now[key2]))return!0}return!1}function sameValue(a,b){if(a===b)return!0;if(a==null&&b==null)return!0;if(a instanceof Date&&b instanceof Date)return a.getTime()===b.getTime();if(a instanceof Date||b instanceof Date){let da=a instanceof Date?a:new Date(String(a)),db=b instanceof Date?b:new Date(String(b));return!Number.isNaN(da.getTime())&&!Number.isNaN(db.getTime())?da.getTime()===db.getTime():!1}if(typeof a==="object"||typeof b==="object")try{return JSON.stringify(a)===JSON.stringify(b)}catch{return!1}return String(a)===String(b)}var CHUNK=500;async function applyRevert(deps,ops,meta){let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,conflicts:ops.conflicts.length,error:`"${meta.targetEntity}" has no id column; its rows cannot be addressed.`};let now=new Date;try{let work=async(tx)=>{let deleted=0,restored=0,reinserted=0;for(let i=0;i<ops.deletes.length;i+=CHUNK){let chunk=ops.deletes.slice(i,i+CHUNK),removed=await tx.delete(deps.drizzleTable).where(inArray15(idCol,chunk)).returning();deleted+=removed.length}for(let restore of ops.restores){let{id:_id,createdAt:_c,createdBy:_cb,...rest3}=restore.row,written=await tx.update(deps.drizzleTable).set({...rest3,updatedAt:now,updatedBy:meta.userId}).where(and23(eq37(idCol,restore.id))).returning();restored+=written.length}if(ops.reinserts.length>0)for(let i=0;i<ops.reinserts.length;i+=CHUNK){let chunk=ops.reinserts.slice(i,i+CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();reinserted+=written.length}return{deleted,restored,reinserted}};return{ok:!0,...meta.tx?await work(meta.tx):await deps.db.transaction(work),conflicts:ops.conflicts.length}}catch(error3){return deps.logger.error("[Integrations] Revert transaction failed",{targetEntity:meta.targetEntity,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,conflicts:ops.conflicts.length,error:"The database rejected this undo; it was rolled back and nothing changed."}}}function groupPreImagesByEntity(preImages){let byEntity=new Map;for(let image of preImages){let list2=byEntity.get(image.targetEntity);if(list2)list2.push(image);else byEntity.set(image.targetEntity,[image])}return[...byEntity.entries()].map(([targetEntity,images])=>({targetEntity,preImages:images}))}function touchedRowIds(preImages){let ids=new Set;for(let image of preImages)if(image.rowId)ids.add(image.rowId);return[...ids]}var TREE_PARENT_KEY="__treeParent";function flattenTree(records,childrenPath){let out=[],truncated=!1,visit=(node,parent,depth)=>{if(!node||typeof node!=="object")return;if(depth>64){truncated=!0;return}let source=node,children=source[childrenPath],{[childrenPath]:_nested,...own}=source;if(out.push({...own,["__depth"]:depth,["__treeParent"]:parent??null}),!Array.isArray(children))return;for(let child of children)visit(child,own,depth+1)};for(let root of records)visit(root,null,0);return{records:out,truncated}}function treeChildrenPath(value2){let trimmed=(value2??"").trim();return trimmed.length>0?trimmed:null}function getByPath(obj,path7){if(!path7)return;let cur=obj;for(let part of path7.split(".")){if(cur==null||typeof cur!=="object")return;cur=cur[part]}return cur}function readSourceValue(external,parent,path7){return readOne(external,parent,path7)}function readOne(external,parent,path7){return path7.startsWith("__parent.")?getByPath(parent,path7.slice(9)):getByPath(external,path7)}var TEMPLATE_TOKEN=/\{([^{}]+)\}/g;function isTemplateSource(source){return TEMPLATE_TOKEN.lastIndex=0,TEMPLATE_TOKEN.test(source)}function renderTemplate(template,external,parent){let treeParentAbsent=external!=null&&typeof external==="object"&&TREE_PARENT_KEY in external&&external[TREE_PARENT_KEY]==null,readsTreeParent=(text2)=>text2.includes(`{${TREE_PARENT_KEY}.`),readToken=(token)=>{let[path7="",transform3]=token.split("|"),value2=readOne(external,parent,path7.trim());if(transform3===void 0)return value2;let result=applyTransform(value2,transform3.trim());return result.ok?result.value:value2};for(let alternative of template.split("||")){let candidate=alternative.trim();if(candidate==="")continue;if(treeParentAbsent&&readsTreeParent(candidate))continue;let complete=!0,rendered=candidate.replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(complete&&rendered.trim()!=="")return rendered}let last=template.split("||").pop()??template;if(treeParentAbsent&&readsTreeParent(last))return"";return last.trim().replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);return value2==null?"":String(value2)})}function extractRecords(body,rootPath){if(rootPath){let at=getByPath(body,rootPath);if(Array.isArray(at))return at;return at&&typeof at==="object"?[at]:[]}let candidate=firstArrayLike(body)??deepFirstArrayOfObjects(body);return Array.isArray(candidate)?candidate:[]}var ENVELOPE_KEYS=["content","items","data","results","records","rows","list","value","responseObject"];function firstArrayLike(body){if(Array.isArray(body))return body;if(!body||typeof body!=="object")return;let b=body;for(let key2 of ENVELOPE_KEYS){let v=b[key2];if(Array.isArray(v))return v;if(v&&typeof v==="object"){let nested=v.items;if(Array.isArray(nested))return nested}}return}function deepFirstArrayOfObjects(body,depth=0){if(depth>5||body==null||typeof body!=="object"||body instanceof Date)return;if(Array.isArray(body))return body.length>0&&typeof body[0]==="object"&&body[0]!==null?body:void 0;let entries=Object.values(body);for(let v of entries)if(Array.isArray(v)&&v.length>0&&typeof v[0]==="object"&&v[0]!==null)return v;for(let v of entries)if(v&&typeof v==="object"&&!Array.isArray(v)){let found=deepFirstArrayOfObjects(v,depth+1);if(found)return found}for(let v of entries)if(Array.isArray(v))return v;return}var FOLD={\u{131}:"i",\u{130}:"I",\u{15f}:"s",\u{15e}:"S",\u{11f}:"g",\u{11e}:"G",\u{f8}:"o",\u{d8}:"O",\u{e6}:"ae",\u{c6}:"AE",\u{df}:"ss",\u{111}:"d",\u{110}:"D",\u{142}:"l",\u{141}:"L"};function foldToAscii(value2){return value2.replace(/[\u0131\u0130\u015F\u015E\u011F\u011E\u00F8\u00D8\u00E6\u00C6\u00DF\u0111\u0110\u0142\u0141]/g,(ch)=>FOLD[ch]??ch).normalize("NFD").replace(/[\u0300-\u036f]/g,"")}var TRUTHY=new Set(["true","1","yes","y","evet","e","on"]),FALSY=new Set(["false","0","no","n","hayir","hay\u0131r","h","off"]);function applyTransform(value2,transform3,locale){if(value2==null)return{ok:!0,value:value2};switch(transform3){case"trim":return{ok:!0,value:String(value2).trim()};case"upper":return{ok:!0,value:String(value2).trim().toLocaleUpperCase(locale)};case"lower":return{ok:!0,value:String(value2).trim().toLocaleLowerCase(locale)};case"toString":return{ok:!0,value:String(value2)};case"toNumber":{if(typeof value2==="boolean")return{ok:!1,reason:"not a number",raw:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let n=Number(s);return Number.isFinite(n)?{ok:!0,value:n}:{ok:!1,reason:"not a number",raw:value2}}case"toBoolean":{if(typeof value2==="boolean")return{ok:!0,value:value2};let s=String(value2).trim().toLocaleLowerCase("tr-TR");if(s==="")return{ok:!0,value:null};if(TRUTHY.has(s))return{ok:!0,value:!0};if(FALSY.has(s))return{ok:!0,value:!1};return{ok:!1,reason:"not a yes/no value",raw:value2}}case"emailSafe":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"")};case"slug":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/-{2,}/g,"-").replace(/^-+|-+$/g,"")};case"pathLeaf":{let parts=String(value2).split(/[/\\>\u203A\u00BB]|->/).map((part)=>part.trim()).filter((part)=>part!=="");return{ok:!0,value:parts.length>0?parts[parts.length-1]:""}}case"toList":{if(Array.isArray(value2))return{ok:!0,value:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:[]};return{ok:!0,value:s.split(",").map((part)=>part.trim()).filter((part)=>part!=="")}}case"dateOnly":{let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let leading=s.match(/^\d{4}-\d{2}-\d{2}/);if(leading)return{ok:!0,value:leading[0]};let d=new Date(s);return Number.isNaN(d.getTime())?{ok:!1,reason:"not a date",raw:value2}:{ok:!0,value:d.toISOString().slice(0,10)}}default:return{ok:!0,value:value2}}}function isEmpty(v){return v==null||typeof v==="string"&&v.trim()===""}function mapRecord(external,mappings,parent){let row={},problems=[];for(let fm of mappings){if(!fm.target)continue;let value2;if(fm.constant!=null&&fm.constant!=="")value2=fm.constant;else{let raw=isTemplateSource(fm.source)?renderTemplate(fm.source,external,parent):readOne(external,parent,fm.source),result=applyTransform(raw,fm.transform);if(!result.ok)problems.push(`${fm.source} \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null;else value2=result.value}if(isEmpty(value2)&&fm.fallback!=null&&fm.fallback!==""){let raw=isTemplateSource(fm.fallback)?renderTemplate(fm.fallback,external,parent):fm.fallback,result=applyTransform(raw,fm.transform);if(result.ok)value2=result.value;else problems.push(`fallback \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null}if(value2!==void 0)row[fm.target]=value2}return{row,problems}}function buildMappedRecords(externalRecords,mappings,dedupTargetField,parents){let records=[],issues=[];return externalRecords.forEach((ext,i)=>{let{row,problems}=mapRecord(ext,mappings,parents?.[i]);for(let message of problems)issues.push({sourceIndex:i,kind:"invalid_value",message});let dedupKey=dedupTargetField&&!isEmpty(row[dedupTargetField])?String(row[dedupTargetField]).trim():null;records.push({data:row,dedupKey,sourceIndex:i,external:ext,parent:parents?.[i]})}),{records,issues}}function flattenKeys(obj,prefix="",out=[],depth=0){if(out.length>200||depth>4||obj==null||typeof obj!=="object")return out;if(Array.isArray(obj)){if(prefix)out.push(prefix);return out}for(let[k,v]of Object.entries(obj)){let path7=prefix?`${prefix}.${k}`:k;if(v!=null&&typeof v==="object"&&!Array.isArray(v))flattenKeys(v,path7,out,depth+1);else out.push(path7)}return out}var MAX_FANOUT_COMBINATIONS=5000;function resolvePath2(rawPath,values){let missing=new Set,used=new Set;return{path:rawPath.replace(/\{([a-zA-Z_][\w-]*)\}|:([a-zA-Z_]\w*)/g,(_full,brace,colon)=>{let key2=brace??colon,v=values[key2];if(v==null||v==="")return missing.add(key2),brace?`{${key2}}`:`:${key2}`;return used.add(key2),encodeURIComponent(String(v))}),missing:[...missing],used}}function planFetchOrder(endpoints,roots){let byId=new Map(endpoints.map((e)=>[e.id,e])),order=[],settled=new Set,onPath=[],onPathSet=new Set,visit=(id,requiredBy)=>{if(settled.has(id))return null;if(onPathSet.has(id))return{ok:!1,reason:"cycle",chain:[...onPath.slice(onPath.indexOf(id)),id]};let node=byId.get(id);if(!node)return{ok:!1,reason:"unknown_endpoint",missing:id,requiredBy:requiredBy??id};onPath.push(id),onPathSet.add(id);for(let binding of node.paramBindings??[]){if(binding.from!=="endpoint")continue;let failure=visit(binding.endpointId,id);if(failure)return failure}return onPath.pop(),onPathSet.delete(id),settled.add(id),order.push(id),null};for(let id of roots??endpoints.map((e)=>e.id)){let failure=visit(id,null);if(failure)return failure}return{ok:!0,order}}function expandBindings(bindings,sources,limit=MAX_FANOUT_COMBINATIONS){if(!bindings||bindings.length===0)return{ok:!0,calls:[{values:{}}]};let axes=[];for(let binding of bindings){if(binding.from==="static"){axes.push({param:binding.param,options:[{value:binding.value}]});continue}if(binding.from==="endpoint"){let options=(sources.parents?.[binding.endpointId]??[]).map((record3)=>({value:getByPath(record3,binding.field),parent:record3})).filter((o)=>o.value!=null&&o.value!=="");axes.push({param:binding.param,options});continue}let values=sources.entityValues?.[`${binding.entity}.${binding.field}`]??[];axes.push({param:binding.param,options:values.filter((v)=>v!=null&&v!=="").map((value2)=>({value:value2}))})}if(axes.some((a)=>a.options.length===0))return{ok:!0,calls:[]};let combinations=axes.reduce((n,a)=>n*a.options.length,1);if(combinations>limit)return{ok:!1,reason:"too_many",combinations,limit};let calls=[{values:{}}];for(let axis of axes){let next=[];for(let call of calls)for(let option of axis.options)next.push({values:{...call.values,[axis.param]:option.value},parent:option.parent??call.parent});calls=next}return{ok:!0,calls}}function parentEndpointIds(bindings){let ids=new Set;for(let b of bindings??[])if(b.from==="endpoint")ids.add(b.endpointId);return[...ids]}function entityValueKeys(bindings){let keys=new Set;for(let b of bindings??[])if(b.from==="entity")keys.add(`${b.entity}.${b.field}`);return[...keys]}var MAX_PAGES=1000,DEFAULT_PAGE_SIZE=200,initialState2=()=>({pagesFetched:0,recordsFetched:0,cursor:null});function firstPageParams(profile){switch(profile.kind){case"page_number":{let params={[profile.pageParam]:String(profile.firstPage??0)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"offset":return{[profile.offsetParam]:"0",[profile.limitParam]:String(pageSize(profile))};case"cursor":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"link_header":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}default:return{}}}function reportedTotal(profile,body){let path7=profile.kind==="page_number"||profile.kind==="offset"?profile.totalPath:void 0;if(!path7)return null;let raw=getByPath(body,path7);if(typeof raw==="number"&&Number.isFinite(raw)&&raw>=0)return Math.floor(raw);if(typeof raw==="string"&&raw.trim()!==""){let n=Number(raw);if(Number.isFinite(n)&&n>=0)return Math.floor(n)}return null}function nextPage(profile,state,observed){if(profile.kind==="none")return{kind:"done",reason:"single request"};if(state.pagesFetched>=MAX_PAGES)return{kind:"failed",reason:`Paging stopped after ${MAX_PAGES} requests without reaching the end. The source may not be honouring the paging parameters; importing this would be a partial read.`};if(observed.recordCount===0)return{kind:"done",reason:"empty page"};switch(profile.kind){case"page_number":{if(isLastPage(profile.lastPagePath,observed.body))return{kind:"done",reason:"source reported the last page"};let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};let next=(profile.firstPage??0)+state.pagesFetched,params={[profile.pageParam]:String(next)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"offset":{let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};return{kind:"params",params:{[profile.offsetParam]:String(state.recordsFetched),[profile.limitParam]:String(pageSize(profile))}}}case"cursor":{let raw=getByPath(observed.body,profile.nextCursorPath),next=raw==null?"":String(raw).trim();if(next==="")return{kind:"done",reason:"no further cursor"};if(state.cursor!=null&&next===state.cursor)return{kind:"failed",reason:`The source returned the same cursor twice (${next}); paging would not advance.`};let params={[profile.cursorParam]:next};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"link_header":{let url=parseNextLink(observed.linkHeader);if(!url)return{kind:"done",reason:"no rel=next link"};return{kind:"url",url}}default:return{kind:"done",reason:"single request"}}}function pageSize(profile){let declared="pageSize"in profile?profile.pageSize:void 0;return declared&&declared>0?declared:DEFAULT_PAGE_SIZE}function isLastPage(path7,body){if(!path7)return!1;let raw=getByPath(body,path7);if(typeof raw==="boolean")return raw;if(typeof raw==="string")return raw.trim().toLowerCase()==="true";return!1}function parseNextLink(header){if(!header)return null;for(let part of splitLinks(header)){let match=part.match(/<([^>]*)>(.*)/);if(!match)continue;let url=(match[1]??"").trim(),attrs=match[2]??"";if(!url)continue;if(/;\s*rel\s*=\s*["']?\s*next\s*["']?(\s*;|\s*$)/i.test(attrs))return url}return null}function splitLinks(header){let parts=[],depth=0,current="";for(let ch of header){if(ch==="<")depth++;else if(ch===">")depth--;if(ch===","&&depth===0){parts.push(current),current="";continue}current+=ch}if(current.trim()!=="")parts.push(current);return parts}var DEFAULT_MAX_CONCURRENT=4,DEFAULT_MAX_RECORDS=50000;async function collectOne(source,endpoint,params,deps,counters){let profile=endpoint.pagination??{kind:"none"},maxRecords=deps.maxRecords??DEFAULT_MAX_RECORDS,values={...endpoint.queryParams??{},...params.values},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return{ok:!1,error:`This endpoint needs path parameter(s) ${resolved.missing.map((m)=>`{${m}}`).join(", ")} and nothing supplies them. Add a parameter binding, or a static value.`};let baseQuery={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;baseQuery[key2]=value2}let records=[],total=null,state=initialState2(),pageParams=firstPageParams(profile),absoluteUrl=null;for(;;){if(deps.isCancelled?.())return{ok:!1,error:"Cancelled."};let url;if(absoluteUrl)try{url=new URL(absoluteUrl)}catch{return{ok:!1,error:`The source returned an unusable next-page link: ${absoluteUrl}`}}else{let built=buildUrl(source.baseUrl,resolved.path,{...baseQuery,...pageParams});if(!built.ok)return{ok:!1,error:built.error};url=built.url}let headers={accept:"application/json"};if(deps.bearerToken)headers.Authorization=`Bearer ${deps.bearerToken}`;counters.calls++;let outcome=await fetchOnce({...source,token:deps.bearerToken??source.token},{method:endpoint.method,url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl:deps.fetchImpl});if(!outcome.ok)return{ok:!1,error:outcome.error??`HTTP ${outcome.status}`};let raw=extractRecords(outcome.body,endpoint.responseRootPath),childrenPath=treeChildrenPath(endpoint.treeChildrenPath),flattened=childrenPath?flattenTree(raw,childrenPath):null;if(flattened?.truncated)return{ok:!1,error:"This source answered with a structure that nests into itself. Nothing was imported \u2014 a company that contains itself has no order to write it in."};let page=flattened?flattened.records:raw;if(records.push(...page),counters.records+=page.length,total===null)total=reportedTotal(profile,outcome.body);if(counters.records>maxRecords)return{ok:!1,error:`This run would hold more than ${maxRecords} records at once. Narrow the source with a filter, or raise maxRecordsPerRun.`};deps.onProgress?.(counters.records),state={pagesFetched:state.pagesFetched+1,recordsFetched:records.length,cursor:pageParams[cursorParamOf(profile)??""]??state.cursor};let next=nextPage(profile,state,{recordCount:page.length,body:outcome.body,linkHeader:outcome.linkHeader});if(next.kind==="done")break;if(next.kind==="failed")return{ok:!1,error:next.reason};if(next.kind==="url"){absoluteUrl=next.url,pageParams={};continue}absoluteUrl=null,pageParams=next.params}return{ok:!0,records,total}}function cursorParamOf(profile){return profile.kind==="cursor"?profile.cursorParam:null}function describeCallFailure(call,error3){let params=call.values??{},named=Object.entries(params).map(([key2,value2])=>`${key2}=${String(value2)}`).join(", ");return named?`${named}: ${error3}`:error3}async function collectEndpoint(source,endpoint,sources,deps={}){let counters={calls:0,records:0},expansion=expandBindings(endpoint.paramBindings??void 0,sources);if(!expansion.ok)return{ok:!1,callCount:0,error:`This endpoint would be called ${expansion.combinations} times (the ceiling is ${expansion.limit}). Narrow the parent list, or remove one of the parameter bindings.`};if(expansion.calls.length===0)return{ok:!0,records:[],reportedTotal:null,callCount:0};let limit=Math.max(1,deps.maxConcurrent??DEFAULT_MAX_CONCURRENT),collected=[],total=null,failure=null,partial3=[],cursor=0,worker=async()=>{for(;;){if(failure||deps.isCancelled?.())return;let index=cursor++,call=expansion.calls[index];if(!call)return;let result=await collectOne(source,endpoint,call,deps,counters);if(!result.ok){if(expansion.calls.length>1){partial3.push(describeCallFailure(call,result.error));continue}failure??=result.error;return}for(let record3 of result.records)collected.push({record:record3,parent:call.parent});if(expansion.calls.length===1)total=result.total}};if(await Promise.all(Array.from({length:Math.min(limit,expansion.calls.length)},worker)),failure)return{ok:!1,error:failure,callCount:counters.calls};if(deps.isCancelled?.())return{ok:!1,error:"Cancelled.",callCount:counters.calls};if(partial3.length>0&&collected.length===0&&partial3.length===expansion.calls.length)return{ok:!1,error:`Every call to this endpoint failed. First: ${partial3[0]}`,callCount:counters.calls};return{ok:!0,records:collected,reportedTotal:total,callCount:counters.calls,...partial3.length>0?{partialFailures:partial3}:{}}}function isDestructive(writeMode,missingPolicy){return writeMode==="replace"||missingPolicy==="delete"||missingPolicy==="deactivate"}function destructiveGate(input){if(!isDestructive(input.writeMode,input.missingPolicy))return{allowed:!0};if(input.partialFailures>0&&!input.scopedRemoval)return{allowed:!1,kind:"incomplete_source",message:`${input.partialFailures} call(s) in this source never answered, so part of it was not read. This run removes records the source does not send, and those unread records would be removed as if the source had dropped them. Fix the failing call, or switch this mapping to leave missing records alone.`};if(input.fetched===0)return{allowed:!1,kind:"incomplete_source",message:"The source returned no records at all. This run removes what the source does not send, so it would empty the target table. A source that is genuinely empty and one that could "+"not be read look the same from here, so this will not proceed on its own \u2014 preview it, "+"and if the source really is empty, remove the rows deliberately."};if(input.reported!==null&&input.fetched<input.reported)return{allowed:!1,kind:"incomplete_source",message:`The source reports ${input.reported} records but only ${input.fetched} were read. This run deletes what the source does not send, so it will not proceed on a partial read. Check the paging settings for this endpoint.`};return{allowed:!0}}function checkPlanVolume(input){if(input.maxShare<=0)return{allowed:!0};if(input.removing===0||input.existing===0)return{allowed:!0};let share=input.removing/input.existing;if(share<=input.maxShare)return{allowed:!0};let asPercent=(value2)=>`${Math.round(value2*100)}%`;return{allowed:!1,kind:"incomplete_source",message:`This run would remove ${input.removing} of ${input.existing} rows (${asPercent(share)}), which is above the ${asPercent(input.maxShare)} this mapping allows unattended. `+"A source can return perfectly good records and still produce a removal this large \u2014 a "+"changed dedup column, a repointed endpoint, a filter added upstream. Preview the run; if the removal is right, apply it deliberately."}}function orphanLinkNote(input){let{made,unresolved}=input;if(unresolved<=0)return null;let total=made+unresolved,share=total>0?unresolved/total:1,column3=input.column?` (${input.column})`:"",consequence=`${unresolved} record${unresolved===1?"":"s"} could not find the parent to attach to${column3} \u2014 `+"they are drawn at the TOP of the tree, at the same level as the chief executive.";if(share>=0.2)return`${consequence} Next to the ${made} that did attach, that is a large share: either the source is not sending a parent for these people, or one of the matching fields is written differently in the two places. Look at the source before trusting the chart.`;return`${consequence} ${made} link${made===1?" was":"s were"} made.`}function looksLikeKeyDrift(input){if(input.existing<=0)return!1;if(input.creating<=0||input.unmatched<=0)return!1;return input.creating/input.existing>=0.1&&input.unmatched/input.existing>=0.1}function keyDriftWarning(input){if(!looksLikeKeyDrift(input))return null;return`This run will add ${input.creating} rows, and the source no longer sends ${input.unmatched} of the rows already here. Both being this large points at the matching values in the `+"source having changed \u2014 so these are not new records, they are the same records under "+"new names. Run it with \u201Cmissing rows: leave alone\u201D and both generations survive: the "+`table grows to ${input.existing+input.creating} rows, and where records point at each other (an organisation tree, for instance) the new rows cannot find their old parents and the structure breaks. Either switch the policy to delete/deactivate and clean up `+"once, or correct the matching column to the source\u2019s new value."}var referenceKey=(check)=>`${check.entity}.${check.entityColumn}`,pointsAtOwnTable=(check,targetEntity)=>check.entity===targetEntity;function referenceValuesOf(raw){if(Array.isArray(raw))return{values:raw.map((item)=>String(item??"").trim()).filter((item)=>item!==""),wasList:!0};if(raw===null||raw===void 0)return{values:[],wasList:!1};let single=String(raw).trim();return{values:single===""?[]:[single],wasList:!1}}var isEmptyReference=(raw)=>referenceValuesOf(raw).values.length===0;function resolveReference(raw,ids){let{values,wasList}=referenceValuesOf(raw),found=[],unmatched=[];for(let value2 of values){let id=ids?.[value2];if(id===void 0)unmatched.push(value2);else if(!found.includes(id))found.push(id)}return{ids:found,unmatched,wasList}}function resolvedColumnValue(resolution){return resolution.wasList?resolution.ids:resolution.ids[0]??null}function applyReferenceIds(row,references,ids,targetEntity){let next={...row},deferred=[];for(let check of references){if(!check.writeIdTo)continue;let raw=row[check.column];if(pointsAtOwnTable(check,targetEntity)){if(next[check.writeIdTo]=Array.isArray(raw)?[]:null,!isEmptyReference(raw))deferred.push({check,raw});continue}next[check.writeIdTo]=resolvedColumnValue(resolveReference(raw,ids[referenceKey(check)]))}return{row:next,deferred}}function unambiguousIds(rows){let seen=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;seen.set(key2,seen.has(key2)?null:String(row.id))}let ids={};for(let[key2,id]of seen)if(id!==null)ids[key2]=id;return ids}function ambiguousValues(rows){let counts=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;counts.set(key2,(counts.get(key2)??0)+1)}return[...counts.entries()].filter(([,n])=>n>1).map(([key2])=>key2)}var UNRESOLVED_TEMPLATE=/^\s*(\$\{[^}]*\}|\{\{[^}]*\}\})\s*$/,isEmpty2=(v)=>v==null||typeof v==="string"&&(v.trim()===""||UNRESOLVED_TEMPLATE.test(v));function displayValue(value2){if(value2!==null&&typeof value2==="object")try{return JSON.stringify(value2)}catch{return"(a value that cannot be shown)"}return String(value2)}function buildFallbackIdentifier(format2,data){let complete=!0,rendered=format2.replace(/\{([^{}]+)\}/g,(_match,path7)=>{let value2=data[path7.trim()];if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(!complete)return null;let cleaned=foldToAscii(rendered).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"");return cleaned===""?null:cleaned}function missingReferences(row,references,known){let broken=[];for(let check of references){let raw=row[check.column];if(isEmpty2(raw))continue;let value2=displayValue(raw).trim(),present=known[`${check.entity}.${check.entityColumn}`];if(!present)continue;if(!present.has(value2))broken.push({check,value:value2,raw})}return broken}async function loadReferenceValues(references,read2){let values={};for(let check of references){let key2=`${check.entity}.${check.entityColumn}`;if(values[key2])continue;let rows=await read2(check.entity,check.entityColumn);values[key2]=new Set(rows.filter((v)=>!isEmpty2(v)).map((v)=>String(v).trim()))}return values}async function loadReferenceIds(references,targetEntity,read2){let ids={},ambiguous={};for(let check of references){if(!check.writeIdTo)continue;if(pointsAtOwnTable(check,targetEntity))continue;let key2=referenceKey(check);if(ids[key2])continue;let pairs=await read2(check.entity,check.entityColumn);ids[key2]=unambiguousIds(pairs);let shared=ambiguousValues(pairs);if(shared.length>0)ambiguous[key2]=shared}return{ids,ambiguous}}function ambiguityWarnings(ambiguous){return Object.entries(ambiguous).map(([key2,values])=>{let shown=values.slice(0,5).join(", "),rest3=values.length>5?` and ${values.length-5} more`:"";return`${values.length} value(s) in ${key2} belong to more than one row \u2014 ${shown}${rest3}. Records pointing at them are left unlinked rather than linked to whichever row came first.`})}function planWrites(input){let{records,existing,dedupTargetField,writeMode,missingPolicy,missingColumn,missingValue,removalScope=null,originColumn,originValue,requiredFields=[],uniqueFields=[],createDefaults={},accountRule=null,existingAccounts={},references=[],referenceValues={},referenceIds={},targetEntity=""}=input,issues=[],warnings=[],creates=[],referenceInserts=[],accountInserts=[],accountJoinInserts=[],plannedAccounts=new Set,plannedRefs=new Set,updates=[],deletes=[],deactivates=[],departures=[],deferredLinks=[],dedupConfigured=Boolean(dedupTargetField),accountClaims=new Map,accountIdIsUnique=accountRule?uniqueFields.includes(accountRule.idColumn):!1,fillIdentifier=(data)=>{let format2=accountRule?.emailFormat?.trim();if(!accountRule||!format2)return data;if(!isEmpty2(data[accountRule.matchFrom]))return data;let built=buildFallbackIdentifier(format2,data);return built===null?data:{...data,[accountRule.matchFrom]:built}},withAccount=(record3,input2)=>{if(!accountRule)return input2;let data=fillIdentifier(input2),raw=data[accountRule.matchFrom];if(isEmpty2(raw))return issues.push({sourceIndex:record3.sourceIndex,kind:"account_unmatched",field:accountRule.matchFrom,message:`${accountRule.matchFrom} is empty, so this record gets no account \u2014 it is imported without one.`,dedupKey:record3.dedupKey,row:data}),data;let value2=String(raw).trim(),claimedBy=accountClaims.get(value2);if(claimedBy&&accountIdIsUnique)return issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field:accountRule.matchFrom,value:String(value2),message:`${accountRule.matchFrom} is \u201C${value2}\u201D, which another record in this import already uses \u2014 and ${accountRule.idColumn} allows one record per account. This one is left out.`,dedupKey:record3.dedupKey,row:data,keptRow:claimedBy.data}),null;accountClaims.set(value2,record3);let existingId=existingAccounts[value2];if(existingId)return{...data,[accountRule.idColumn]:existingId};if(!plannedAccounts.has(value2)){plannedAccounts.add(value2);let accountData={[accountRule.matchColumn]:value2};for(let pair of accountRule.values??[]){let from=data[pair.from];if(!isEmpty2(from))accountData[pair.column]=from}accountInserts.push({entity:accountRule.entity,matchColumn:accountRule.matchColumn,matchValue:value2,data:accountData});for(let join7 of accountRule.joins??[])accountJoinInserts.push({entity:join7.entity,accountColumn:join7.accountColumn,values:join7.values,matchValue:value2})}return data},hasDefaults=Object.keys(createDefaults).length>0,stamp2=originColumn?{[originColumn]:originValue}:{},newRecord=(data)=>hasDefaults?{...createDefaults,...data,...stamp2}:{...data,...stamp2},existingByKey=new Map;if(dedupTargetField)for(let row of existing){let value2=row.row[dedupTargetField];if(!isEmpty2(value2))existingByKey.set(String(value2).trim(),row)}let claimedUnique=new Map;for(let field of uniqueFields){let taken=new Map;for(let existingRow of existing){let value2=existingRow.row[field];if(!isEmpty2(value2))taken.set(String(value2).trim(),existingRow.id)}claimedUnique.set(field,taken)}let ownsRow=(row)=>{if(!originColumn)return!0;let value2=row.row[originColumn];return String(value2??"")===String(originValue??"")},matchedIds=new Set,seenIds=new Set,seenInBatch=new Map;for(let sourceRecord of records){let broken=missingReferences(sourceRecord.data,references,referenceValues),resolvedRow=applyReferenceIds(sourceRecord.data,references,referenceIds,targetEntity),record3={...sourceRecord,data:fillIdentifier(resolvedRow.row)};if(record3.dedupKey!=null){let carried=existingByKey.get(record3.dedupKey);if(carried)seenIds.add(carried.id)}for(let link of resolvedRow.deferred){if(!dedupTargetField)continue;let matchValue=record3.data[dedupTargetField];if(isEmpty2(matchValue))continue;deferredLinks.push({matchColumn:dedupTargetField,matchValue:String(matchValue).trim(),writeIdTo:link.check.writeIdTo,lookupColumn:link.check.entityColumn,raw:link.raw,isList:Array.isArray(link.raw)})}let blocking=broken.find((b)=>b.check.onMissing==="skipRecord");if(blocking){let{check,value:value2}=blocking;issues.push({sourceIndex:record3.sourceIndex,kind:"missing_reference",message:typeof blocking.raw==="object"&&blocking.raw!==null?`${check.column} is not a single value but a whole object \u2014 ${value2}. Point the mapping at one field of it, e.g. \`${check.column}.code\`, and it will have something to match against ${check.entity}.${check.entityColumn}.`:`${check.column} is \u201C${value2}\u201D, which does not exist in ${check.entity}.${check.entityColumn} \u2014 this record is left out.`,dedupKey:record3.dedupKey,row:record3.data,reference:{column:check.column,value:value2,entity:check.entity,entityColumn:check.entityColumn}});continue}let keepReferences=()=>{for(let{check,value:value2}of broken){if(check.onMissing!=="create")continue;let token=`${check.entity}.${check.entityColumn}::${value2}`;if(plannedRefs.has(token))continue;plannedRefs.add(token);let data={};for(let pair of check.createValues??[]){let fromSource=isTemplateSource(pair.from)?renderTemplate(pair.from,record3.external,record3.parent):readSourceValue(record3.external,record3.parent,pair.from),value3=isEmpty2(fromSource)?record3.data[pair.from]:fromSource;if(!isEmpty2(value3))data[pair.column]=value3}referenceInserts.push({entity:check.entity,column:check.entityColumn,value:value2,...Object.keys(data).length>0?{data}:{}})}},uniqueCollision=(data,ownRowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;let value2=String(raw).trim(),holder3=claimedUnique.get(field)?.get(value2);if(holder3===void 0)continue;if(holder3!==null&&holder3===ownRowId)continue;return{field,value:value2}}return null},claimUnique=(data,rowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;claimedUnique.get(field)?.set(String(raw).trim(),rowId)}},collide=(field,value2)=>{issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field,value:String(value2),message:`${field} is \u201C${value2}\u201D, which something else already has \u2014 ${field} has to be unique, so this record is left out.`,dedupKey:record3.dedupKey,row:record3.data})},missingRequired=requiredFields.filter((f)=>isEmpty2(record3.data[f])&&isEmpty2(createDefaults[f]));if(missingRequired.length>0){issues.push({sourceIndex:record3.sourceIndex,kind:"missing_required",field:missingRequired.join(", "),message:`Required field(s) empty: ${missingRequired.join(", ")}`,dedupKey:record3.dedupKey,row:record3.data});continue}if(!dedupConfigured){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}if(record3.dedupKey==null){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}issues.push({sourceIndex:record3.sourceIndex,kind:"missing_dedup_key",message:"Deduplication field is empty on this record \u2014 it will be added as new."}),keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let claimedBy=seenInBatch.get(record3.dedupKey);if(claimedBy){issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_in_batch",value:String(record3.dedupKey??""),message:`The source carries this key more than once: ${record3.dedupKey} \u2014 this occurrence is skipped.`,dedupKey:record3.dedupKey,row:record3.data,keptRow:claimedBy});continue}if(seenInBatch.set(record3.dedupKey,record3.data),writeMode==="replace"||writeMode==="append"){let clash2=uniqueCollision(record3.data,null);if(clash2&&!(writeMode==="replace"&&claimedUnique.get(clash2.field)?.get(clash2.value))){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let match=existingByKey.get(record3.dedupKey),clash=uniqueCollision(record3.data,match?.id??null);if(clash){collide(clash.field,clash.value);continue}if(keepReferences(),claimUnique(record3.data,match?.id??null),match)matchedIds.add(match.id),updates.push({id:match.id,data:{...record3.data,...stamp2},before:match.row,sourceIndex:record3.sourceIndex});else{let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex})}}if(writeMode==="replace")deletes.push(...existing);else if(writeMode==="upsert"&&missingPolicy!=="ignore"){let wasRead=(row)=>{if(!removalScope)return!0;let value2=row.row[removalScope.column];if(isEmpty2(value2))return!1;return removalScope.readValues.includes(String(value2).trim())},gone=existing.filter((row)=>!seenIds.has(row.id)).filter((row)=>ownsRow(row)).filter(wasRead);if(missingPolicy==="delete")deletes.push(...gone);else deactivates.push(...gone);departures.push(...gone)}if(writeMode==="upsert"&&missingPolicy==="ignore"){let owned=existing.filter((row)=>ownsRow(row)),unmatched=owned.filter((row)=>!seenIds.has(row.id)).length,drift=keyDriftWarning({creating:creates.length,unmatched,existing:owned.length});if(drift)warnings.push(drift)}if(!dedupConfigured&&writeMode==="upsert")warnings.push("No deduplication field is set. Nothing can be matched against what is already here, so every record is added as new and each run will duplicate the last.");if(dedupConfigured&&records.length>0&&records.every((r)=>r.dedupKey==null))warnings.push(`The deduplication field is empty on every record \u2014 it is probably not among the mapped fields. As it stands nothing can ever match: all ${records.length} records will be re-added on every run.`);if(writeMode==="append"&&dedupConfigured)warnings.push("Append mode ignores the deduplication field: records already here will be added again.");if(writeMode==="replace"){if(warnings.push(`Replace mode: all ${existing.length} rows currently in the table are deleted and rebuilt from the source. Row identifiers change, so anything referring to them by id breaks.`),dedupConfigured)warnings.push('A deduplication field is set, so "update existing" would keep the current rows and their identifiers. Replace mode is only necessary when records cannot be matched at all.')}if(deactivates.length>0&&(!missingColumn||isEmpty2(missingValue)))warnings.push('The policy for records missing from the source is "deactivate", but no column and value are configured \u2014 those rows will be left untouched.'),deactivates.length=0;return{creates,updates,deletes,deactivates,departures,deferredLinks,issues,warnings,referenceInserts,accountInserts,accountJoinInserts}}var SKIPPING_ISSUE_KINDS=new Set(["missing_required","duplicate_in_batch","duplicate_value","invalid_value","missing_reference"]);function skippedRecordCount(issues){let records=new Set;for(let issue of issues){if(!SKIPPING_ISSUE_KINDS.has(issue.kind))continue;if(issue.sourceIndex<0)continue;records.add(issue.sourceIndex)}return records.size}function summarize(ops,meta){let sampleSize=meta.sampleSize??8,sample=[...ops.creates.map((c)=>c.data),...ops.updates.map((u)=>u.data)].slice(0,sampleSize);return{targetEntity:meta.targetEntity,writeMode:meta.writeMode,totalFetched:meta.totalFetched,reportedTotal:meta.reportedTotal,toCreate:ops.creates.length,toUpdate:ops.updates.length,toSkip:skippedRecordCount(ops.issues),missing:ops.deletes.length+ops.deactivates.length,missingPolicy:meta.missingPolicy,existingCount:meta.existingCount,dedupConfigured:meta.dedupConfigured,issues:ops.issues,warnings:ops.warnings,referenceInserts:ops.referenceInserts,accountsToCreate:ops.accountInserts.length,sample}}function removalScopeFor(column3,records){if(!column3)return null;let readValues=new Set;for(let record3 of records){let value2=record3.data[column3];if(!isEmpty2(value2))readValues.add(String(value2).trim())}return{column:column3,readValues:[...readValues]}}init_AccountLink();import{and as and24,eq as eq38,inArray as inArray16}from"drizzle-orm";var INSERT_CHUNK=500,DELETE_CHUNK=1000;function validateAll(ops,columns,validatePayload2){let issues=[];for(let op of ops.creates){let result=validatePayload2(op.data,columns,!1);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}for(let op of ops.updates){let result=validatePayload2(op.data,columns,!0);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}return issues}function referenceRow(columns,column3,value2,extra){let row={...extra,[column3]:value2},unfillable=[];for(let col8 of columns){let name2=camel(col8.name);if(name2===column3)continue;if(SYSTEM_COLUMNS.has(name2))continue;if(row[name2]!==void 0)continue;if(!(col8.notNull===!0&&col8.default===void 0&&!col8.defaultRaw&&!col8.nullable))continue;if(TEXTUAL_TYPES.has(String(col8.type)))row[name2]=value2;else unfillable.push(name2)}return unfillable.length>0?{ok:!1,unfillable}:{ok:!0,row}}var SYSTEM_COLUMNS=new Set(["id","createdAt","updatedAt","createdBy","updatedBy"]),TEXTUAL_TYPES=new Set(["text","varchar","char"]),camel=(s)=>s.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase());function linkAccount(data,rule,idByValue){let value2=data[rule.matchFrom];if(value2==null)return{};let id=idByValue.get(String(value2).trim());return id?{[rule.idColumn]:id}:{}}function groupDeferred(links){let groups=new Map;for(let link of links){let key2=`${link.writeIdTo}|${link.lookupColumn}|${link.matchColumn}`,group=groups.get(key2)??{writeIdTo:link.writeIdTo,lookupColumn:link.lookupColumn,matchColumn:link.matchColumn,links:[]};group.links.push(link),groups.set(key2,group)}return[...groups.values()]}async function applyWrites(deps,input){let{ops,targetEntity,userId}=input,scope=input.scopeConditions??[],writeIssues=[],cancelled=()=>input.isCancelled?.()===!0,invalid=validateAll(ops,deps.columns,deps.validatePayload);if(invalid.length>0)return{ok:!1,failure:{kind:"validation_failed",message:`${invalid.length} record(s) did not pass validation; nothing was written.`,issues:invalid}};let refGroups=new Map;for(let insert of ops.referenceInserts){let resolved=deps.resolveEntity?.(insert.entity);if(!resolved)return{ok:!1,failure:{kind:"write_failed",message:`This mapping would add \u201C${insert.value}\u201D to "${insert.entity}", which does not exist.`}};let built=referenceRow(resolved.columns,insert.column,insert.value,insert.data);if(!built.ok)return{ok:!1,failure:{kind:"write_failed",message:`\u201C${insert.value}\u201D cannot be added to "${insert.entity}" automatically: ${built.unfillable.join(", ")} is required and cannot be filled from a ${insert.column}. Add the missing ${insert.entity} by hand, or set this reference to leave those records out.`}};let group=refGroups.get(insert.entity)??{table:resolved.table,rows:[]};group.rows.push(built.row),refGroups.set(insert.entity,group)}let accountRule=input.account??null,accountEntity=ops.accountInserts[0]?.entity,accountTable=accountEntity?deps.resolveEntity?.(accountEntity):null;if(ops.accountInserts.length>0&&(!accountRule||!accountTable))return{ok:!1,failure:{kind:"write_failed",message:accountRule?`This import creates accounts in "${accountEntity}", which does not exist.`:"This import creates accounts but no password was supplied, so nothing was written."}};if(cancelled())return{ok:!1,failure:{kind:"cancelled",message:"Cancelled before writing."}};let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,failure:{kind:"write_failed",message:`Target "${targetEntity}" has no id column; the engine cannot address its rows.`}};let preImages=[],now=new Date,deactivating=ops.deactivates.length>0&&input.missingColumn&&input.missingValue!=null?{column:input.missingColumn,value:input.missingValue}:null;try{let linksMade=0,linksUnresolved=0;return{ok:!0,...await deps.db.transaction(async(tx)=>{let created=0,accountsCreated=0,referencesCreated=0,updated=0,deleted=0,deactivated=0,accountsClosed=0;if(ops.deletes.length>0){let ids=ops.deletes.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and24(inArray16(idCol,chunk),...scope):inArray16(idCol,chunk),removed=await tx.delete(deps.drizzleTable).where(where).returning();deleted+=removed.length;for(let row of removed)preImages.push({targetEntity,rowId:String(row.id),action:"delete",before:row,after:null})}}for(let op of ops.updates){if(cancelled())throw new CancelledError;let where=scope.length?and24(eq38(idCol,op.id),...scope):eq38(idCol,op.id),written=await tx.update(deps.drizzleTable).set({...op.data,updatedAt:now,updatedBy:userId}).where(where).returning();if(written.length===0)throw new ScopeError(op.id);updated+=written.length,preImages.push({targetEntity,rowId:op.id,action:"update",before:op.before,after:written[0]??null})}if(deactivating){let ids=ops.deactivates.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and24(inArray16(idCol,chunk),...scope):inArray16(idCol,chunk),written=await tx.update(deps.drizzleTable).set({[deactivating.column]:deactivating.value,updatedAt:now,updatedBy:userId}).where(where).returning();deactivated+=written.length;let beforeById=new Map(ops.deactivates.map((r)=>[r.id,r.row]));for(let row of written){let id=String(row.id);preImages.push({targetEntity,rowId:id,action:"deactivate",before:beforeById.get(id)??null,after:row})}}}if(deps.accountClosure){let written=new Set(preImages.filter((image)=>image.action==="delete"||image.action==="deactivate").map((image)=>image.rowId)),removedRows=ops.departures.filter((row)=>written.has(row.id)).map((row)=>row.row),leaverIds=accountIdsIn(removedRows,deps.accountClosure.userColumn);if(leaverIds.length>0){let closed=await closeAccounts({db:tx,usersTable:deps.accountClosure.usersTable,sessionsTable:deps.accountClosure.sessionsTable,atomic:!0,onError:(error3)=>{deps.logger.error("[Integrations] A departure\u2019s account stayed open",{error:error3})}},leaverIds);accountsClosed=closed.closed;for(let userId2 of closed.closedIds)preImages.push({targetEntity:deps.accountClosure.accountEntity,rowId:userId2,action:"update",before:{isActive:!0},after:{isActive:!1}});if(closed.closed>0&&!closed.signedOut)writeIssues.push({sourceIndex:-1,kind:"account_sessions_not_cleared",value:String(closed.closed),message:`${closed.closed} account(s) behind removed records were deactivated, but their open sessions could not be cleared \u2014 those people stay signed in until the session expires.`})}}for(let[entity,group]of refGroups){let rows=group.rows.map((r)=>({...r,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(group.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();referencesCreated+=written.length;for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}let accountIdByValue=new Map;if(accountRule&&accountTable&&ops.accountInserts.length>0){let rows=ops.accountInserts.map((account)=>({...account.data,[accountRule.passwordColumn]:accountRule.passwordHash,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(accountTable.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();accountsCreated+=written.length;for(let row of written){let value2=row[accountRule.matchColumn];if(row.id!=null&&value2!=null)accountIdByValue.set(String(value2).trim(),String(row.id));preImages.push({targetEntity:ops.accountInserts[0]?.entity??"",rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(accountRule&&ops.accountJoinInserts.length>0){let byEntity=new Map;for(let join7 of ops.accountJoinInserts){let accountId=accountIdByValue.get(join7.matchValue);if(!accountId){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`No account was found for \u201C${join7.matchValue}\u201D, so its ${join7.entity} row was not written \u2014 that person can sign in and do nothing.`});continue}let rows=byEntity.get(join7.entity)??[];rows.push({...join7.values,[join7.accountColumn]:accountId,createdAt:now,updatedAt:now,createdBy:userId}),byEntity.set(join7.entity,rows)}for(let[entity,rows]of byEntity){let resolved=deps.resolveEntity?.(entity);if(!resolved){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`The \u201C${entity}\u201D table is not available here, so ${rows.length} role membership(s) were not written. The accounts exist but hold no role.`});continue}for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(resolved.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(ops.creates.length>0){let rows=ops.creates.map((c)=>({...c.data,...accountRule&&c.data[accountRule.idColumn]==null?linkAccount(c.data,accountRule,accountIdByValue):{},createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let chunk=rows.slice(i,i+INSERT_CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();created+=written.length;for(let row of written)preImages.push({targetEntity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}if(ops.deferredLinks.length>0)for(let group of groupDeferred(ops.deferredLinks)){if(cancelled())throw new CancelledError;let lookupCol=deps.resolveCol(group.lookupColumn),matchCol=deps.resolveCol(group.matchColumn),targetCol=deps.resolveCol(group.writeIdTo);if(!lookupCol||!matchCol||!targetCol){deps.logger.error(`[Integrations] Cannot fill "${group.writeIdTo}": ${[!lookupCol?group.lookupColumn:null,!matchCol?group.matchColumn:null,!targetCol?group.writeIdTo:null].filter(Boolean).join(", ")} is not a column of "${targetEntity}".`);continue}let rows=await tx.select({v:lookupCol,id:idCol}).from(deps.drizzleTable),idByValue={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!idByValue[key2])idByValue[key2]=String(row.id)}let imageByMatch=new Map;for(let image of preImages){let value2=image.after?.[group.matchColumn];if(value2!=null)imageByMatch.set(String(value2).trim(),image)}for(let link of group.links){let resolution=resolveReference(link.raw,idByValue);if(resolution.ids.length===0){linksUnresolved+=1;continue}let value2=link.isList?resolution.ids:resolution.ids[0],where=scope.length?and24(eq38(matchCol,link.matchValue),...scope):eq38(matchCol,link.matchValue);if((await tx.update(deps.drizzleTable).set({[group.writeIdTo]:value2}).where(where).returning()).length===0){linksUnresolved+=1;continue}linksMade+=1;let image=imageByMatch.get(String(link.matchValue).trim());if(image?.after)image.after={...image.after,[group.writeIdTo]:value2}}}return{created,accountsCreated,referencesCreated,updated,deleted,deactivated,accountsClosed,linksMade,linksUnresolved}}),preImages,issues:writeIssues}}catch(error3){if(error3 instanceof CancelledError)return{ok:!1,failure:{kind:"cancelled",message:"Cancelled while writing; the transaction was rolled back and nothing changed."}};if(error3 instanceof ScopeError)return{ok:!1,failure:{kind:"write_failed",message:`Row ${error3.rowId} is outside what this account may write. Nothing was written.`}};return deps.logger.error(`[Integrations] Write transaction failed for "${targetEntity}": ${reasonOf2(error3)}`),{ok:!1,failure:{kind:"write_failed",message:"The database rejected this import; it was rolled back and nothing changed."}}}}function reasonOf2(error3){if(!(error3 instanceof Error))return String(error3);let extra=error3;return[error3.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.constraint?`constraint: ${String(extra.constraint)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}class CancelledError extends Error{constructor(){super("cancelled");this.name="CancelledError"}}class ScopeError extends Error{rowId;constructor(rowId){super(`row ${rowId} outside scope`);this.rowId=rowId;this.name="ScopeError"}}var DAY_MS=86400000;async function executeRun(context,deps,lock){let{mapping,source}=context,empty={runId:null,status:"failed",failure:null,plan:null,created:0,accountsCreated:0,referencesCreated:0,updated:0,deleted:0,deactivated:0,externalCalls:0,issues:[]},opened=await deps.repo.openRun({mappingId:mapping.id,targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,trigger:context.trigger,userId:context.userId});if(!opened.ok)return{...empty,failure:{kind:"write_failed",message:`Could not open a run record: ${opened.error}`}};let runId=opened.runId;deps.onRunOpened?.(runId);let cancelChecked=0,cancelSeen=!1,isCancelled=()=>{if(cancelSeen)return!0;if(deps.abortSignal?.aborted)return cancelSeen=!0,!0;if(!lock.isHeld())return cancelSeen=!0,!0;return!1},refreshCancelFlag=async()=>{if(cancelChecked++,await deps.repo.isCancelRequested(runId))cancelSeen=!0},progress=(p)=>deps.publishProgress?.({runId,...p}),preImagesStored=!0,finish=async(outcome)=>{let revertible=outcome.status==="succeeded"&&preImagesStored;return await deps.repo.closeRun(runId,{status:outcome.status,totalFetched:outcome.plan?.totalFetched??0,sourceReportedTotal:outcome.plan?.reportedTotal??null,createdCount:outcome.created,accountsCreatedCount:outcome.accountsCreated,referencesCreatedCount:outcome.referencesCreated,updatedCount:outcome.updated,skippedCount:outcome.plan?.toSkip??0,deletedCount:outcome.deleted,deactivatedCount:outcome.deactivated,errorCount:outcome.failure?1:0,externalCallCount:outcome.externalCalls,issues:outcome.issues,errors:outcome.failure?[outcome.failure.message]:[],finishedAt:new Date,preImagesExpireAt:revertible?new Date(Date.now()+(deps.retainPreImagesMs??30*DAY_MS)):null}),progress({phase:"done",message:outcome.failure?.message}),{runId,...outcome}};progress({phase:"fetching"});let nodes=context.endpoints.map((e)=>({id:e.id,paramBindings:e.paramBindings??void 0})),order=planFetchOrder(nodes,[context.rootEndpointId]);if(!order.ok){let failure=order.reason==="cycle"?{kind:"cycle_detected",message:`These endpoints depend on each other in a loop (${order.chain.join(" \u2192 ")}), so there is no correct place to start.`,chain:order.chain}:{kind:"fetch_failed",message:`"${order.requiredBy}" takes a parameter from an endpoint that no longer exists (${order.missing}).`};return finish({...empty,failure,status:"failed"})}let bearerToken=null;if(context.oauth){let token=await getAccessToken(context.oauth,deps.tokenCache,{fetchImpl:deps.fetchImpl});if(!token.ok)return finish({...empty,failure:{kind:"fetch_failed",message:token.error}});bearerToken=token.accessToken}let byId=new Map(context.endpoints.map((e)=>[e.id,e])),parents={},entityValues={},externalCalls=0,rootRecords=[],fetchWarnings=[],reportedTotal2=null;for(let endpointId of order.order){let endpoint=byId.get(endpointId);if(!endpoint)continue;if(await refreshCancelFlag(),isCancelled())return finish({...empty,status:"cancelled",externalCalls,failure:{kind:"cancelled",message:"Cancelled before anything was written."}});for(let key2 of entityValueKeys(endpoint.paramBindings??void 0)){if(entityValues[key2])continue;let[entity,field]=key2.split(".");entityValues[key2]=await deps.repo.readEntityColumn(entity,field)}let collected=await collectEndpoint(source,endpoint,{parents,entityValues},{fetchImpl:deps.fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrentFanout,maxRecords:deps.maxRecordsPerRun,isCancelled,onProgress:(n)=>progress({phase:"fetching",processed:n})});if(externalCalls+=collected.callCount,!collected.ok){let cancelled=isCancelled();return finish({...empty,externalCalls,status:cancelled?"cancelled":"failed",failure:cancelled?{kind:"cancelled",message:"Cancelled before anything was written."}:{kind:"fetch_failed",message:collected.error}})}if(collected.partialFailures?.length)fetchWarnings.push(...collected.partialFailures.map((failure)=>`Could not read part of this source \u2014 ${failure}`));if(parents[endpointId]=collected.records.map((r)=>r.record),endpointId===context.rootEndpointId)rootRecords=collected.records,reportedTotal2=collected.reportedTotal}for(let id of Object.keys(parents))if(!(id===context.rootEndpointId||context.endpoints.some((e)=>parentEndpointIds(e.paramBindings??void 0).includes(id))))delete parents[id];let verdict=destructiveGate({writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,fetched:rootRecords.length,reported:reportedTotal2,partialFailures:fetchWarnings.length,scopedRemoval:Boolean(mapping.removalScopeColumn)});if(!verdict.allowed)return finish({...empty,externalCalls,failure:{kind:verdict.kind,message:fetchWarnings.length?`${verdict.message}
 
 ${fetchWarnings.join(`
 `)}`:verdict.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"mapping",total:rootRecords.length});let mapped3=buildMappedRecords(rootRecords.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,rootRecords.map((r)=>r.parent));if(await refreshCancelFlag(),isCancelled())return finish({...empty,externalCalls,status:"cancelled",failure:{kind:"cancelled",message:"Cancelled before anything was written."}});let existing=await deps.repo.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column3)=>deps.repo.readEntityColumn(entity,column3)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column3)=>deps.repo.readEntityPairsBy(entity,column3)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await deps.repo.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,removalScope:removalScopeFor(mapping.removalScopeColumn,mapped3.records),originColumn:mapping.originColumn,originValue:mapping.originValue,requiredFields:deps.repo.requiredFields(mapping.targetEntity),uniqueFields:deps.repo.uniqueFields(mapping.targetEntity),createDefaults:context.createDefaults??{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous)),ops.warnings.unshift(...fetchWarnings);let plan=summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:rootRecords.length,reportedTotal:reportedTotal2,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)}),volume=checkPlanVolume({removing:ops.deletes.length+ops.deactivates.length,existing:existing.length,maxShare:mapping.maxRemovalShare??0});if(!volume.allowed)return finish({...empty,externalCalls,failure:{kind:volume.kind,message:volume.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"writing",total:ops.creates.length+ops.updates.length});let applied=await applyWrites(deps.writer,{ops,targetEntity:mapping.targetEntity,userId:context.userId,account:mapping.accountRule&&context.accountPasswordHash?{idColumn:mapping.accountRule.idColumn,matchColumn:mapping.accountRule.matchColumn,matchFrom:mapping.accountRule.matchFrom,passwordColumn:mapping.accountRule.passwordColumn,passwordHash:context.accountPasswordHash}:null,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,isCancelled});if(!applied.ok){let failureIssues=applied.failure.kind==="validation_failed"?applied.failure.issues:[];return finish({...empty,plan,externalCalls,issues:[...ops.issues,...failureIssues],status:applied.failure.kind==="cancelled"?"cancelled":"failed",failure:applied.failure})}return preImagesStored=await deps.repo.savePreImages(runId,applied.preImages),deps.logger.info("[Integrations] Run finished",{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,cancelChecks:cancelChecked}),finish({...empty,status:"succeeded",plan,failure:null,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,issues:[...ops.issues,...applied.issues,...orphanIssues(applied)]})}function orphanIssues(applied){let note=orphanLinkNote({made:applied.linksMade,unresolved:applied.linksUnresolved});return note?[{sourceIndex:-1,kind:"parent_unresolved",message:note}]:[]}var RANGES=[[0,59],[0,23],[1,31],[1,12],[0,6]],NAMES=["minute","hour","day of month","month","day of week"];function expandField(raw,[min,max]){let values=new Set;for(let part of raw.split(",")){let[spec,stepText]=part.split("/"),step=stepText===void 0?1:Number(stepText);if(!Number.isInteger(step)||step<1)return null;let from,to;if(spec==="*")from=min,to=max;else if(spec?.includes("-")){let[a,b]=spec.split("-").map(Number);if(!Number.isInteger(a)||!Number.isInteger(b))return null;from=a,to=b}else{let one=Number(spec);if(!Number.isInteger(one))return null;from=one,to=stepText===void 0?one:max}if(from<min||to>max||from>to)return null;for(let v=from;v<=to;v+=step)values.add(v)}return values.size>0?values:null}function parseCron2(expression){let parts=expression.trim().split(/\s+/);if(parts.length!==5)return{ok:!1,error:`A schedule has five parts \u2014 minute hour day-of-month month day-of-week \u2014 and this has ${parts.length}. "0 2 * * *" is every night at 02:00.`};let sets2=[];for(let i=0;i<5;i++){let field=expandField(parts[i],RANGES[i]);if(!field)return{ok:!1,error:`The ${NAMES[i]} part ("${parts[i]}") is not something I can read.`};sets2.push(field)}return{ok:!0,fields:{minutes:sets2[0],hours:sets2[1],daysOfMonth:sets2[2],months:sets2[3],daysOfWeek:sets2[4],anyDayOfMonth:parts[2]==="*",anyDayOfWeek:parts[4]==="*"}}}function partsIn2(when2,timeZone){let formatter=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",weekday:"short"}),parts={};for(let part of formatter.formatToParts(when2))parts[part.type]=part.value;let weekdays=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{year:Number(parts.year),month:Number(parts.month),day:Number(parts.day),hour:Number(parts.hour)%24,minute:Number(parts.minute),weekday:Math.max(0,weekdays.indexOf(parts.weekday??"Sun"))}}function matchesCron(fields,when2,timeZone){let at=partsIn2(when2,timeZone);if(!fields.minutes.has(at.minute))return!1;if(!fields.hours.has(at.hour))return!1;if(!fields.months.has(at.month))return!1;let dayOfMonthMatches=fields.daysOfMonth.has(at.day),dayOfWeekMatches=fields.daysOfWeek.has(at.weekday);if(fields.anyDayOfMonth&&fields.anyDayOfWeek)return!0;if(fields.anyDayOfMonth)return dayOfWeekMatches;if(fields.anyDayOfWeek)return dayOfMonthMatches;return dayOfMonthMatches||dayOfWeekMatches}var CATCH_UP_MINUTES=1500,MINUTE_MS=60000;function isDue(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{due:!1,error:parsed.error};let zone=input.timeZone?.trim()||"UTC",nowMinute=Math.floor(input.now.getTime()/MINUTE_MS),lookBack=0;if(input.lastRunAt){let lastMinute=Math.floor(input.lastRunAt.getTime()/MINUTE_MS);if(lastMinute>=nowMinute)return{due:!1};lookBack=Math.min(nowMinute-lastMinute-1,CATCH_UP_MINUTES)}try{for(let back=0;back<=lookBack;back++){let at=new Date((nowMinute-back)*MINUTE_MS);if(matchesCron(parsed.fields,at,zone))return{due:!0}}}catch{return{due:!1,error:`"${zone}" is not a timezone this system knows.`}}return{due:!1}}function describeCron(expression,timeZone){let parsed=parseCron2(expression);if(!parsed.ok)return parsed.error;let zone=timeZone?.trim()||"UTC",parts=expression.trim().split(/\s+/),[minute,hour,dayOfMonth,month,dayOfWeek]=parts,everyMinutes=minute?.startsWith("*/")?Number(minute.slice(2)):null;if(everyMinutes&&hour==="*"&&dayOfMonth==="*"&&month==="*"&&dayOfWeek==="*")return`Every ${everyMinutes} minutes.`;let time2=minute!==void 0&&hour!==void 0&&!minute.includes("*")&&!hour.includes("*")?`${hour.padStart(2,"0")}:${minute.padStart(2,"0")}`:null,DAYS=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"];if(time2&&dayOfWeek!=="*"&&dayOfMonth==="*")return`Every ${[...parsed.fields.daysOfWeek??[]].map((d)=>DAYS[d]).join(", ")} at ${time2} (${zone}).`;if(time2&&dayOfMonth!=="*")return`On day ${dayOfMonth} of the month at ${time2} (${zone}).`;if(time2)return`Every day at ${time2} (${zone}).`;return`On the schedule "${expression}" (${zone}).`}function nextFireTimes(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{times:[],error:parsed.error};let zone=input.timeZone?.trim()||"UTC",count2=Math.max(1,Math.min(input.count??5,50)),horizon=Math.max(1,Math.min(input.horizonDays??400,400)),times=[],startMinute=Math.floor(input.from.getTime()/MINUTE_MS)+1,limit=horizon*24*60;try{for(let offset=0;offset<limit&&times.length<count2;offset+=1){let when2=new Date((startMinute+offset)*MINUTE_MS);if(matchesCron(parsed.fields,when2,zone))times.push(when2)}}catch{return{times:[],error:`"${zone}" is not a timezone this system knows.`}}return{times}}var MINUTE2=60000;function dueMappings(mappings,now){let due=[],problems=[];for(let mapping of mappings){if(!mapping.scheduleCron?.trim())continue;let answer=isDue({expression:mapping.scheduleCron,timeZone:mapping.scheduleTimezone,now,lastRunAt:mapping.lastRunAt??null});if(answer.error){problems.push({mapping,error:answer.error});continue}if(answer.due)due.push(mapping)}return{due,problems}}function startScheduler(deps){let now=deps.now??(()=>new Date),reported=new Set,stopped=!1,tick=async()=>{if(stopped)return;let mappings;try{mappings=await deps.listScheduled()}catch(error3){deps.logger.error("[Integrations] Could not read the schedules",{error:error3 instanceof Error?error3.message:String(error3)});return}let{due,problems}=dueMappings(mappings,now());for(let problem of problems){let token=`${problem.mapping.id}:${problem.error}`;if(reported.has(token))continue;reported.add(token),deps.logger.error(`[Integrations] "${problem.mapping.name}" has a schedule that cannot run: ${problem.error}`)}for(let mapping of due)try{if(await deps.startRun(mapping.id))deps.logger.info(`[Integrations] Scheduled import started: ${mapping.name}`)}catch(error3){deps.logger.error(`[Integrations] Scheduled import failed to start: ${mapping.name}`,{error:error3 instanceof Error?error3.message:String(error3)})}},timer=setInterval(()=>{tick()},MINUTE2);if(typeof timer==="object"&&timer&&"unref"in timer)timer.unref();return{stop:()=>{stopped=!0,clearInterval(timer)}}}var asObject=(value2)=>value2&&typeof value2==="object"&&!Array.isArray(value2)?value2:null,asArray=(value2)=>Array.isArray(value2)?value2:[],text2=(value2)=>{if(value2==null)return null;let s=String(value2);return s===""?null:s};function buildTransferDocument(input){let{source,endpoints,mappings}=input,nameById=new Map;for(let endpoint of endpoints){let id=text2(endpoint.id),name2=text2(endpoint.name);if(id&&name2)nameById.set(id,name2)}return{version:1,exportedAt:input.exportedAt,secretsExcluded:!0,connection:{name:String(source.name??""),slug:String(source.slug??""),baseUrl:String(source.baseUrl??""),description:text2(source.description),authType:String(source.authType??"none"),authHeaderName:text2(source.authHeaderName),authQueryParam:text2(source.authQueryParam),extraHeaders:asObject(source.extraHeaders),tokenUrl:text2(source.tokenUrl),oauthGrantType:text2(source.oauthGrantType),oauthClientId:text2(source.oauthClientId),oauthUsername:text2(source.oauthUsername),oauthScope:text2(source.oauthScope),oauthClientAuth:text2(source.oauthClientAuth),tlsVerify:source.tlsVerify!==!1,timeoutMs:typeof source.timeoutMs==="number"?source.timeoutMs:null,enabled:source.enabled!==!1},endpoints:endpoints.map((endpoint)=>({name:String(endpoint.name??""),tag:String(endpoint.tag??""),method:String(endpoint.method??"GET"),path:String(endpoint.path??""),description:text2(endpoint.description),queryParams:asObject(endpoint.queryParams),requestBody:asObject(endpoint.requestBody),responseRootPath:text2(endpoint.responseRootPath),treeChildrenPath:text2(endpoint.treeChildrenPath),pagination:asObject(endpoint.pagination),paramBindings:asArray(endpoint.paramBindings).map((binding)=>{if(binding.from!=="endpoint")return{...binding};let{endpointId,...rest3}=binding;return{...rest3,endpointName:nameById.get(String(endpointId))??null}}),enabled:endpoint.enabled!==!1})),mappings:mappings.map((mapping)=>({name:String(mapping.name??""),endpointName:nameById.get(String(mapping.endpointId))??null,targetEntity:String(mapping.targetEntity??""),fieldMappings:asArray(mapping.fieldMappings),referenceChecks:asArray(mapping.referenceChecks),dedupSourceField:text2(mapping.dedupSourceField),dedupTargetField:text2(mapping.dedupTargetField),writeMode:String(mapping.writeMode??"upsert")??"upsert",missingRecordPolicy:String(mapping.missingRecordPolicy??"ignore")??"ignore",missingRecordColumn:text2(mapping.missingRecordColumn),missingRecordValue:text2(mapping.missingRecordValue),removalScopeColumn:text2(mapping.removalScopeColumn),passwordTargetColumn:text2(mapping.passwordTargetColumn),accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:text2(mapping.scheduleCron),scheduleTimezone:text2(mapping.scheduleTimezone),enabled:mapping.enabled!==!1}))}}function validateTransferDocument(value2){let problems=[],doc=asObject(value2);if(!doc)return{ok:!1,document:null,problems:[{path:"",message:"This is not an integration export file."}]};if(typeof doc.version!=="number")problems.push({path:"version",message:"The file does not say which format it is in."});else if(doc.version>1)problems.push({path:"version",message:`This file was written by a newer version (${doc.version}); this one understands up to 1.`});let connection=asObject(doc.connection);if(!connection)problems.push({path:"connection",message:"The file has no connection."});else{if(!text2(connection.name))problems.push({path:"connection.name",message:"Missing name."});if(!text2(connection.slug))problems.push({path:"connection.slug",message:"Missing slug."});if(!text2(connection.baseUrl))problems.push({path:"connection.baseUrl",message:"Missing base URL."})}let endpoints=asArray(doc.endpoints),endpointNames=new Set;return endpoints.forEach((endpoint,index)=>{let name2=text2(endpoint.name);if(!name2){problems.push({path:`endpoints[${index}].name`,message:"Missing name."});return}if(endpointNames.has(name2))problems.push({path:`endpoints[${index}].name`,message:`Two endpoints are called "${name2}"; names are how the rest of the file refers to them.`});if(endpointNames.add(name2),!text2(endpoint.path))problems.push({path:`endpoints[${index}].path`,message:"Missing path."});if(!text2(endpoint.tag))problems.push({path:`endpoints[${index}].tag`,message:"Missing tag."})}),endpoints.forEach((endpoint,index)=>{asArray(endpoint.paramBindings).forEach((binding,bindingIndex)=>{if(binding.from!=="endpoint")return;let target2=text2(binding.endpointName);if(!target2||!endpointNames.has(target2))problems.push({path:`endpoints[${index}].paramBindings[${bindingIndex}]`,message:`Takes its value from an endpoint called "${target2??"?"}", which is not in this file.`})})}),asArray(doc.mappings).forEach((mapping,index)=>{if(!text2(mapping.name))problems.push({path:`mappings[${index}].name`,message:"Missing name."});if(!text2(mapping.targetEntity))problems.push({path:`mappings[${index}].targetEntity`,message:"Missing target table."});let endpointName=text2(mapping.endpointName);if(!endpointName||!endpointNames.has(endpointName))problems.push({path:`mappings[${index}].endpointName`,message:`Reads from an endpoint called "${endpointName??"?"}", which is not in this file.`})}),{ok:problems.length===0,document:problems.length===0?doc:null,problems}}init_crypto();init_routeCollector();init_utils5();init_utils6();init_godminGuard();init_esm3();init_utils5();async function testConnection(chain,tokenCache,deps={}){let{source,oauth}=chain,fetchImpl=deps.fetchImpl;if(oauth){tokenCache.invalidate(source.id);let token=await getAccessToken(oauth,tokenCache,{fetchImpl});return token.ok?{ok:!0,detail:`A token was issued (${token.accessToken.length} characters). The credentials and token address are valid.`}:{ok:!1,error:token.error}}let built=buildUrl(source.baseUrl,"");if(!built.ok)return{ok:!1,error:built.error};let{headers}=applyAuth(source,built.url),outcome=await fetchOnce(source,{method:"GET",url:built.url,headers},{fetchImpl});if(outcome.status===0)return{ok:!1,error:outcome.error};return{ok:outcome.status<500,detail:`The address answered: HTTP ${outcome.status}.`,error:outcome.status>=500?outcome.error:void 0}}var PREVIEW_LIMIT=1500;async function sampleEndpoint(source,endpoint,pathParams,tokenCache,oauth,deps={}){let fetchImpl=deps.fetchImpl,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return blank({error:token.error});bearerToken=token.accessToken}let values={...endpoint.queryParams??{},...pathParams??{}},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return blank({error:`This endpoint needs a value for ${resolved.missing.map((m)=>`{${m}}`).join(", ")}. Enter an example value to test it (e.g. ${resolved.missing[0]} = 12345).`});let query={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;query[key2]=value2}let built=buildUrl(source.baseUrl,resolved.path,query);if(!built.ok)return blank({error:built.error});let{headers}=applyAuth({...source,token:bearerToken??source.token},built.url);if(bearerToken)headers.Authorization=`Bearer ${bearerToken}`;let outcome=await fetchOnce(source,{method:endpoint.method,url:built.url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl}),bodyKeys=outcome.body&&typeof outcome.body==="object"&&!Array.isArray(outcome.body)?Object.keys(outcome.body).slice(0,40):[];if(!outcome.ok)return blank({status:outcome.status,error:outcome.error??`HTTP ${outcome.status}`,bodyKeys,bodyPreview:previewBody(outcome.body)});let childrenPath=treeChildrenPath(endpoint.treeChildrenPath),extracted=extractRecords(outcome.body,endpoint.responseRootPath),flattened=childrenPath?flattenTree(extracted,childrenPath):null;if(flattened?.truncated)return blank({status:outcome.status,error:"This source answered with a structure that nests into itself, so it cannot be walked. Check the field named as the children.",bodyKeys,bodyPreview:previewBody(outcome.body)});let records=flattened?flattened.records:extracted;return{ok:!0,status:outcome.status,error:records.length===0?bodyKeys.length>0?`No record array was found. The response's top-level keys are: ${bodyKeys.join(", ")} \u2014 set the response root path to whichever holds the list.`:"No record array was found in the response.":null,recordCount:records.length,sample:records.slice(0,5),fields:records.length>0?flattenKeys(records[0]):[],bodyKeys,bodyPreview:previewBody(outcome.body)}}function blank(over){return{ok:!1,status:0,error:null,recordCount:0,sample:[],fields:[],bodyKeys:[],bodyPreview:null,...over}}function previewBody(body){if(body==null)return null;try{let text3=typeof body==="string"?body:JSON.stringify(body);return text3.length>PREVIEW_LIMIT?`${text3.slice(0,PREVIEW_LIMIT)}\u2026`:text3}catch{return null}}async function previewRun(chain,tokenCache,lookups,deps={}){let fetchImpl=deps.fetchImpl,{mapping,source,oauth}=chain,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return{ok:!1,error:token.error};bearerToken=token.accessToken}let root=chain.endpoints.find((e)=>e.id===chain.rootEndpointId);if(!root)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};let parents={},entityValues={},externalCalls=0;for(let binding of root.paramBindings??[]){if(binding.from==="endpoint"&&!parents[binding.endpointId]){let parentSpec=chain.endpoints.find((e)=>e.id===binding.endpointId);if(!parentSpec)continue;let collected2=await collectEndpoint(source,parentSpec,{},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected2.callCount,!collected2.ok)return{ok:!1,error:collected2.error};parents[binding.endpointId]=collected2.records.map((r)=>r.record)}if(binding.from==="entity"){let key2=`${binding.entity}.${binding.field}`;if(!entityValues[key2])entityValues[key2]=await lookups.readEntityColumn(binding.entity,binding.field)}}let collected=await collectEndpoint(source,root,{parents,entityValues},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected.callCount,!collected.ok)return{ok:!1,error:collected.error};let mapped3=buildMappedRecords(collected.records.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,collected.records.map((r)=>r.parent)),existing=await lookups.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column3)=>lookups.readEntityColumn(entity,column3)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column3)=>lookups.readEntityPairsBy(entity,column3)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await lookups.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,requiredFields:lookups.requiredFields(mapping.targetEntity),uniqueFields:lookups.uniqueFields(mapping.targetEntity),createDefaults:mapping.passwordColumn?{[mapping.passwordColumn]:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"}:{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous));let invalid=lookups.validateRows?.(ops.creates)??[];for(let problem of invalid){let create4=ops.creates.find((c)=>c.sourceIndex===problem.sourceIndex);ops.issues.push({sourceIndex:problem.sourceIndex,kind:"invalid_value",message:problem.message,row:create4?.data})}if(invalid.length>0){let refused=new Set(invalid.map((problem)=>problem.sourceIndex));ops.creates=ops.creates.filter((create4)=>!refused.has(create4.sourceIndex))}return{ok:!0,externalCalls,plan:summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:collected.records.length,reportedTotal:collected.reportedTotal,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)})}}init_crypto();import{and as and25,eq as eq39,inArray as inArray17}from"drizzle-orm";var camel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function tableFor(deps,entity){return deps.schemaTables[camel2(entity)]??null}var col8=(table,field)=>table?.[field]??table?.[camel2(field)];function open(deps,envelope,where){if(typeof envelope!=="string"||envelope==="")return"";let key2=deps.getEncryptionKey();if(!key2)return deps.logger.error("[Integrations] A stored credential cannot be read: no encryption key",{column:where}),"";try{return decryptSecret(envelope,key2)}catch{return deps.logger.error("[Integrations] A stored credential could not be decrypted \u2014 the encryption key has changed since it was saved. Re-enter it in the panel.",{column:where}),""}}async function resolveChain(deps,mappingId){let mappings=tableFor(deps,"integration_mappings"),endpoints=tableFor(deps,"integration_endpoints"),sources=tableFor(deps,"integration_sources");if(!mappings||!endpoints||!sources)return{ok:!1,error:"The integration tables are not present in this schema."};let[mappingRow]=await deps.db.select().from(mappings).where(eq39(col8(mappings,"id"),mappingId)).limit(1);if(!mappingRow)return{ok:!1,error:"This mapping no longer exists."};let row=mappingRow,[endpointRow]=await deps.db.select().from(endpoints).where(eq39(col8(endpoints,"id"),String(row.endpointId))).limit(1);if(!endpointRow)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};if(endpointRow.enabled===!1)return{ok:!1,error:"The call this mapping reads is switched off."};if(row.enabled===!1)return{ok:!1,error:"This mapping is switched off."};let sourceId=String(endpointRow.sourceId),siblingRows=await deps.db.select().from(endpoints).where(eq39(col8(endpoints,"sourceId"),sourceId)),[sourceRow]=await deps.db.select().from(sources).where(eq39(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"The source this mapping reads no longer exists."};let s=sourceRow;if(s.enabled===!1)return{ok:!1,error:"This source is switched off."};let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{ok:!0,chain:{mapping:toMappingSpec(row),endpoints:siblingRows.map((e)=>toEndpointSpec(e)),rootEndpointId:String(endpointRow.id),source,oauth}}}async function resolveEndpointContext(deps,by){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints");if(!sources||!endpoints)return{ok:!1,error:"The integration tables are not present in this schema."};let endpointRow=null,sourceId=by.sourceId;if(by.endpointId){let[row]=await deps.db.select().from(endpoints).where(eq39(col8(endpoints,"id"),by.endpointId)).limit(1);if(!row)return{ok:!1,error:"This endpoint no longer exists."};endpointRow=row,sourceId=String(endpointRow.sourceId)}if(!sourceId)return{ok:!1,error:"No source was named."};let[sourceRow]=await deps.db.select().from(sources).where(eq39(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"This source no longer exists."};let{source,oauth}=toConnection(deps,sourceRow);return{ok:!0,context:{source,oauth,endpoint:endpointRow?toEndpointSpec(endpointRow):null}}}async function cacheEndpointSample(deps,endpointId,records){let endpoints=tableFor(deps,"integration_endpoints");if(!endpoints||records.length===0)return;try{await deps.db.update(endpoints).set({sampleResponse:{records:records.slice(0,3)},updatedAt:new Date}).where(eq39(col8(endpoints,"id"),endpointId))}catch(error3){deps.logger.warn("[Integrations] Could not cache the endpoint sample",{endpointId,error:error3 instanceof Error?error3.message:String(error3)})}}function toConnection(deps,s){let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{source,oauth}}function toMappingSpec(row){return{id:String(row.id),name:String(row.name??""),targetEntity:String(row.targetEntity??""),fieldMappings:Array.isArray(row.fieldMappings)?row.fieldMappings:[],references:Array.isArray(row.referenceChecks)?row.referenceChecks:[],dedupTargetField:row.dedupTargetField||null,writeMode:String(row.writeMode??"upsert")??"upsert",missingPolicy:String(row.missingRecordPolicy??"ignore")??"ignore",missingColumn:row.missingRecordColumn??null,removalScopeColumn:row.removalScopeColumn||null,missingValue:row.missingRecordValue??null,originColumn:row.originColumn??null,originValue:row.originValue??null,maxRemovalShare:Number(row.maxRemovalShare??0)||0,passwordColumn:row.passwordTargetColumn||null,accountRule:row.accountRule??null}}function toEndpointSpec(row){let pagination=row.pagination;return{id:String(row.id),method:String(row.method??"GET"),path:String(row.path??""),queryParams:row.queryParams??null,requestBody:row.requestBody??null,responseRootPath:row.responseRootPath||null,treeChildrenPath:row.treeChildrenPath||null,pagination:pagination&&typeof pagination==="object"&&"kind"in pagination?pagination:{kind:"none"},paramBindings:Array.isArray(row.paramBindings)?row.paramBindings:null}}async function readConnectionBundle(deps,sourceId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return null;let[sourceRow]=await deps.db.select().from(sources).where(eq39(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return null;let endpointRows=await deps.db.select().from(endpoints).where(eq39(col8(endpoints,"sourceId"),sourceId)),ids=new Set(endpointRows.map((row)=>String(row.id))),allMappings=await deps.db.select().from(mappings);return{source:sourceRow,endpoints:endpointRows,mappings:allMappings.filter((row)=>ids.has(String(row.endpointId)))}}async function applyTransferDocument(deps,document2,userId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return{ok:!1,error:"The integration tables are not present in this schema."};return deps.db.transaction(async(tx)=>{let now=new Date,c=document2.connection,connectionValues={name:c.name,slug:c.slug,baseUrl:c.baseUrl,description:c.description??null,authType:c.authType,authHeaderName:c.authHeaderName??null,authQueryParam:c.authQueryParam??null,extraHeaders:c.extraHeaders??null,tokenUrl:c.tokenUrl??null,oauthGrantType:c.oauthGrantType??null,oauthClientId:c.oauthClientId??null,oauthUsername:c.oauthUsername??null,oauthScope:c.oauthScope??null,oauthClientAuth:c.oauthClientAuth??null,tlsVerify:c.tlsVerify!==!1,timeoutMs:c.timeoutMs??null,enabled:c.enabled!==!1,updatedAt:now,updatedBy:userId},[existingSource]=await tx.select().from(sources).where(eq39(col8(sources,"slug"),c.slug)).limit(1),sourceId,created=!1;if(existingSource)sourceId=String(existingSource.id),await tx.update(sources).set(connectionValues).where(eq39(col8(sources,"id"),sourceId));else{let[row]=await tx.insert(sources).values({...connectionValues,createdAt:now,createdBy:userId}).returning();if(!row?.id)return{ok:!1,error:"The connection could not be created."};sourceId=String(row.id),created=!0}let existingEndpoints=await tx.select().from(endpoints).where(eq39(col8(endpoints,"sourceId"),sourceId)),endpointIdByName=new Map;for(let row of existingEndpoints)endpointIdByName.set(String(row.name),String(row.id));for(let endpoint of document2.endpoints){let values={sourceId,name:endpoint.name,tag:endpoint.tag,method:endpoint.method,path:endpoint.path,description:endpoint.description??null,queryParams:endpoint.queryParams??null,requestBody:endpoint.requestBody??null,responseRootPath:endpoint.responseRootPath??null,treeChildrenPath:endpoint.treeChildrenPath??null,pagination:endpoint.pagination??null,enabled:endpoint.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=endpointIdByName.get(endpoint.name);if(existingId)await tx.update(endpoints).set(values).where(eq39(col8(endpoints,"id"),existingId));else{let[row]=await tx.insert(endpoints).values({...values,paramBindings:[],createdAt:now,createdBy:userId}).returning();if(row?.id)endpointIdByName.set(endpoint.name,String(row.id))}}for(let endpoint of document2.endpoints){let id=endpointIdByName.get(endpoint.name);if(!id)continue;let bindings=(endpoint.paramBindings??[]).map((binding)=>{if(binding.from!=="endpoint")return binding;let{endpointName,...rest3}=binding;return{...rest3,endpointId:endpointIdByName.get(String(endpointName))??""}});await tx.update(endpoints).set({paramBindings:bindings,updatedAt:now}).where(eq39(col8(endpoints,"id"),id))}let allMappings=await tx.select().from(mappings),ownIds=new Set(endpointIdByName.values()),mappingIdByName=new Map;for(let row of allMappings)if(ownIds.has(String(row.endpointId)))mappingIdByName.set(String(row.name),String(row.id));let mappingCount=0;for(let mapping of document2.mappings){let endpointId=mapping.endpointName?endpointIdByName.get(mapping.endpointName):void 0;if(!endpointId)continue;let values={endpointId,name:mapping.name,targetEntity:mapping.targetEntity,fieldMappings:mapping.fieldMappings??[],referenceChecks:mapping.referenceChecks??[],dedupSourceField:mapping.dedupSourceField??null,dedupTargetField:mapping.dedupTargetField??null,writeMode:mapping.writeMode,missingRecordPolicy:mapping.missingRecordPolicy,missingRecordColumn:mapping.missingRecordColumn??null,missingRecordValue:mapping.missingRecordValue??null,removalScopeColumn:mapping.removalScopeColumn??null,passwordTargetColumn:mapping.passwordTargetColumn??null,accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:mapping.scheduleCron??null,scheduleTimezone:mapping.scheduleTimezone??null,enabled:mapping.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=mappingIdByName.get(mapping.name);if(existingId)await tx.update(mappings).set(values).where(eq39(col8(mappings,"id"),existingId));else await tx.insert(mappings).values({...values,createdAt:now,createdBy:userId});mappingCount++}return{ok:!0,sourceId,created,endpoints:endpointIdByName.size,mappings:mappingCount}})}async function readScheduledMappings(deps){let mappings=tableFor(deps,"integration_mappings");if(!mappings)return[];return(await deps.db.select().from(mappings)).filter((row)=>row.scheduleEnabled===!0&&row.enabled!==!1).filter((row)=>typeof row.scheduleCron==="string"&&row.scheduleCron.trim()!=="").map((row)=>({id:String(row.id),name:String(row.name??""),scheduleCron:String(row.scheduleCron),scheduleTimezone:row.scheduleTimezone??null,lastRunAt:row.lastRunAt?new Date(row.lastRunAt):null,needsPassword:Boolean(row.passwordTargetColumn)||row.accountRule!=null}))}function requiredFieldsOf(entities,targetEntity){return(entities.find((e)=>e.table_name===targetEntity)?.columns??[]).filter((c)=>c.notNull===!0&&c.default===void 0&&!c.defaultRaw&&!c.nullable).map((c)=>camel2(c.name))}function uniqueFieldsOf(entities,targetEntity){let entity=entities.find((e)=>e.table_name===targetEntity),columns=entity?.columns??[],fields=new Set;for(let column3 of columns)if(column3.unique===!0||column3.primaryKey===!0)fields.add(camel2(column3.name));for(let index of entity?.indexes??[])if(index.unique===!0&&index.columns.length===1&&index.columns[0])fields.add(camel2(index.columns[0]));return fields.delete("id"),[...fields]}function createRunRepository(deps,entities){let runs=()=>tableFor(deps,"integration_runs"),runItems=()=>tableFor(deps,"integration_run_items");return{async openRun(input){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let id=(await deps.db.insert(table).values({mappingId:input.mappingId,targetEntity:input.targetEntity,writeMode:input.writeMode,trigger:input.trigger,status:"running",startedAt:new Date,createdBy:input.userId??null}).returning())[0]?.id;return id?{ok:!0,runId:String(id)}:{ok:!1,error:"The run record was created but returned no identifier."}}catch(error3){return{ok:!1,error:error3 instanceof Error?error3.message:String(error3)}}},async closeRun(runId,patch){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let mappingId=(await deps.db.update(table).set({...patch,updatedAt:new Date}).where(eq39(col8(table,"id"),runId)).returning())[0]?.mappingId,finishedAt=patch.finishedAt,mappings=tableFor(deps,"integration_mappings");if(mappings&&mappingId&&finishedAt)await deps.db.update(mappings).set({lastRunAt:finishedAt,updatedAt:new Date}).where(eq39(col8(mappings,"id"),String(mappingId)));return{ok:!0}}catch(error3){return deps.logger.error("[Integrations] Could not close the run record",{runId,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,error:"Could not write the run record."}}},async savePreImages(runId,images){let table=runItems();if(!table)return!1;if(images.length===0)return!0;let CHUNK2=500;try{return await deps.db.transaction(async(tx)=>{for(let i=0;i<images.length;i+=CHUNK2)await tx.insert(table).values(images.slice(i,i+CHUNK2).map((image)=>({runId,targetEntity:image.targetEntity,rowId:image.rowId,action:image.action,before:image.before,after:image.after})))}),!0}catch(error3){return deps.logger.error("[Integrations] The run succeeded but its before-images could not be stored; it cannot be undone",{runId,error:error3 instanceof Error?error3.message:String(error3)}),!1}},async isCancelRequested(runId){let table=runs();if(!table)return!1;try{let[row]=await deps.db.select().from(table).where(eq39(col8(table,"id"),runId)).limit(1);return row?.cancelRequested===!0}catch{return!1}},async readExistingRows(targetEntity){let table=tableFor(deps,targetEntity);if(!table)return[];return(await deps.db.select().from(table)).map((row)=>({id:String(row.id),row}))},async readEntityColumn(entity,field){let table=tableFor(deps,entity),column3=table?col8(table,field):void 0;if(!table||!column3)return[];return(await deps.db.selectDistinct({v:column3}).from(table)).map((r)=>r.v).filter((v)=>v!=null&&v!=="")},async readEntityIdsBy(entity,field){let table=tableFor(deps,entity),column3=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column3||!idColumn)return{};let rows=await deps.db.select({v:column3,id:idColumn}).from(table),map3={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!map3[key2])map3[key2]=String(row.id)}return map3},async readEntityPairsBy(entity,field){let table=tableFor(deps,entity),column3=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column3||!idColumn)return[];return await deps.db.select({value:column3,id:idColumn}).from(table)},requiredFields:(targetEntity)=>requiredFieldsOf(entities,targetEntity),uniqueFields:(targetEntity)=>uniqueFieldsOf(entities,targetEntity)}}async function readRowsById(deps,targetEntity,ids){let table=tableFor(deps,targetEntity),result=new Map;if(!table||ids.length===0)return result;let CHUNK2=1000;for(let i=0;i<ids.length;i+=CHUNK2){let rows=await deps.db.select().from(table).where(inArray17(col8(table,"id"),ids.slice(i,i+CHUNK2)));for(let row of rows)result.set(String(row.id),row)}return result}async function readPreImages(deps,runId){let table=tableFor(deps,"integration_run_items");if(!table)return[];return(await deps.db.select().from(table).where(eq39(col8(table,"runId"),runId))).map((row)=>({targetEntity:String(row.targetEntity),rowId:row.rowId?String(row.rowId):null,action:String(row.action),before:row.before??null,after:row.after??null}))}async function readRun(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return null;let[row]=await deps.db.select().from(table).where(eq39(col8(table,"id"),runId)).limit(1);return row??null}async function requestCancel(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return!1;return(await deps.db.update(table).set({cancelRequested:!0,updatedAt:new Date}).where(and25(eq39(col8(table,"id"),runId),eq39(col8(table,"status"),"running"))).returning()).length>0}var fail3=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createInspectRoutes(routeConfig,deps,tokenCache){let settings=routeConfig.resolvedOptions.integrations??{};return[defineRoute({method:"POST",path:"/sources/:id/test",detail:{tags:["Integrations"],summary:"Check a source is reachable and its credentials are accepted"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{sourceId:params.id});if(!context.ok)return fail3(set2,404,context.error);let result=await testConnection(context.context,tokenCache);return{isSuccess:result.ok,message:result.ok?result.detail??"Connected.":result.error??"Could not connect.",data:result}}}),defineRoute({method:"POST",path:"/endpoints/:id/sample",body:Type.Optional(Type.Object({pathParams:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})),detail:{tags:["Integrations"],summary:"Call one endpoint once and report its real shape"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{endpointId:params.id});if(!context.ok)return fail3(set2,404,context.error);let{source,oauth,endpoint}=context.context;if(!endpoint)return fail3(set2,404,"This endpoint no longer exists.");let result=await sampleEndpoint(source,endpoint,body?.pathParams,tokenCache,oauth);if(result.ok&&result.sample.length>0)await cacheEndpointSample(repoDeps,params.id,result.sample);return{isSuccess:result.ok,message:result.error??"Sampled.",data:result}}}),defineRoute({method:"POST",path:"/preview",body:Type.Object({mappingId:Type.String()}),detail:{tags:["Integrations"],summary:"Dry-run an import: counts, warnings and a sample, with no writes"},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let repo=createRunRepository(repoDeps,repoDeps.entities),result=await previewRun(chain.chain,tokenCache,{readExistingRows:repo.readExistingRows,readEntityColumn:repo.readEntityColumn,requiredFields:repo.requiredFields,uniqueFields:repo.uniqueFields,readEntityIdsBy:repo.readEntityIdsBy,readEntityPairsBy:repo.readEntityPairsBy,validateRows:(rows)=>{let columns=repoDeps.entities.find((e)=>e.table_name===chain.chain.mapping.targetEntity)?.columns??[],problems=[];for(let row of rows){let result2=validatePayload(row.data,columns,!1);if(!result2.valid)problems.push({sourceIndex:row.sourceIndex,message:result2.errors.map((e)=>`${e.field}: ${e.message}`).join("; ")})}return problems}},{maxRecords:settings.maxRecordsPerRun,maxConcurrent:settings.maxConcurrentFanout});if(!result.ok)return fail3(set2,422,result.error);return{isSuccess:!0,message:"Nothing was written.",data:{plan:result.plan,externalCalls:result.externalCalls}}}}),defineRoute({method:"POST",path:"/schedule-check",body:Type.Object({mappingId:Type.String(),at:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Simulate the schedule: the next firings, and whether a given moment is one",description:"Writes nothing and starts nothing. Answers the question a schedule cannot otherwise be asked until the night it runs: does this expression name the minute I meant, in the clock I meant."},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let raw=chain.chain.mapping,expression=String(raw.scheduleCron??"").trim(),timeZone=String(raw.scheduleTimezone??"").trim()||"UTC";if(expression==="")return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression:"",timeZone,times:[]}};let at=body.at?new Date(body.at):new Date;if(Number.isNaN(at.getTime()))return fail3(set2,400,"That is not a moment I can read.");let upcoming=nextFireTimes({expression,timeZone,from:at,count:5}),verdict=isDue({expression,timeZone,now:at,lastRunAt:null});return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression,timeZone,describes:describeCron(expression,timeZone),at:at.toISOString(),wouldFireAtThatMoment:verdict.due,error:verdict.error??upcoming.error??null,times:upcoming.times.map((t)=>t.toISOString())}}}})]}var fail4=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};async function closeAbandonedRuns(repoDeps,mappingId,logger2){try{let runsTable=tableFor(repoDeps,"integration_runs");if(!runsTable)return;let{and:and26,eq:eq40,inArray:inArray18}=await import("drizzle-orm"),closed=await repoDeps.db.update(runsTable).set({status:"failed",finishedAt:new Date,errors:["This import stopped without finishing \u2014 the process running it went away (a restart, a deploy, or a crash). Whatever it had already written is still there; run it again, or check the target table."],updatedAt:new Date}).where(and26(eq40(runsTable.mappingId,mappingId),inArray18(runsTable.status,["running","queued"]))).returning();if(closed.length>0)logger2.warn(`[Integrations] ${closed.length} run(s) of this mapping were left open by a process that went away; marked as failed.`)}catch(error3){logger2.error("[Integrations] Could not close abandoned runs",error3)}}var tokenCache=new TokenCache;function createIntegrationRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,resolvedOptions,getEncryptionKey,getLockStore,publish}=routeConfig,entities=resolveEntities(SYSTEM_TABLES,resolvedOptions.entities??[],{consumerMode:resolvedOptions.authentication?.mode==="consumer"}).entities,settings=resolvedOptions.integrations??{},topicPrefix=settings.realtimeTopicPrefix||"integrations",guard4=createGodminGuard2({logger:logger2,db,schemaTables,area:"data integrations",allowedRoles:routeConfig.adminRoles??settings.adminRoles}),deps=()=>db?{db,schemaTables,entities,logger:logger2,getEncryptionKey}:null,inspectRoutes=createInspectRoutes(routeConfig,deps,tokenCache),writerFor=(repoDeps,targetEntity)=>{let table=tableFor(repoDeps,targetEntity);if(!table)return null;let entity=entities.find((e)=>e.table_name===targetEntity);return{db:repoDeps.db,drizzleTable:table,resolveCol:(field)=>table[field]??table[field.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase())],columns:entity?.columns??[],logger:logger2,validatePayload,resolveEntity:(name2)=>{let refTable=tableFor(repoDeps,name2);if(!refTable)return null;let refEntity=entities.find((e)=>e.table_name===name2);return{table:refTable,columns:refEntity?.columns??[]}},accountClosure:accountClosureFor(targetEntity)}};function accountClosureFor(targetEntity){let link=accountLinkFor(routeConfig.resolvedOptions.authentication?.accountLinks,targetEntity);if(!link)return null;let usersTable=schemaTables.users;if(!usersTable)return null;let sessionsTable=schemaTables.userSessions??schemaTables.sessions;return{userColumn:link.userColumn,accountEntity:"users",usersTable,sessionsTable:sessionsTable??null}}let routePostRuns=defineRoute({method:"POST",path:"/runs",body:Type.Object({mappingId:Type.String(),confirm:Type.Optional(Type.Boolean()),sharedPassword:Type.Optional(Type.String()),referenceMode:Type.Optional(Type.Union([Type.Literal("create"),Type.Literal("skipRecord")]))}),detail:{tags:["Integrations"],summary:"Start an import; answers 202 with the run identifier"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail4(set2,404,chain.error);let declared2=chain.chain.mapping,answer=body.referenceMode,mapping=answer?{...declared2,references:(declared2.references??[]).map((check)=>check.onMissing==="ignore"?check:{...check,onMissing:answer})}:declared2,wantsPassword=Boolean(mapping.passwordColumn||mapping.accountRule),createDefaults,accountPasswordHash=null;if(wantsPassword){let supplied=typeof body.sharedPassword==="string"?body.sharedPassword:"";if(supplied.length<8)return fail4(set2,422,mapping.accountRule?"This import creates a login for every new record, so it needs a password to create them with: send sharedPassword, at least 8 characters. It is used once, for this run, and is stored nowhere.":`This mapping writes a password into "${mapping.passwordColumn}", so it needs one to write: send sharedPassword, at least 8 characters. It is used for the accounts this run creates and is not stored anywhere.`);let hash=await hashPassword(supplied);if(accountPasswordHash=hash,mapping.passwordColumn)createDefaults={[mapping.passwordColumn]:hash}}if(isDestructive(mapping.writeMode,mapping.missingPolicy)&&body.confirm!==!0)return set2.status=428,{isSuccess:!1,message:mapping.writeMode==="replace"?"This mapping rebuilds the whole table. Send confirm: true to proceed.":mapping.missingPolicy==="deactivate"?"This mapping deactivates records the source no longer carries. Send confirm: true to proceed.":"This mapping deletes records the source no longer carries. Send confirm: true to proceed.",data:null};let lockStore=getLockStore();if(!lockStore)return fail4(set2,503,"The lock service is unavailable, so a second run of this mapping could not be prevented. Runs are refused until it is back.");let lock=await acquireRunLock(lockStore,mapping.id,{logger:logger2});if(!lock.ok){if(lock.reason==="unavailable")return fail4(set2,503,`The lock service is unavailable: ${lock.error}`);return set2.status=409,{isSuccess:!1,message:"This mapping is already importing. Wait for it to finish, or cancel it.",data:{heldSince:lock.heldSince}}}await closeAbandonedRuns(repoDeps,mapping.id,logger2);let writer=writerFor(repoDeps,mapping.targetEntity);if(!writer)return await lock.handle.release(),fail4(set2,422,`This mapping targets "${mapping.targetEntity}", which does not exist.`);let userId=request.headers.get("x-user-id")??"unknown",repo=createRunRepository(repoDeps,entities),announce=()=>{},runIdReady=new Promise((resolve2)=>{announce=resolve2}),started=executeRun({...chain.chain,mapping,userId,trigger:"manual",createDefaults,accountPasswordHash},{repo,writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),onRunOpened:(id)=>announce(id),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle),runId=await Promise.race([runIdReady,started.then((outcome)=>outcome.runId)]);return started.catch(async(error3)=>{let reason=error3 instanceof Error?error3.message:String(error3);logger2.error("[Integrations] Run threw outside its own error handling",{mappingId:mapping.id,error:reason});let openedId=await runIdReady.catch(()=>null);if(openedId)await repo.closeRun(openedId,{status:"failed",finishedAt:new Date,errors:[reason]}).catch(()=>{})}).finally(()=>lock.handle.release()),set2.status=202,{isSuccess:!0,message:"The import has started.",data:{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity}}}}),startScheduledRun=async(mappingId)=>{let repoDeps=deps();if(!repoDeps)return!1;let chain=await resolveChain(repoDeps,mappingId);if(!chain.ok)return logger2.error(`[Integrations] Scheduled import cannot run: ${chain.error}`),!1;let lockStore=getLockStore();if(!lockStore)return!1;let lock=await acquireRunLock(lockStore,mappingId,{logger:logger2});if(!lock.ok)return!1;let writer=writerFor(repoDeps,chain.chain.mapping.targetEntity);if(!writer)return await lock.handle.release(),logger2.error(`[Integrations] Scheduled import targets "${chain.chain.mapping.targetEntity}", which does not exist.`),!1;return executeRun({...chain.chain,userId:null,trigger:"schedule"},{repo:createRunRepository(repoDeps,entities),writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle).then((outcome)=>{if(outcome.status!=="succeeded")logger2.error(`[Integrations] Scheduled import "${chain.chain.mapping.name}" ${outcome.status}: ${outcome.failure?.message??"no reason recorded"}`)}).catch((error3)=>{logger2.error("[Integrations] Scheduled import threw outside its own error handling",{mappingId,error:error3 instanceof Error?error3.message:String(error3)})}).finally(()=>lock.handle.release()),!0},unattendable=new Set;if(settings.schedulesEnabled!==!1)startScheduler({logger:logger2,listScheduled:async()=>{let repoDeps=deps();if(!repoDeps)return[];return(await readScheduledMappings(repoDeps)).filter((row)=>{if(!row.needsPassword)return!0;if(!unattendable.has(row.id))unattendable.add(row.id),logger2.error(`[Integrations] "${row.name}" is scheduled but creates logins, which need a password nobody can type at that hour. It will not run on its own \u2014 start it by hand, or turn the login off.`);return!1})},startRun:(mappingId)=>startScheduledRun(mappingId)});let routeGetSourcesIdExport=defineRoute({method:"GET",path:"/sources/:id/export",detail:{tags:["Integrations"],summary:"Export a connection, its calls and its mappings \u2014 without any secret"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let bundle=await readConnectionBundle(repoDeps,params.id);if(!bundle)return fail4(set2,404,"This connection no longer exists.");let document2=buildTransferDocument({...bundle,exportedAt:new Date().toISOString()});return{isSuccess:!0,message:`${document2.endpoints.length} call(s) and ${document2.mappings.length} mapping(s). Credentials are NOT included \u2014 they are asked for again on the other side.`,data:document2}}}),routePostImport=defineRoute({method:"POST",path:"/import",body:Type.Object({document:Type.Unknown()}),detail:{tags:["Integrations"],summary:"Bring in an exported connection; re-running it updates rather than duplicates"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let checked=validateTransferDocument(body?.document);if(!checked.ok||!checked.document)return set2.status=422,{isSuccess:!1,message:"This file cannot be imported as it stands.",data:{problems:checked.problems}};let userId=request.headers.get("x-user-id")??"unknown",result=await applyTransferDocument(repoDeps,checked.document,userId);if(!result.ok)return fail4(set2,422,result.error);return{isSuccess:!0,message:`Connection "${checked.document.connection.name}" is here: ${result.endpoints} call(s) and ${result.mappings} mapping(s). Its credentials are not \u2014 enter them before running anything.`,data:result}}}),routePostRunsIdCancel=defineRoute({method:"POST",path:"/runs/:id/cancel",detail:{tags:["Integrations"],summary:"Ask a running import to stop"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");if(!await requestCancel(repoDeps,params.id))return fail4(set2,409,"This run is not running, so there is nothing to cancel.");return{isSuccess:!0,message:"Cancellation requested. The import stops at its next checkpoint and anything it had written is rolled back.",data:{runId:params.id}}}}),routePostRunsIdRevert=defineRoute({method:"POST",path:"/runs/:id/revert",body:Type.Optional(Type.Object({force:Type.Optional(Type.Boolean())})),detail:{tags:["Integrations"],summary:"Undo a run that succeeded"},handler:async({params,body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let run=await readRun(repoDeps,params.id);if(!run)return fail4(set2,404,"This run no longer exists.");if(run.status!=="succeeded")return fail4(set2,409,`Only a run that finished successfully can be undone; this one is "${String(run.status)}".`);let expiry=run.preImagesExpireAt?new Date(String(run.preImagesExpireAt)):null;if(expiry&&expiry.getTime()<Date.now())return fail4(set2,410,"This run is too old to undo: the records of what it replaced have been cleared.");let targetEntity=String(run.targetEntity??""),preImages=await readPreImages(repoDeps,params.id);if(preImages.length===0)return fail4(set2,410,"There is no record of what this run replaced, so it cannot be undone.");let groups=groupPreImagesByEntity(preImages).sort((a,b)=>a.targetEntity===targetEntity?-1:b.targetEntity===targetEntity?1:0),planned=[];for(let group of groups){let current=await readRowsById(repoDeps,group.targetEntity,touchedRowIds(group.preImages));planned.push({targetEntity:group.targetEntity,ops:planRevert({preImages:group.preImages,current,force:body?.force===!0})})}let ops={deletes:planned.flatMap((p)=>p.ops.deletes),restores:planned.flatMap((p)=>p.ops.restores),reinserts:planned.flatMap((p)=>p.ops.reinserts),conflicts:planned.flatMap((p)=>p.ops.conflicts)};if(ops.deletes.length===0&&ops.restores.length===0&&ops.reinserts.length===0&&ops.conflicts.length>0)return set2.status=409,{isSuccess:!1,message:"Every record this run touched has been edited since. Undoing would discard those edits; send force: true to overwrite them anyway.",data:{conflicts:ops.conflicts}};let userId=request.headers.get("x-user-id")??"unknown";for(let group of planned)if(!writerFor(repoDeps,group.targetEntity))return fail4(set2,422,`"${group.targetEntity}" no longer exists.`);let undone={deleted:0,restored:0,reinserted:0},failure=null;try{await repoDeps.db.transaction(async(tx)=>{for(let group of planned){let groupWriter=writerFor(repoDeps,group.targetEntity),result2=await applyRevert(groupWriter,group.ops,{targetEntity:group.targetEntity,userId,tx});if(!result2.ok)throw failure=result2.error??"The undo could not be completed.",Error(failure);undone={deleted:undone.deleted+(result2.deleted??0),restored:undone.restored+(result2.restored??0),reinserted:undone.reinserted+(result2.reinserted??0)}}})}catch(error3){let message=failure??(error3 instanceof Error?error3.message:"The undo could not be completed.");return fail4(set2,500,`${message} Nothing was undone \u2014 every table was rolled back together.`)}let result={ok:!0,...undone,conflicts:ops.conflicts.length},finished=ops.conflicts.length===0,runsTable=tableFor(repoDeps,"integration_runs");if(runsTable&&finished){let{eq:eq40}=await import("drizzle-orm");await repoDeps.db.update(runsTable).set({status:"reverted",revertedAt:new Date,revertedBy:userId}).where(eq40(runsTable.id,params.id))}return{isSuccess:!0,message:finished?"The import was undone.":`Undone except for ${ops.conflicts.length} record(s) edited since the import. They were left as they are \u2014 send force: true to overwrite them too.`,data:{deleted:result.deleted,restored:result.restored,reinserted:result.reinserted,conflicts:ops.conflicts}}}}),routePutSourcesIdCredentials=defineRoute({method:"PUT",path:"/sources/:id/credentials",body:Type.Object({token:Type.Optional(Type.String()),oauthClientSecret:Type.Optional(Type.String()),oauthPassword:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Store a source credential; only a masked preview is returned"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let key2=getEncryptionKey();if(!key2)return fail4(set2,503,"No encryption key is configured, so a credential stored now could never be read back.");let table=tableFor(repoDeps,"integration_sources");if(!table)return fail4(set2,503,"The integration tables are not present in this schema.");let patch={},hints={},apply=(value2,column3,hintColumn,name2)=>{if(value2===void 0)return;let trimmed=value2.trim();if(trimmed===""){patch[column3]=null,patch[hintColumn]=null,hints[name2]=null;return}patch[column3]=encryptSecret(trimmed,key2),patch[hintColumn]=previewOf(trimmed),hints[name2]=previewOf(trimmed)};if(apply(body.token,"authTokenEncrypted","authTokenHint","token"),apply(body.oauthClientSecret,"oauthClientSecretEncrypted","oauthClientSecretHint","clientSecret"),apply(body.oauthPassword,"oauthPasswordEncrypted","oauthPasswordHint","password"),Object.keys(patch).length===0)return{isSuccess:!0,message:"Nothing to change.",data:{hints}};let{eq:eq40}=await import("drizzle-orm");return await repoDeps.db.update(table).set({...patch,updatedAt:new Date}).where(eq40(table.id,params.id)),tokenCache.invalidate(params.id),{isSuccess:!0,message:"Saved.",data:{hints}}}});logger2.info(`[Integrations] Routes enabled at ${basePath}`);let declared=[routePostRuns,routeGetSourcesIdExport,routePostImport,routePostRunsIdCancel,routePostRunsIdRevert,routePutSourcesIdCredentials,...inspectRoutes];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function parseDuration(value2){if(!value2)return;let match=value2.trim().match(/^(\d+)\s*([smhd])$/i);if(!match)return;let amount=Number(match[1]),unit=(match[2]??"d").toLowerCase();return amount*(unit==="s"?1000:unit==="m"?60000:unit==="h"?3600000:86400000)}init_esm3();init_routeCollector();init_adminGuard();var STREAM_HEADERS={"Content-Type":"text/event-stream; charset=utf-8","Cache-Control":"no-cache, no-transform",Connection:"keep-alive"},textEncoder=new TextEncoder,encodeEvent=(event,data)=>{let payload=typeof data==="string"?data:JSON.stringify(data);return textEncoder.encode(`event: ${event}
 data: ${payload}
 
-`)};function parseTimeToMs2(time2){let match=time2.match(/^(\d+)(ms|s|m|h)$/);if(!match?.[1]||!match[2])return 5000;let value2=parseInt(match[1],10);switch(match[2]){case"ms":return value2;case"s":return value2*1000;case"m":return value2*60*1000;case"h":return value2*60*60*1000;default:return 5000}}function createMonitoringRoutes(config){let{getService,logger:logger2,endpoints,db,schemaTables}=config,snapshotOrNull=async()=>await getService()?.getLatestSnapshot()??null,alertsOrEmpty=()=>getService()?.getActiveAlerts()??[],guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"monitoring",{allowRoles:endpoints.allowRoles}),mount=(routes2)=>collectRoutes([{prefix:endpoints.basePath,guards:[guard4],routes:routes2}]);if(!endpoints.enabled)return mount([]);logger2.info(`[Monitoring] Routes enabled at ${endpoints.basePath} (stream: ${endpoints.stream.enabled}, snapshot: ${endpoints.snapshot.enabled}, history: ${endpoints.history.enabled}, alerts: ${endpoints.alerts.enabled})`);let routes=[];if(endpoints.stream.enabled)routes.push(defineRoute({method:"GET",path:endpoints.stream.path,handler:({request})=>{let intervalMs=parseTimeToMs2(endpoints.stream.interval),abortSignal=request.signal;logger2.info("[Monitoring] SSE stream connected");let cleanup,stream=new ReadableStream({start(controller){let closed=!1,send2=(event,data)=>{if(closed)return;controller.enqueue(encodeEvent(event,data))},cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(timer),abortSignal?.removeEventListener("abort",cleanupHandler),logger2.info("[Monitoring] SSE stream disconnected");try{controller.close()}catch{}};cleanup=cleanupHandler;let tick=async()=>{if(closed)return;let snapshot=await snapshotOrNull();if(snapshot)send2("snapshot",snapshot);let alerts=alertsOrEmpty();if(alerts.length>0)send2("alerts",alerts)},timer=setInterval(tick,intervalMs);abortSignal?.addEventListener("abort",cleanupHandler),send2("open",{interval:intervalMs}),tick()},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Monitoring"],summary:"Stream real-time monitoring data",description:"Server-Sent Events stream for real-time monitoring metrics"}}));if(endpoints.snapshot.enabled)routes.push(defineRoute({method:"GET",path:endpoints.snapshot.path,handler:async()=>{let snapshot=await snapshotOrNull();if(!snapshot)return{isSuccess:!0,message:"No monitoring data available yet",data:null};return{isSuccess:!0,message:"Current monitoring snapshot",data:snapshot}},detail:{tags:["Monitoring"],summary:"Get current monitoring snapshot",description:"Returns the latest monitoring metrics snapshot"}}));if(endpoints.history.enabled)routes.push(defineRoute({method:"GET",path:endpoints.history.path,handler:async({query})=>{let minutes=Math.min(query.minutes?parseInt(String(query.minutes),10):60,endpoints.history.maxMinutes),history=await getService()?.getHistory(minutes)??[];return{isSuccess:!0,message:`Monitoring history for last ${minutes} minutes`,data:{minutes,count:history.length,snapshots:history}}},query:Type.Object({minutes:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Get monitoring history",description:"Returns historical monitoring data for the specified time range"}}));if(endpoints.alerts.enabled)routes.push(defineRoute({method:"GET",path:endpoints.alerts.path,handler:()=>{let alerts=alertsOrEmpty();return{isSuccess:!0,message:"Active alerts",data:{count:alerts.length,alerts}}},detail:{tags:["Monitoring"],summary:"Get active alerts",description:"Returns all currently active monitoring alerts"}})),routes.push(defineRoute({method:"POST",path:`${endpoints.alerts.path}/:alertId/acknowledge`,handler:({params,set:set2})=>{let service=getService();if(!service)return set2.status=503,{isSuccess:!1,message:"Monitoring service is not available",data:null};if(!service.acknowledgeAlert(params.alertId))return set2.status=404,{isSuccess:!1,message:"Alert not found",data:null};return{isSuccess:!0,message:"Alert acknowledged",data:{alertId:params.alertId}}},params:Type.Object({alertId:Type.String()}),detail:{tags:["Monitoring"],summary:"Acknowledge an alert",description:"Mark an alert as acknowledged"}}));return mount(routes)}init_esm3();init_routeCollector();init_adminGuard();function createLiveMonitoringRoutes(config){let{getService,getLifecycleRecorder,logger:logger2,basePath,streamInterval,db,schemaTables}=config,guard4=createGodminGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"live monitoring"),requireService=()=>{let svc=getService();if(!svc)throw Error("Live monitoring service not initialized");return svc};logger2.info(`[LiveMonitoring] Routes enabled at ${basePath} (stream interval: ${streamInterval}ms)`);let routes=[defineRoute({method:"GET",path:"/health",handler:()=>{let svc=getService();return{status:svc?"ok":"initializing",timestamp:Date.now(),monitoring:svc?.isEnabled()??!1}},detail:{tags:["Live Monitoring"],summary:"Health check for live monitoring"}}),defineRoute({method:"GET",path:"/settings",handler:()=>{return requireService().getSettings()},detail:{tags:["Live Monitoring"],summary:"Get live monitoring settings"}}),defineRoute({method:"PATCH",path:"/settings",handler:({body})=>{return requireService().changeSettings(body)},body:Type.Partial(Type.Object({logMemory:Type.Boolean(),logCpu:Type.Boolean(),logDapr:Type.Boolean(),logWebSocket:Type.Boolean(),memoryLogInterval:Type.Number(),cpuLogInterval:Type.Number(),memoryLogLimit:Type.Number(),cpuLogLimit:Type.Number(),daprLogLimit:Type.Number(),wsLogLimit:Type.Number(),requestLogLimit:Type.Number()})),detail:{tags:["Live Monitoring"],summary:"Change live monitoring settings"}}),defineRoute({method:"GET",path:"/incidents",handler:async({query})=>{let raw=Number(query?.limit),limit=Number.isFinite(raw)&&raw>0?Math.min(raw,50):20,recorder=getLifecycleRecorder?.();if(!recorder)return{available:!1,incidents:[]};return{available:!0,incidents:await recorder.incidents(limit)}},query:Type.Optional(Type.Object({limit:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Why previous runs of this process ended"}}),defineRoute({method:"GET",path:"/realtime",handler:({query})=>{let raw=Number(query?.windowMinutes),minutes=Number.isFinite(raw)&&raw>0?Math.min(raw,1440):void 0;return requireService().getRealtimeHealth(minutes?minutes*60000:void 0)},query:Type.Optional(Type.Object({windowMinutes:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Realtime (WebSocket) health digest"}}),defineRoute({method:"GET",path:"/logs",handler:()=>{return requireService().getLogs()},detail:{tags:["Live Monitoring"],summary:"Get all live monitoring logs"}}),defineRoute({method:"GET",path:"/logs/stream",handler:({request})=>{let abortSignal=request.signal,cleanup,svc=requireService(),snapshot=svc.getSnapshot(),lastTimestamps={memory:snapshot.memory.length?snapshot.memory[snapshot.memory.length-1]?.timestamp??0:0,cpu:snapshot.cpu.length?snapshot.cpu[snapshot.cpu.length-1]?.timestamp??0:0,request:snapshot.requests.length?snapshot.requests[snapshot.requests.length-1]?.timestamp??0:0,dapr:snapshot.dapr.length?snapshot.dapr[snapshot.dapr.length-1]?.timestamp??0:0,ws:snapshot.ws.length?snapshot.ws[snapshot.ws.length-1]?.timestamp??0:0},stream=new ReadableStream({start(controller){let closed=!1;controller.enqueue(encodeEvent("snapshot",snapshot));let interval=setInterval(()=>{if(closed)return;let update=svc.getUpdatesSince(lastTimestamps);if(!update){controller.enqueue(encodeEvent("heartbeat",{timestamp:Date.now()}));return}if(update.memory.length)lastTimestamps.memory=update.memory[update.memory.length-1]?.timestamp??lastTimestamps.memory;if(update.cpu.length)lastTimestamps.cpu=update.cpu[update.cpu.length-1]?.timestamp??lastTimestamps.cpu;if(update.requests.length)lastTimestamps.request=update.requests[update.requests.length-1]?.timestamp??lastTimestamps.request;if(update.dapr.length)lastTimestamps.dapr=update.dapr[update.dapr.length-1]?.timestamp??lastTimestamps.dapr;if(update.ws.length)lastTimestamps.ws=update.ws[update.ws.length-1]?.timestamp??lastTimestamps.ws;controller.enqueue(encodeEvent("update",update))},streamInterval),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(interval),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Live Monitoring"],summary:"Stream real-time live monitoring data via SSE"}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_routeCollector();init_adminGuard();var LOG_LEVELS=["debug","info","warn","error","fatal"],SOURCES=["logger","stdout","stderr"];function parseLevels(raw){if(!raw)return;let parsed=raw.split(",").map((value2)=>value2.trim().toLowerCase()).filter((value2)=>LOG_LEVELS.includes(value2));return parsed.length>0?parsed:void 0}function parseSource(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return SOURCES.includes(value2)?value2:void 0}function parseMinLevel(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return LOG_LEVELS.includes(value2)?value2:void 0}function parseCursor(raw){if(raw===void 0||raw===null||raw==="")return;let value2=Number(raw);return Number.isFinite(value2)&&value2>=0?value2:void 0}function buildQuery(query){return{levels:parseLevels(query.levels),minLevel:parseMinLevel(query.minLevel),scope:query.scope?.trim()||void 0,search:query.search||void 0,source:parseSource(query.source),after:parseCursor(query.after),before:parseCursor(query.before),limit:parseCursor(query.limit)}}var STREAM_KEEPALIVE_MS=25000;function createServerLogRoutes(config){let{buffer,logger:logger2,basePath,path:path7,allowRoles,streamEnabled=!0,clearEnabled=!0,db,schemaTables}=config,guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"server logs",{allowRoles}),routes=[defineRoute({method:"GET",path:path7,handler:({query})=>{return{isSuccess:!0,message:"Server logs",data:{...buffer.query(buildQuery(query)),scopes:buffer.scopes(),levelCounts:buffer.levelCounts()}}},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number()),before:Type.Optional(Type.Number()),limit:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Read buffered server logs",description:"Filtered, cursor-paged view of the in-memory server log buffer. Use `after` to tail forward and `before` to page backwards."}})];if(streamEnabled)routes.push(defineRoute({method:"GET",path:`${path7}/stream`,handler:({request,query})=>{let tailQuery=buildQuery(query),{after,before:_before,limit:_limit,...filter}=tailQuery,abortSignal=request.signal,cleanup,stream=new ReadableStream({start(controller){let closed=!1,backlog=buffer.query({...filter,...after!==void 0?{after}:{},limit:200});controller.enqueue(encodeEvent("backlog",backlog));let unsubscribe=buffer.subscribe((record3)=>{if(closed)return;if(!buffer.query({...filter,after:record3.seq-1,limit:1}).records.some((r)=>r.seq===record3.seq))return;try{controller.enqueue(encodeEvent("logs",[record3]))}catch{cleanup?.()}}),heartbeat=setInterval(()=>{if(closed)return;try{controller.enqueue(encodeEvent("ping",{timestamp:Date.now()}))}catch{cleanup?.()}},STREAM_KEEPALIVE_MS),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(heartbeat),unsubscribe(),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Tail server logs",description:"Server-Sent Events tail of the server log buffer, filtered server-side."}}));if(clearEnabled)routes.push(defineRoute({method:"DELETE",path:path7,handler:()=>{return buffer.clear(),logger2.info("[ServerLogs] Buffer cleared from the admin panel"),{isSuccess:!0,message:"Server log buffer cleared",data:null}},detail:{tags:["Monitoring"],summary:"Clear the server log buffer"}}));return logger2.info(`[ServerLogs] Routes enabled at ${basePath}${path7} (capacity: ${buffer.getCapacity()}, stream: ${streamEnabled})`),collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_Notification();init_routeCollector();init_adminGuard();var CHANNELS=["portal","email","telegram","webhook"];function createNotificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry,getEmailService}=routeConfig,basePath=routeConfig.basePath||config.endpoints?.basePath||"/notifications",buildService=(tables)=>new NotificationService({db,schemaTables:tables,config,logger:logger2,getEmailService}),defaultService=buildService(schemaTables),serviceFor=(request)=>{if(!tenantRegistry)return defaultService;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaultService;let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?buildService(ctx.schemaTables):defaultService},allowedSendRoles=new Set((config.endpoints?.sendRoles??[]).map((role)=>role.toLowerCase())),canSend=async(request)=>{if(allowedSendRoles.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowedSendRoles.has(role.toLowerCase())))return!0}return isGodminRequest(request,{db,schemaTables,logger:logger2})},requireUser=(request,set2)=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,null;return userId},declared=[defineRoute({method:"GET",path:"/",handler:async({request,query,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};let asCount=(raw,max)=>{if(raw===void 0||raw==="")return;let n=Number(raw);if(!Number.isFinite(n))return;return Math.min(max,Math.max(0,Math.floor(n)))};return{success:!0,data:await serviceFor(request).getNotifications(userId,{limit:asCount(query.limit,200),offset:asCount(query.offset,Number.MAX_SAFE_INTEGER),type:query.type||void 0})}},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String()),type:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"List the caller\u2019s notifications"}}),defineRoute({method:"GET",path:"/unseen-count",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).getUnseenCount(userId)}}},detail:{tags:["Notifications"],summary:"Unseen notification count"}}),defineRoute({method:"POST",path:"/:notification_id/seen",handler:async({params,request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};if(!await serviceFor(request).markAsSeen(params.notification_id,userId))return set2.status=404,{success:!1,message:"Notification not found"};return{success:!0,message:"Marked as seen"}},params:Type.Object({notification_id:Type.String()}),detail:{tags:["Notifications"],summary:"Mark one notification as seen"}}),defineRoute({method:"POST",path:"/seen-all",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).markAllAsSeen(userId)}}},detail:{tags:["Notifications"],summary:"Mark every notification as seen"}}),defineRoute({method:"POST",path:"/send",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending notifications requires godmin or an allowed role"};let recipients=body.userIds??(body.userId?[body.userId]:[]);if(recipients.length===0)return set2.status=400,{success:!1,message:"userId or userIds is required"};let channels=body.channels??[config.defaultChannel??"portal"],service=serviceFor(request),failed=(await Promise.allSettled(recipients.map((user_id)=>service.send({user_id,title:body.title,body:body.body,entity_name:body.entityName,entity_id:body.entityId,type:body.type??"custom",source:body.source,channels})))).map((result,index)=>{let userId=recipients[index];if(result.status==="rejected"){let reason=result.reason;return{userId,sent:!1,reason:reason instanceof Error?reason.message:String(reason)}}if(result.value.delivered.length>0)return{userId,sent:!0,reason:""};return{userId,sent:!1,reason:result.value.undelivered.map((one)=>`${one.channel}: ${one.reason}`).join("; ")||"no channel was requested"}}).filter((one)=>!one.sent),sentCount=recipients.length-failed.length,reasons=[...new Set(failed.map((one)=>one.reason))].join("; ");if(sentCount===0)set2.status=503;return{success:failed.length===0,message:failed.length===0?`Sent to ${recipients.length} recipient(s)`:`Sent to ${sentCount}, failed for ${failed.length}: ${reasons}`,data:{sent:sentCount,failed:failed.map((one)=>one.userId)}}},body:Type.Object({userId:Type.Optional(Type.String()),userIds:Type.Optional(Type.Array(Type.String())),title:Type.String(),body:Type.Optional(Type.String()),entityName:Type.Optional(Type.String()),entityId:Type.Optional(Type.String()),type:Type.Optional(Type.Union([Type.Literal("verification"),Type.Literal("system"),Type.Literal("custom")])),source:Type.Optional(Type.String()),channels:Type.Optional(Type.Array(Type.Union(CHANNELS.map((c)=>Type.Literal(c)))))}),detail:{tags:["Notifications"],summary:"Send a notification to one or more users",description:"Privileged. Delivers over the requested channels (portal, email, telegram, webhook). Email uses the configured provider \u2014 credentials resolve through the secrets store, so a rotation applies immediately."}}),defineRoute({method:"POST",path:"/email",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending email requires godmin or an allowed role"};let emailService=getEmailService?.()??null;if(!emailService?.isAvailable())return set2.status=503,{success:!1,message:"No email provider is configured or available"};let result=await emailService.sendEmail({to:body.to,subject:body.subject,html:body.html,text:body.text,replyTo:body.replyTo});if(!result.success)return set2.status=502,{success:!1,message:result.error??"Email delivery failed"};return logger2.info("[Notification] Transactional email sent",{recipients:Array.isArray(body.to)?body.to.length:1,subject:body.subject}),{success:!0,message:"Email sent",data:null}},body:Type.Object({to:Type.Union([Type.String(),Type.Array(Type.String())]),subject:Type.String(),html:Type.Optional(Type.String()),text:Type.Optional(Type.String()),replyTo:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"Send a transactional email to explicit recipients",description:"Backend-to-backend send through the configured provider \u2014 an app never needs an email SDK or the provider credentials of its own. Privileged, same gate as /send."}})];return{routes:collectRoutes([{prefix:basePath,routes:declared}]),notificationService:defaultService}}init_routeCollector();init_routeRecording();init_websocket();init_ack_manager();import{timingSafeEqual as timingSafeEqual3}from"crypto";init_ack_manager();var DEFAULT_MAX_TOPICS_PER_CLIENT=512;function createClientManager(config){let clients=new Map,presenceBroadcastDebounce=new Map,{redis,logger:logger2}=config,ackTtl=config.ack.ttlSeconds,ackEnabled=config.ack.enabled,maxRetries=config.ack.maxRetries,presenceEnabled=config.presence.enabled,presenceDebounceMs=config.presence.debounceMs,maxClientsPerUser=config.maxClientsPerUser,maxTopicsPerClient=config.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,MAX_TOPIC_LENGTH=256;function generateClientId(){return`client_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}function capTopics(topics){let accepted=[],dropped=[],seen=new Set;for(let t of topics){if(typeof t!=="string")continue;let trimmed=t.length>256?t.slice(0,256):t;if(seen.has(trimmed))continue;if(seen.add(trimmed),accepted.length>=maxTopicsPerClient){dropped.push(trimmed);continue}accepted.push(trimmed)}return{accepted,dropped}}function reportDropped(context,clientId,userId,dropped){if(dropped.length===0)return;logger2.warn("[PubSub] Topic subscription capped \u2014 events for these will NOT be delivered",{context,clientId,userId,cap:maxTopicsPerClient,droppedCount:dropped.length,dropped})}function registerClient(clientId,ws,userId,topics){let existingClients=getClientsByUser(userId);if(existingClients.length>=maxClientsPerUser){let oldestClientId=existingClients[0];if(oldestClientId)logger2.info("[PubSub] Max clients reached, closing oldest",{userId,oldestClientId}),unregisterClient(oldestClientId)}let{accepted,dropped}=capTopics(topics);return clients.set(clientId,{ws,userId,subscribedTopics:new Set(accepted),connectedAt:Date.now(),pendingAcks:new Map}),logger2.info("[PubSub] Client registered",{clientId,userId,topics:accepted,requestedCount:topics.length,subscribedCount:accepted.length,totalClients:clients.size}),reportDropped("registerClient",clientId,userId,dropped),{accepted,dropped}}function unregisterClient(clientId){let client=clients.get(clientId);if(!client)return;let userId=client.userId;if(clients.delete(clientId),logger2.info("[PubSub] Client unregistered",{clientId,userId,totalClients:clients.size}),presenceEnabled&&userId){if(getClientsByUser(userId).length===0)broadcastPresenceToOthers(userId,"offline")}}function updateClientTopics(clientId,topics){let client=clients.get(clientId);if(!client)return{accepted:[],dropped:[]};let{accepted,dropped}=capTopics(topics);return client.subscribedTopics=new Set(accepted),reportDropped("updateClientTopics",clientId,client.userId,dropped),{accepted,dropped}}function getClientsByUser(userId){let result=[];for(let[clientId,client]of clients)if(client.userId===userId)result.push(clientId);return result}function getConnectedUserIds(){let userIds=new Set;for(let[,client]of clients)if(client.userId)userIds.add(client.userId);return userIds}function getClientCount(){return clients.size}function sendToClient(clientId,message){let client=clients.get(clientId);if(!client)return!1;try{return client.ws.send(JSON.stringify(message)),!0}catch{return clients.delete(clientId),!1}}function broadcastEvent(topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0;for(let[clientId,client]of clients)if(client.subscribedTopics.has("*")||client.subscribedTopics.has(topic))try{if(client.ws.send(payload),sentCount++,ackEnabled){if(client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent(),client.userId)storePendingMessage(redis,{messageId,topic,clientId,userId:client.userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{})}}catch{clients.delete(clientId)}logger2.info("[PubSub] Broadcasted event",{topic,messageId,sentCount})}function broadcastToUser(userId,topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0,sentToAnyClient=!1;for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{if(client.ws.send(payload),sentCount++,sentToAnyClient=!0,ackEnabled)client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent()}catch{clients.delete(clientId)}}if(ackEnabled)storePendingMessage(redis,{messageId,topic,clientId:sentToAnyClient?"delivered":"pending",userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{});logger2.info("[PubSub] Broadcasted to user",{userId,topic,messageId,sentCount,storedForOffline:!sentToAnyClient})}function broadcastToUserNoAck(userId,topic,event){let timestamp=Date.now(),payload=JSON.stringify({type:"event",topic,data:event,timestamp});for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{client.ws.send(payload)}catch{clients.delete(clientId)}}}function broadcastPresenceToOthers(userId,status){let debounceKey=`${userId}:${status}`,now=Date.now(),lastBroadcast=presenceBroadcastDebounce.get(debounceKey);if(lastBroadcast&&now-lastBroadcast<presenceDebounceMs)return;if(presenceBroadcastDebounce.set(debounceKey,now),presenceBroadcastDebounce.size>1000){let cutoff=now-presenceDebounceMs*2;for(let[key2,timestamp]of presenceBroadcastDebounce)if(timestamp<cutoff)presenceBroadcastDebounce.delete(key2)}let connectedUserIds=getConnectedUserIds();for(let targetUserId of connectedUserIds)if(targetUserId!==userId)broadcastToUserNoAck(targetUserId,"user-presence",{type:"user-presence",data:{userId,status}})}async function handleClientAck(clientId,messageId){if(!ackEnabled)return!0;let client=clients.get(clientId);if(!client)return!1;if(client.pendingAcks.get(messageId))client.pendingAcks.delete(messageId);if(client.userId)return acknowledgeMessage(redis,client.userId,messageId,ackTtl);return!0}async function deliverPendingMessages(userId,clientId){if(!ackEnabled)return 0;let client=clients.get(clientId);if(!client||client.userId!==userId)return 0;let pendingMessages=await getPendingMessagesForUser(redis,userId);if(pendingMessages.length===0)return 0;logger2.info("[PubSub] Delivering pending messages",{userId,count:pendingMessages.length});let deliveredCount=0;for(let message of pendingMessages){if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(message.topic))continue;let payload=JSON.stringify({type:"event",messageId:message.messageId,topic:message.topic,data:message.data,timestamp:message.sentAt,isRedelivery:!0});try{client.ws.send(payload),client.pendingAcks.set(message.messageId,{sentAt:Date.now(),retryCount:message.retryCount+1}),await incrementRetryCount(redis,userId,message.messageId,ackTtl,maxRetries),deliveredCount++}catch{break}}return deliveredCount}function sweepStaleClients(){let payload=JSON.stringify({type:"ping",data:{at:Date.now()}}),dropped=0,checked=clients.size;for(let[clientId,client]of[...clients])try{client.ws.send(payload)}catch{clients.delete(clientId),dropped++}return{checked,dropped}}return{generateClientId,registerClient,unregisterClient,updateClientTopics,getClientsByUser,getConnectedUserIds,getClientCount,sweepStaleClients,sendToClient,broadcastEvent,broadcastToUser,broadcastToUserNoAck,broadcastPresenceToOthers,handleClientAck,deliverPendingMessages,getPendingMessageCount:(userId)=>getPendingMessageCount(redis,userId)}}var OPAQUE_RUN=/[A-Za-z0-9_-]{24,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g;function previewOf2(frame){return frame.slice(0,120).replace(OPAQUE_RUN,(match)=>`[redacted ${match.length} chars]`)}function classifyClientFrame(message){if(typeof message==="string"){if(message.trim()==="")return{kind:"ignore"};let parsed;try{parsed=JSON.parse(message)}catch{return{kind:"malformed",preview:previewOf2(message)}}return asMessage(parsed,message.length)}if(message&&typeof message==="object")return asMessage(message,approximateSize(message));return{kind:"ignore"}}function approximateSize(value2){if(ArrayBuffer.isView(value2))return value2.byteLength;if(value2 instanceof ArrayBuffer)return value2.byteLength;try{return JSON.stringify(value2)?.length??0}catch{return 0}}function asMessage(value2,size){if(!value2||typeof value2!=="object"||Array.isArray(value2))return{kind:"ignore"};let record3=value2,type4=record3.type;if(typeof type4!=="string"||type4==="")return{kind:"ignore"};return{kind:"message",parsed:record3,type:type4,size}}function tokensMatch(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual3(ba,bb)}var HEARTBEAT_WS_TYPES=new Set(["ping","pong","ack"]);function buildHandshakeHeaders(rawHeaders,queryToken){let headers=new Headers;if(rawHeaders&&typeof rawHeaders==="object"){for(let[key2,value2]of Object.entries(rawHeaders))if(typeof value2==="string")headers.set(key2,value2)}if(queryToken)headers.set("authorization",`Bearer ${queryToken}`),headers.delete("cookie");return headers}function createPubSubRoutes(config){let{logger:logger2,getLiveMonitoringService}=config,clientManager=createClientManager(config);if(config.ack.enabled)initAckCleanup();let cleanupTimer=null,daprApiToken=config.daprApiToken||process.env.APP_API_TOKEN||process.env.DAPR_API_TOKEN,warnedNoDaprToken=!1;recordBootStep(()=>{if(config.cleanupIntervalMs>0)cleanupTimer=setInterval(()=>{let{checked,dropped}=clientManager.sweepStaleClients();if(dropped>0)logger2.info("[PubSub] Dropped clients whose socket no longer accepts a write",{checked,dropped,remaining:clientManager.getClientCount()})},config.cleanupIntervalMs);logger2.info("[PubSub] Routes initialized",{basePath:config.basePath,wsPath:config.wsPath,ackEnabled:config.ack.enabled,presenceEnabled:config.presence.enabled})}),recordShutdownStep(()=>{if(cleanupTimer)clearInterval(cleanupTimer),cleanupTimer=null});let routePostTopic=defineRoute({method:"POST",path:"/:topic",handler:async({params,body,request,set:set2})=>{let topic=params.topic;if(daprApiToken){let presented=request.headers.get("dapr-api-token")??"";if(!tokensMatch(presented,daprApiToken))return logger2.warn("[PubSub] Rejected Dapr event: missing/invalid dapr-api-token",{topic}),set2.status=403,{status:"DROP"}}else if(!warnedNoDaprToken)warnedNoDaprToken=!0,logger2.warn("[PubSub] Dapr subscription endpoint is UNAUTHENTICATED \u2014 set config.pubsub.daprApiToken or the APP_API_TOKEN/DAPR_API_TOKEN env so only the Dapr sidecar can inject events");let eventData;try{if(!body){let text3=await request.text();eventData=JSON.parse(text3)}else eventData=body}catch{return set2.status=200,{status:"DROP"}}logger2.info("[PubSub] Dapr event received",{topic,eventId:eventData.id,source:eventData.source});let userId=eventData.data?.user_id;if(userId)clientManager.broadcastToUser(userId,topic,eventData);else clientManager.broadcastEvent(topic,eventData);return getLiveMonitoringService?.()?.recordDaprEvent("pubsub_subscribe",{topic,success:!0,metadata:{eventId:eventData.id,source:eventData.source,userId:userId||null}}),set2.status=200,{status:"SUCCESS"}}}),routes=collectRoutes([{prefix:config.basePath,routes:[routePostTopic]}]),socketRoute=defineWebSocketRoute({path:config.wsPath,idleTimeout:config.wsIdleTimeout,async open(ws){let data=ws.data,query=data.query,userId;if(config.authenticate){let handshakeHeaders=buildHandshakeHeaders(data.headers,query.token),authResult=await config.authenticate(handshakeHeaders);if(!authResult||!("userId"in authResult)){let reason=authResult?.reason??"unspecified";ws.send(JSON.stringify({type:"error",error:"Unauthorized: a valid session is required for this connection",reason,timestamp:Date.now()})),ws.close(4001,`Unauthorized: ${reason}`),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:`Unauthorized WebSocket handshake: ${reason}`,metadata:{reason}});return}userId=authResult.userId}else userId=query.userId;if(!userId){ws.send(JSON.stringify({type:"error",error:"userId is required for WebSocket connection",timestamp:Date.now()})),ws.close(4001,"userId is required"),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:"userId is required"});return}let clientId=clientManager.generateClientId(),topics=query.topics?.split(",").map((t)=>t.trim())||["*"];ws.data.clientId=clientId,ws.data.openedAt=Date.now();let registration=clientManager.registerClient(clientId,ws,userId,topics);if(ws.send(JSON.stringify({type:"connected",clientId,subscribedTopics:registration.accepted,...registration.dropped.length>0?{droppedTopics:registration.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})),getLiveMonitoringService?.()?.recordWsEvent("connection",{clientId,userId,topic:topics.join(","),success:!0}),config.presence.enabled)clientManager.broadcastPresenceToOthers(userId,"online");let connectedUserId=userId;if(config.ack.enabled&&connectedUserId)clientManager.getPendingMessageCount(connectedUserId).then((count2)=>{if(count2>0)logger2.info("[PubSub] Delivering pending messages",{userId:connectedUserId,count:count2}),clientManager.deliverPendingMessages(connectedUserId,clientId).catch(()=>{})}).catch(()=>{})},message(ws,message){let clientId=ws.data.clientId,frame=classifyClientFrame(message);if(frame.kind==="ignore")return;if(frame.kind==="malformed"){logger2.debug("[PubSub] Failed to parse client message",{clientId,frame:frame.preview});return}let{parsed}=frame;try{if(!HEARTBEAT_WS_TYPES.has(frame.type))getLiveMonitoringService?.()?.recordWsEvent("message",{clientId,messageType:frame.type,success:!0,dataSize:frame.size});switch(frame.type){case"subscribe":if(Array.isArray(parsed.topics)){let update=clientManager.updateClientTopics(clientId,parsed.topics);clientManager.sendToClient(clientId,{type:"subscribed",topics:update.accepted,...update.dropped.length>0?{droppedTopics:update.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})}break;case"unsubscribe":logger2.info("[PubSub] Unsubscribe request",{clientId,topics:parsed.topics});break;case"ping":clientManager.sendToClient(clientId,{type:"pong",timestamp:Date.now()});break;case"ack":if(parsed.messageId)clientManager.handleClientAck(clientId,parsed.messageId).catch(()=>{});break}}catch(error3){logger2.error("[PubSub] Client message handler failed",error3,{clientId,messageType:frame.type})}},close(ws,code,reason){let state=ws.data,clientId=state.clientId,openedAt=state.openedAt,livedMs=typeof openedAt==="number"?Date.now()-openedAt:null;if(!clientId)return;clientManager.unregisterClient(clientId),getLiveMonitoringService?.()?.recordWsEvent("close",{clientId,success:!0,metadata:{code,reason:reason||"",livedMs,shortLived:livedMs!==null&&livedMs<60000}}),logger2.info("[PubSub] Client disconnected",{clientId,code,reason,livedMs})}});return{routes,socket:socketRoute,clientManager}}init_JWT();init_utils5();init_sessionBinding();function classifyRefusal(error3){if(!error3)return"unspecified";switch(error3){case"Token expired":return"expired";case"Invalid signature":return"invalid-signature";case"Invalid token format: expected 3 parts":case"Invalid token format: missing parts":case"Invalid header: failed to decode":case"Invalid header: typ must be JWT":case"Invalid payload: failed to decode":return"malformed";case"Invalid issuer":case"Invalid audience":return"wrong-audience";case"Token issued in the future":return"not-yet-valid";default:if(error3.startsWith("Unsupported algorithm:"))return"malformed";return"unspecified"}}function createHandshakeAuthenticator(deps){return async(headers)=>{let wsTokens=parseTokenValuesFromHeaders(headers,deps.tokenNames);if(!wsTokens.access_token)return deps.logger.debug("[PubSub] WS handshake rejected: no access token presented"),{reason:"no-token"};let jwtResult=verifyJWT(wsTokens.access_token,deps.accessTokenSecret,{issuer:deps.issuer,audience:deps.audience});if(!jwtResult.valid){let reason=classifyRefusal(jwtResult.error);return deps.logger.warn("[PubSub] WS handshake rejected: JWT verification failed",{reason:jwtResult.error,classified:reason}),{reason}}let sub=jwtResult.payload?.sub;if(typeof sub!=="string"||sub.length===0)return{reason:"token-without-subject"};if(!deps.requireLiveSession)return{userId:sub};let boundSessionId=typeof jwtResult.payload.sessionId==="string"?jwtResult.payload.sessionId:"";if(!boundSessionId)return deps.logger.warn("[PubSub] WS handshake rejected: token carries no session",{userId:sub}),{reason:"session-unbound"};let tenant=typeof jwtResult.payload.tenant==="string"?jwtResult.payload.tenant:void 0,sessionsTable=deps.resolveSessionsTable?.(tenant)??null,session;try{session=await refreshSessionIsAlive({sessionId:boundSessionId,db:deps.db,sessionsTable})}catch(error3){return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId,error:error3 instanceof Error?error3.message:String(error3)}),{reason:"session-unreadable"}}if(session.unavailable)return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId}),{reason:"session-unreadable"};if(!session.alive)return deps.logger.warn("[PubSub] WS handshake rejected: session is no longer active",{userId:sub,sessionId:boundSessionId,reason:session.reason}),{reason:"session-revoked"};if(session.userId&&session.userId!==sub)return deps.logger.warn("[PubSub] WS handshake rejected: token subject is not the session owner",{userId:sub,sessionId:boundSessionId,sessionOwner:session.userId}),{reason:"session-subject-mismatch"};return{userId:sub}}}init_esm3();init_Secrets();var timed=async(fn)=>{let started=performance.now();return{result:await fn(),durationMs:Math.round(performance.now()-started)}},postForm=async(url,body)=>{let response=await fetch(url,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams(body).toString(),signal:AbortSignal.timeout(12000)}),text3=await response.text(),json={};try{json=JSON.parse(text3)}catch{json=Object.fromEntries(new URLSearchParams(text3))}return{status:response.status,json,text:text3}},describeError=(error3)=>{if(error3 instanceof Error){if(error3.name==="TimeoutError")return"Provider did not respond within 12s";return error3.message}return String(error3)},MICROSOFT_TOKEN_URL=(tenant)=>`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,DEFAULT_TOKEN_URLS={google:"https://oauth2.googleapis.com/token",github:"https://github.com/login/oauth/access_token"},describeRedirectUri=(value2)=>{let trimmed=value2?.trim();if(!trimmed)return"The reply URL (Redirect URI) is empty \u2014 sign-in cannot complete";if(/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))return`The reply URL looks like an environment variable name ("${trimmed}") and that variable is not set`;let parsed;try{parsed=new URL(trimmed)}catch{return`The reply URL is not a valid URL: "${trimmed}"`}if(parsed.protocol!=="https:"&&parsed.hostname!=="localhost")return`The reply URL must be https (it is "${parsed.protocol}//")`;return null};async function testOAuthProvider(provider,config){if(!config.clientId||!config.clientSecret)return{ok:!1,status:"failed",message:"Client ID and Client Secret must both be filled in",durationMs:0};let redirectProblem=describeRedirectUri(config.redirectUri);if(redirectProblem)return{ok:!1,status:"failed",message:redirectProblem,durationMs:0};try{if(provider==="microsoft"){let tenant=config.tenantId||"common";if(tenant==="common"||tenant==="organizations"||tenant==="consumers")return await probeWithBogusCode(MICROSOFT_TOKEN_URL(tenant),config);let{result,durationMs}=await timed(()=>postForm(MICROSOFT_TOKEN_URL(tenant),{grant_type:"client_credentials",client_id:config.clientId,client_secret:config.clientSecret,scope:"https://graph.microsoft.com/.default"}));if(result.status===200&&result.json.access_token)return{ok:!0,status:"ok",message:`Entra credentials verified (tenant ${tenant})`,durationMs};let code=String(result.json.error??result.status);return{ok:!1,status:"failed",message:String(result.json.error_description??result.text).slice(0,400),code,durationMs}}let tokenUrl=config.tokenUrl||DEFAULT_TOKEN_URLS[provider];if(!tokenUrl)return{ok:!1,status:"unknown",message:`No token URL is known for "${provider}" \u2014 enter a tokenUrl`,durationMs:0};return await probeWithBogusCode(tokenUrl,config)}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function probeWithBogusCode(tokenUrl,config){let{result,durationMs}=await timed(()=>postForm(tokenUrl,{grant_type:"authorization_code",code:"nucleus-credential-probe",client_id:config.clientId,client_secret:config.clientSecret,redirect_uri:config.redirectUri||"https://localhost/callback"})),code=String(result.json.error??""),description=String(result.json.error_description??result.text).slice(0,400);if(code==="invalid_grant"||code==="bad_verification_code")return{ok:!0,status:"ok",message:"The provider accepted these credentials",code,durationMs};if(code==="invalid_client"||code==="unauthorized_client"||result.status===401)return{ok:!1,status:"failed",message:description||"The provider refused this Client ID/Secret pair",code:code||"invalid_client",durationMs};if(description.includes("AADSTS7000215")||description.includes("AADSTS700016"))return{ok:!1,status:"failed",message:description,code,durationMs};return{ok:!1,status:"unknown",message:description||"The provider returned an unexpected answer",code:code||String(result.status),durationMs}}async function testStorageProvider(provider){if(!provider)return{ok:!1,status:"failed",message:"No storage provider is configured",durationMs:0};try{let{result,durationMs}=await timed(()=>provider.isAvailable());return result?{ok:!0,status:"ok",message:`Connection verified: ${provider.describe}`,durationMs}:{ok:!1,status:"failed",message:`Unreachable: ${provider.describe} \u2014 check the server, the share name and the credentials`,durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function testEmailProvider(service,recipient){if(!service)return{ok:!1,status:"failed",message:"No email provider is configured",durationMs:0};if(!service.isAvailable())return{ok:!1,status:"failed",message:"The provider could not be started with these credentials",durationMs:0};if(!recipient)return{ok:!0,status:"ok",message:"The provider started \u2014 enter a recipient address to send for real",durationMs:0};try{let{result,durationMs}=await timed(()=>service.sendEmail({to:recipient,subject:"Nucleus connection test",html:"<p>This email was sent by a connection test run from the admin panel.</p>"}));return result.success?{ok:!0,status:"ok",message:`Test email sent to ${recipient}`,durationMs}:{ok:!1,status:"failed",message:result.error??"Sending failed",durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}init_routeCollector();init_godminGuard();var SECRET_KINDS=["text","password","json","connection_string","pem","boolean","list"];var SCOPE_PATTERN=/^[A-Za-z0-9_.-]{1,200}$/,KEY_PATTERN=/^[A-Za-z0-9_-]{1,120}$/,fail5=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createSecretsRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,getService,resolvedOptions,getEmailService,getStorageProvider:getStorageProvider2}=routeConfig,guard4=createGodminGuard2({logger:logger2,db,schemaTables,area:"secrets management",allowedRoles:routeConfig.adminRoles}),requireService=(set2)=>{let service=getService();if(!service)return set2.status=503,null;return service},actorOf=(request)=>request.headers.get("x-user-id")??void 0,declared=[defineRoute({method:"GET",path:"/slots",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled \u2014 set secrets.enabled and provide an encryption key",data:null};let slots=await service.describe(resolvedOptions),groups=[...new Set(slots.map((s)=>s.group))].sort();return{isSuccess:!0,message:"Credential slots",data:{slots,groups,counts:{total:slots.length,fromDb:slots.filter((s)=>s.source==="db").length,fromEnv:slots.filter((s)=>s.source==="env").length,missing:slots.filter((s)=>s.source==="missing").length,missingRequired:slots.filter((s)=>s.source==="missing"&&s.required).length}}}},detail:{tags:["Secrets"],summary:"List credential slots discovered from the running config",description:"Slots are derived by walking the config tree, so a new integration appears without a code change. Values are never returned \u2014 only a masked preview and the resolution source."}}),defineRoute({method:"GET",path:"/",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};return{isSuccess:!0,message:"Stored credentials",data:{secrets:await service.list()}}},detail:{tags:["Secrets"],summary:"List stored credentials",description:"Metadata only \u2014 the encrypted value is never returned."}}),defineRoute({method:"PUT",path:"/:scope/:key",handler:async({params,body,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{scope,key:key2}=params;if(!SCOPE_PATTERN.test(scope))return fail5(set2,400,"Invalid scope");if(!KEY_PATTERN.test(key2))return fail5(set2,400,"Invalid key");let value2=body.value;if(typeof value2!=="string"||value2.length===0)return fail5(set2,400,"value is required");if(value2.length>65536)return fail5(set2,400,"value exceeds 64KB");if(body.kind==="json")try{JSON.parse(value2)}catch{return fail5(set2,400,"value is not valid JSON")}let saved=await service.set({scope,key:key2,value:value2,kind:body.kind,description:body.description,actorId:actorOf(request)});if(!saved)return fail5(set2,500,"Could not store the credential");return{isSuccess:!0,message:"Credential stored",data:{secret:saved}}},params:Type.Object({scope:Type.String(),key:Type.String()}),body:Type.Object({value:Type.String(),kind:Type.Optional(Type.Union(SECRET_KINDS.map((kind)=>Type.Literal(kind)))),description:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Set or rotate a credential",description:"Stores the value encrypted (AES-256-GCM). Rotating retains the previous value for a one-step rollback. Takes effect within seconds on every pod \u2014 no restart."}}),defineRoute({method:"POST",path:"/:scope/:key/rollback",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let restored=await service.rollback(params.scope,params.key,actorOf(request));if(!restored)return fail5(set2,404,"No previous value to roll back to");return{isSuccess:!0,message:"Previous credential restored",data:{secret:restored}}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Roll back to the value replaced by the last rotation"}}),defineRoute({method:"DELETE",path:"/:scope/:key",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!await service.remove(params.scope,params.key,actorOf(request)))return fail5(set2,404,"Credential not found");return{isSuccess:!0,message:"Credential removed \u2014 the config falls back to env or literal",data:null}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Delete a stored credential",description:"Resolution falls back to the env var or literal declared in config."}}),defineRoute({method:"POST",path:"/test",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{target:target2}=body,result;if(target2==="email")result=await testEmailProvider(getEmailService?.()??null,body.recipient);else if(target2==="oauth"){let provider=body.provider;if(!provider)return fail5(set2,400,"provider is required for an oauth test");let scope=`authentication.oauth.providers.${provider}`,providerConfig=(resolvedOptions.authentication?.oauth?.providers??{})[provider]??{},declaredString=(key2)=>{let raw=providerConfig[key2];return typeof raw==="string"?raw:void 0};result=await testOAuthProvider(provider,{clientId:service.value(scope,"clientId",declaredString("clientId")),clientSecret:service.value(scope,"clientSecret",declaredString("clientSecret")),tenantId:service.value(scope,"tenantId",declaredString("tenantId")),tokenUrl:declaredString("tokenUrl"),redirectUri:service.value(scope,"redirectUri",declaredString("redirectUri"))})}else if(target2==="storage")result=await testStorageProvider(getStorageProvider2?.()??null);else return fail5(set2,400,`Unsupported test target "${target2}"`);return logger2.info("[Secrets] Connection test",{target:target2,provider:body.provider,status:result.status,durationMs:result.durationMs}),{isSuccess:result.ok,message:result.message,data:{result}}},body:Type.Object({target:Type.Union([Type.Literal("oauth"),Type.Literal("email"),Type.Literal("storage")]),provider:Type.Optional(Type.String()),recipient:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Test a credential against the real provider",description:"Backend-to-backend only. OAuth uses client_credentials where the provider supports it and a client-authentication probe otherwise; email optionally sends a real test message."}}),defineRoute({method:"POST",path:"/reencrypt",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!body.newMasterKey||body.newMasterKey.length<16)return fail5(set2,400,"newMasterKey must be at least 16 characters");let result=await service.reencryptAll(body.newMasterKey),uncovered="Credentials stored outside this store \u2014 an integration connection\u2019s token, client secret and service password \u2014 are NOT re-encrypted by this. Re-enter them from the integrations panel after the new key is deployed.";return{isSuccess:result.failed.length===0,message:result.failed.length===0?`Re-encrypted ${result.migrated} credentials \u2014 deploy the new key before the next restart. ${uncovered}`:`Nothing was re-encrypted: ${result.failed.length} credential(s) could not be read with the current key, so none were rewritten.`,data:{...result,uncovered}}},body:Type.Object({newMasterKey:Type.String()}),detail:{tags:["Secrets"],summary:"Re-encrypt every credential under a new master key",description:"Rotates the key protecting the store. The new key must be deployed to the environment before the next restart, or nothing will decrypt."}}),defineRoute({method:"GET",path:"/discover",handler:()=>({isSuccess:!0,message:"Slots discovered from the running config",data:{slots:discoverSlots(resolvedOptions).map(({configValue:_configValue,...slot})=>slot)}}),detail:{tags:["Secrets"],summary:"Show which credential slots the config declares",description:"Diagnostics \u2014 resolution state is not consulted and no value is read."}}),defineRoute({method:"POST",path:"/storage/migrate",handler:async(ctx)=>{let body=ctx.body,build=routeConfig.buildStorageProvider;if(!build)return fail5(ctx.set,503,"Storage is not configured");let destination=build(body.to),source=build(body.to==="smb"?"local":"smb");if(!source||!destination)return fail5(ctx.set,503,"Storage is not configured");if(!await destination.isAvailable())return fail5(ctx.set,422,`The destination store is unreachable (${destination.describe}) \u2014 test the connection first`);if(body.dryRun){let preview=await migrateStorage({from:source,to:Object.assign(Object.create(Object.getPrototypeOf(destination)),destination,{exists:async()=>!1,write:async()=>{},ensureDir:async()=>{}}),maxFiles:1e5},{logger:logger2});return{isSuccess:!0,message:`${preview.copied} file${preview.copied===1?"":"s"} would be copied`,data:{preview}}}let report=await migrateStorage({from:source,to:destination},{logger:logger2}),clean=report.failed===0&&!report.truncated;return logger2.warn("[Storage] Migration run from the admin panel",{to:body.to,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),{isSuccess:clean,message:clean?`${report.copied} file${report.copied===1?"":"s"} copied, ${report.skipped} already present`:`${report.copied} copied, ${report.failed} failed${report.truncated?", list truncated":""}`,data:{report}}},body:Type.Object({to:Type.Union([Type.Literal("local"),Type.Literal("smb")]),dryRun:Type.Optional(Type.Boolean())}),detail:{tags:["Secrets"],summary:"Copy every stored file to the other backend",description:"Copy-only: the source is never deleted, and a file already on the target is skipped so a re-run resumes. Run BEFORE switching storage.provider."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function readAttemptedIdentity(parsedBody,rawBodyText,contentType){let fromJson=parsedBody.email;if(typeof fromJson==="string"&&fromJson.trim())return fromJson;if(!rawBodyText)return;if((contentType||"").toLowerCase().includes("application/x-www-form-urlencoded"))try{let value2=new URLSearchParams(rawBodyText).get("email");return value2?.trim()?value2:void 0}catch{return}return}var snakeToCamel4=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function warnOnEntityBasePathCollision(feature,basePath,entities,logger2){let segment=basePath.replace(/^\/+|\/+$/g,"");if(!segment||segment.includes("/"))return!1;let clash=(entities??[]).find((entity)=>snakeToCamel4(entity.table_name)===segment);if(!clash)return!1;return logger2.error(`[${feature}] basePath "${basePath}" is also the generated entity route for "${clash.table_name}". Both are registered and one will shadow the other. Move the feature (e.g. "/nucleus${basePath}") or rename the entity.`),!0}var ipMatches=(ip,entry)=>entry.includes("/")?isIpInCidr(ip,entry):ip===entry;function canonicalIp(ip){let trimmed=ip.trim();return/^::ffff:((?:\d{1,3}\.){3}\d{1,3})$/i.exec(trimmed)?.[1]??trimmed}function resolveClientIp(socketIp,forwardedFor,trustedProxies=[]){let peer=canonicalIp(socketIp||""),chain=(forwardedFor||"").split(",").map((s)=>canonicalIp(s)).filter(Boolean);if(!peer)return chain[0]||"unknown";if(trustedProxies.length===0)return peer;let trusted=(ip)=>trustedProxies.some((p)=>ipMatches(ip,p));if(!trusted(peer))return peer;for(let i=chain.length-1;i>=0;i--){let hop=chain[i];if(hop&&!trusted(hop))return hop}return chain[0]||peer}var isNonDiscriminatingPeer=(ip)=>ip==="::1"||ip==="unknown"||/^(::ffff:)?127\./.test(ip);function createPeerDiversityWatcher(sampleSize=200){let seen=new Set,seenCount=0,settled=!1;return{observe(ip){if(settled)return null;if(seenCount++,seen.add(ip),seen.size>1)return settled=!0,null;if(seenCount>=sampleSize)return settled=!0,ip;return null}}}var DEFAULTS={cookieName:"csrf_token",headerName:"x-csrf-token"},resolveCsrfConfig=(raw)=>{if(raw===!0)return{enabled:!0,...DEFAULTS};if(!raw)return{enabled:!1,...DEFAULTS};return{enabled:raw.enabled!==!1,cookieName:raw.cookieName||DEFAULTS.cookieName,headerName:(raw.headerName||DEFAULTS.headerName).toLowerCase()}},parseCookies=(cookieHeader)=>{let out={};if(!cookieHeader)return out;for(let part of cookieHeader.split(";")){let trimmed=part.trim(),eq41=trimmed.indexOf("=");if(eq41>0)out[trimmed.slice(0,eq41)]=trimmed.slice(eq41+1)}return out},SAFE_METHODS=new Set(["GET","HEAD","OPTIONS"]),isStateChanging=(method)=>!SAFE_METHODS.has(method.toUpperCase()),requiresCsrf=(params)=>{if(!isStateChanging(params.method))return!1;if(params.hasAuthorizationHeader)return!1;return params.authCookieNames.some((n)=>!!params.cookies[n])},csrfTokenMatches=(csrfCookie,csrfHeader)=>{if(!csrfCookie||!csrfHeader)return!1;return csrfCookie===csrfHeader};init_redactSecrets();var SENSITIVE_HEADER_NAMES=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-access-token","x-refresh-token","x-session-id","x-user-id","x-user-roles","x-user-claims","x-user-email","x-api-key","x-api-key-id","x-api-key-owner-type","x-auth-type"]);function redactSensitiveHeaders(headers){return redactHeaders(headers,{alwaysRedact:SENSITIVE_HEADER_NAMES})}init_sensitiveColumns();var TENANT_CLAIM="tenant",verifyTenantBinding=(tokenTenant,resolvedSchema,mode="lenient")=>{if(mode==="off")return{ok:!0};if(!resolvedSchema)return{ok:!0};let claim=typeof tokenTenant==="string"&&tokenTenant.length>0?tokenTenant:void 0;if(!claim)return mode==="strict"?{ok:!1,reason:"token is not bound to a tenant"}:{ok:!0};return claim===resolvedSchema?{ok:!0}:{ok:!1,reason:"token tenant does not match the requested tenant"}};init_storage2();init_routeMount();init_esm3();init_routeCollector();import{eq as eq41}from"drizzle-orm";var RESERVED_SUBDOMAINS=["www","api","app","admin","dashboard","mail","ftp","cdn","static","assets","docs","help","support","status","blog","dev","staging","test","demo","localhost"],DEFAULT_SELF_SIGNUP_LIMITS={maxSignupsPerIpPerWindow:3,ipWindowMs:3600000,maxTenantsPerEmail:1};var col9=(table,name2)=>table[name2];function createCheckSubdomainRoute(config){let declared=[defineRoute({method:"GET",path:"/tenants/check-subdomain/:subdomain",handler:async(ctx)=>{let{subdomain}=ctx.params,normalized=subdomain.toLowerCase().trim();if(!/^[a-z][a-z0-9-]*$/.test(normalized)||normalized.length<2||normalized.length>63)return ctx.set.status=400,{isSuccess:!1,message:"Invalid subdomain format. Must start with a letter, contain only lowercase letters, numbers, and hyphens, and be 2-63 characters.",data:{available:!1,subdomain:normalized}};if(RESERVED_SUBDOMAINS.includes(normalized))return{isSuccess:!0,message:"Subdomain is reserved",data:{available:!1,subdomain:normalized}};let tenantRegistry=config.getTenantRegistry(),db=config.getDb();if(tenantRegistry){if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===normalized))return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}if(db&&tenantRegistry){let tenantsTable=tenantRegistry.getMainContext().schemaTables.tenants;if(tenantsTable)try{if((await db.select().from(tenantsTable).where(eq41(col9(tenantsTable,"subdomain"),normalized)).limit(1)).length>0)return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}catch{}}return{isSuccess:!0,message:"Subdomain is available",data:{available:!0,subdomain:normalized}}},params:Type.Object({subdomain:Type.String({minLength:2,maxLength:63})}),detail:{tags:["Tenants"],summary:"Check subdomain availability",description:"Public endpoint to check if a subdomain is available for registration. No authentication required."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Logger2();init_routeCollector();init_adminGuard();import{eq as eq42}from"drizzle-orm";var col10=(table,name2)=>table[name2];function createManageRoutes(config){let log4=config.logger.scoped(TENANT_SUSPEND),declared=[defineRoute({method:"GET",path:"/tenants",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let allTenants=[...tenantRegistry.getActiveTenants(),...Array.from(getAllTenants(tenantRegistry)).filter((t)=>t.status!=="active")];return{success:!0,message:`Found ${allTenants.length} tenants`,data:{items:allTenants.map((t)=>({id:t.id,subdomain:t.subdomain,schemaName:t.schemaName,companyId:t.companyId,companyName:t.companyName,godAdminEmail:t.godAdminEmail,status:t.status,plan:t.plan,domain:t.domain,maxUsers:t.maxUsers,provisionedAt:t.provisionedAt,suspendedAt:t.suspendedAt})),totalCount:allTenants.length}}},detail:{tags:["Tenants"],summary:"List tenants",description:"List all tenants in the platform. Requires godmin privileges."}}),defineRoute({method:"GET",path:"/tenants/:id",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found",data:null};let features=tenantRegistry.getTenantFeatures(id);return{success:!0,message:"Tenant found",data:{...tenant,features:features.map((f)=>({featureName:f.featureName,enabled:f.enabled}))}}},detail:{tags:["Tenants"],summary:"Get tenant details",description:"Get detailed information about a specific tenant. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/suspend",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,body=ctx.body,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status==="suspended")return ctx.set.status=400,{success:!1,message:"Tenant is already suspended"};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"suspended",suspendedAt:now,suspendedReason:body.reason||"Suspended by godmin",updatedAt:now}).where(eq42(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"suspended",eventData:JSON.stringify({reason:body.reason||"Suspended by godmin"}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log4.warn("Failed to record suspend event")}return await tenantRegistry.refreshTenant(id),log4.info("Tenant suspended",{tenantId:id,reason:body.reason}),{success:!0,message:`Tenant "${tenant.subdomain}" suspended`}},body:Type.Object({reason:Type.Optional(Type.String())}),detail:{tags:["Tenants"],summary:"Suspend tenant",description:"Suspend a tenant, preventing all access. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/reactivate",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status!=="suspended")return ctx.set.status=400,{success:!1,message:`Tenant is not suspended (current: ${tenant.status})`};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"active",suspendedAt:null,suspendedReason:null,updatedAt:now}).where(eq42(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"reactivated",eventData:JSON.stringify({previousReason:tenant.suspendedReason}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log4.warn("Failed to record reactivate event")}return await tenantRegistry.refreshTenant(id),log4.info("Tenant reactivated",{tenantId:id}),{success:!0,message:`Tenant "${tenant.subdomain}" reactivated`}},detail:{tags:["Tenants"],summary:"Reactivate tenant",description:"Reactivate a suspended tenant. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}var verifyGodmin=async(request,db,tenantRegistry,userId)=>{if(!mayActAsGodmin(request))return!1;let usersTable=tenantRegistry.getMainContext().schemaTables.users;if(!usersTable)return!1;return(await db.select().from(usersTable).where(eq42(col10(usersTable,"id"),userId)).limit(1))[0]?.isGod===!0},getAllTenants=(registry4)=>{let schemaNames=registry4.getAllSchemaNames(),tenants=[];for(let name2 of schemaNames){let ctx=registry4.getSchemaContext(name2);if(ctx?.tenant)tenants.push(ctx.tenant)}return tenants};init_esm3();init_Logger2();init_routeCollector();init_utils6();init_adminGuard();import{eq as eq43}from"drizzle-orm";var col11=(table,name2)=>table[name2],ProvisionBodySchema=Type.Object({subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),companyId:Type.String({format:"uuid"}),companyName:Type.Optional(Type.String()),godAdminEmail:Type.String({format:"email"}),plan:Type.Optional(Type.String()),domain:Type.Optional(Type.String())});function createProvisionRoute(config){let log4=config.logger.scoped(TENANT_PROVISION),declared=[defineRoute({method:"POST",path:"/tenants/provision",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users;if(!usersTable)return ctx.set.status=503,{success:!1,message:"Users table not available"};let requestingUser=(await db.select().from(usersTable).where(eq43(col11(usersTable,"id"),requestingUserId)).limit(1))[0];if(!mayActAsGodmin(ctx.request)||!requestingUser?.isGod)return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let body=ctx.body,tenantSchemaName=`tenant_${body.subdomain.replace(/-/g,"_")}`;if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===body.subdomain))return ctx.set.status=409,{success:!1,message:`Subdomain "${body.subdomain}" is already taken`};let tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available in main schema"};let tenantId=crypto.randomUUID(),now=new Date;try{await db.insert(tenantsTable).values({id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,createdAt:now,updatedAt:now}),log4.info("Tenant record created",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName})}catch(err){let msg=err instanceof Error?err.message:String(err);return log4.error("Failed to insert tenant record",{error:msg}),ctx.set.status=500,{success:!1,message:`Failed to create tenant record: ${msg}`}}try{let tenantRecord={id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log4.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable){let godminId=crypto.randomUUID(),tempPassword=crypto.randomUUID().slice(0,16),hashedPassword=await hashPassword(tempPassword);await db.insert(tenantUsersTable).values({id:godminId,email:body.godAdminEmail,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log4.info("Godmin user seeded",{tenantId,godminEmail:body.godAdminEmail,godminId})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq43(col11(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"provisioned",eventData:JSON.stringify({schemaName:tenantSchemaName,godAdminEmail:body.godAdminEmail,plan:body.plan||null}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log4.warn("Failed to record tenant_event, continuing")}return await tenantRegistry.refreshTenant(tenantId),log4.info("Provisioning complete",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"PROVISION",userId:requestingUserId,summary:`Tenant "${body.subdomain}" provisioned by godmin`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant provisioned successfully",data:{tenantId,schemaName:tenantSchemaName,subdomain:body.subdomain,godAdminEmail:body.godAdminEmail,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log4.error("Provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq43(col11(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:`Provisioning failed: ${msg}`}}},body:ProvisionBodySchema,detail:{tags:["Tenants"],summary:"Provision new tenant",description:"Create a new tenant with its own schema, tables, and godmin user. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Authorization();init_Logger2();init_routeCollector();init_passwordPolicy();init_utils6();import{eq as eq44}from"drizzle-orm";var col12=(table,name2)=>table[name2],ipRateMap=new Map,lastCleanup=Date.now();function cleanupRateMap(windowMs){let now=Date.now();if(now-lastCleanup<600000)return;lastCleanup=now;for(let[key2,entry]of ipRateMap.entries())if(now-entry.windowStart>windowMs)ipRateMap.delete(key2)}function isIpRateLimited(ip,maxPerWindow,windowMs){let now=Date.now(),entry=ipRateMap.get(ip);if(!entry||now-entry.windowStart>windowMs)return ipRateMap.set(ip,{count:1,windowStart:now}),!1;return entry.count++,entry.count>maxPerWindow}var SelfSignupBodySchema=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),plan:Type.Optional(Type.String()),companyName:Type.Optional(Type.String())});function createSelfSignupRoute(config){let log4=config.logger.scoped(TENANT_SELF_SIGNUP),limits={...DEFAULT_SELF_SIGNUP_LIMITS,...config.selfSignupLimits},declared=[defineRoute({method:"POST",path:"/tenants/self-signup",handler:async(ctx)=>{cleanupRateMap(limits.ipWindowMs);let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let ip=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown";if(isIpRateLimited(ip,limits.maxSignupsPerIpPerWindow,limits.ipWindowMs))return log4.warn("Self-signup rate limited",{ip}),ctx.set.status=429,{success:!1,message:"Too many signup attempts. Please try again later."};let body=ctx.body,email=body.email.toLowerCase().trim(),subdomain=body.subdomain.toLowerCase().trim();if(RESERVED_SUBDOMAINS.includes(subdomain))return ctx.set.status=400,{success:!1,message:"This subdomain is reserved."};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users,tenantsTable=mainContext.schemaTables.tenants;if(!usersTable||!tenantsTable)return ctx.set.status=503,{success:!1,message:"Required tables not available."};if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===subdomain))return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."};try{if((await db.select().from(tenantsTable).where(eq44(col12(tenantsTable,"subdomain"),subdomain)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."}}catch{}try{if((await db.select().from(tenantsTable).where(eq44(col12(tenantsTable,"godAdminEmail"),email))).length>=limits.maxTenantsPerEmail)return ctx.set.status=409,{success:!1,message:`Tenant limit reached. Maximum ${limits.maxTenantsPerEmail} tenant(s) per account.`}}catch{}let strength=validateAgainstPolicy(body.password,void 0,body.email);if(!strength.valid)return ctx.set.status=400,{success:!1,message:"Password too weak",errors:strength.errors};let userId,hashedPassword=await hashPassword(body.password),now=new Date,existingUsers=await db.select().from(usersTable).where(eq44(col12(usersTable,"email"),email)).limit(1);if(existingUsers.length>0)userId=existingUsers[0].id,log4.info("Self-signup: existing user resolved",{userId,email});else{userId=crypto.randomUUID();try{await db.insert(usersTable).values({id:userId,email,password:hashedPassword,isActive:!0,createdAt:now,updatedAt:now}),log4.info("Self-signup: user created",{userId,email})}catch(err){let msg=err instanceof Error?err.message:String(err);return log4.error("Self-signup: user creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create account."}}}let tenantId=crypto.randomUUID(),tenantSchemaName=`tenant_${subdomain.replace(/-/g,"_")}`;try{await db.insert(tenantsTable).values({id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,createdAt:now,updatedAt:now}),log4.info("Tenant record created",{tenantId,subdomain})}catch(err){let msg=err instanceof Error?err.message:String(err);return log4.error("Tenant record creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create tenant."}}try{let tenantRecord={id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,domain:null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log4.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable)await db.insert(tenantUsersTable).values({id:userId,email,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log4.info("Godmin seeded in tenant schema",{tenantId,email,userId});let tenantRolesTable=tenantContext.schemaTables.roles,tenantUserRolesTable=tenantContext.schemaTables.userRoles;if(tenantRolesTable&&tenantUserRolesTable)try{let godminRoles=await db.select().from(tenantRolesTable).where(eq44(tenantRolesTable.name,GODMIN_ROLE_NAME)).limit(1),godminRoleId;if(godminRoles.length>0)godminRoleId=godminRoles[0].id;else{let[newRole]=await db.insert(tenantRolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();godminRoleId=newRole.id,log4.info("Created godmin role in tenant schema",{tenantId,roleId:godminRoleId})}if(godminRoleId)await db.insert(tenantUserRolesTable).values({userId,roleId:godminRoleId}),log4.info("Assigned godmin role to signup user",{tenantId,userId,roleId:godminRoleId})}catch(roleErr){log4.warn("Failed to assign godmin role to signup user",{tenantId,userId,error:roleErr instanceof Error?roleErr.message:String(roleErr)})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq44(col12(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"self_signup",eventData:JSON.stringify({email,subdomain,plan:body.plan||null}),performedBy:userId,ipAddress:ip,createdAt:now,updatedAt:now})}catch{}return await tenantRegistry.refreshTenant(tenantId),log4.info("Self-signup complete",{tenantId,subdomain,email}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"SELF_SIGNUP",userId,summary:`Self-signup: tenant "${subdomain}" provisioned by ${email}`,ipAddress:ip,userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant created successfully",data:{tenantId,subdomain,schemaName:tenantSchemaName,userId,email,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log4.error("Self-signup provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq44(col12(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:"Provisioning failed. Please try again."}}},body:SelfSignupBodySchema,detail:{tags:["Tenants"],summary:"Self-service tenant signup",description:"Public endpoint for self-service signup. Creates user account, provisions tenant schema, and seeds godmin. Rate-limited by IP with configurable max tenants per email."}})];return collectRoutes([{routes:declared}])}function createTenantRoutes(app,config){return useRoutes(app,createCheckSubdomainRoute(config)),useRoutes(app,createProvisionRoute(config)),useRoutes(app,createSelfSignupRoute(config)),useRoutes(app,createManageRoutes(config)),app}init_esm3();init_routeCollector();init_adminGuard();init_apiKeyCeiling();init_buildServices();var MODEL_2_GRAPH_SCHEMA=Type.Object({steps:Type.Array(Type.Object({node_id:Type.String({minLength:1,maxLength:255}),step_order:Type.Integer({minimum:1,maximum:200}),name:Type.Optional(Type.String({maxLength:255})),description:Type.Optional(Type.String({maxLength:4000})),kind:Type.Optional(Type.Union([Type.Literal("approval"),Type.Literal("revision")])),approval_mode:Type.Optional(Type.Union([Type.Literal("all_assignees"),Type.Literal("any_assignee")])),on_approved:Type.Optional(Type.Union([Type.Literal("next"),Type.Literal("complete"),Type.Literal("goto_step")])),on_approved_step_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),on_rejected:Type.Optional(Type.Union([Type.Literal("end"),Type.Literal("goto_step")])),on_rejected_step_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),assignees:Type.Array(Type.Object({slot_index:Type.Integer({minimum:1,maximum:50}),verifier_type:Type.Union([Type.Literal("role"),Type.Literal("user"),Type.Literal("entity_author")]),verifier_user_id:Type.Optional(Type.Union([Type.String(),Type.Null()])),verifier_role:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),require_signature:Type.Optional(Type.Boolean()),role_quorum:Type.Optional(Type.Union([Type.Literal("one"),Type.Literal("all")])),legacy_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()]))}))})),actions:Type.Array(Type.Object({step_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),trigger:Type.Union([Type.Literal("on_flow_started"),Type.Literal("on_step_reached"),Type.Literal("on_approved"),Type.Literal("on_rejected"),Type.Literal("on_flow_completed"),Type.Literal("on_flow_rejected"),Type.Literal("on_resubmitted")]),action_type:Type.Optional(Type.Literal("notify")),action_order:Type.Optional(Type.Integer({minimum:1,maximum:200})),is_enabled:Type.Optional(Type.Boolean()),fires_on_pass:Type.Optional(Type.Union([Type.Literal("every"),Type.Literal("first"),Type.Literal("repeat")])),title_template:Type.Optional(Type.Union([Type.String({maxLength:8000}),Type.Null()])),body_template:Type.Optional(Type.Union([Type.String({maxLength:8000}),Type.Null()])),starts_at:Type.Optional(Type.Union([Type.String(),Type.Null()])),expires_at:Type.Optional(Type.Union([Type.String(),Type.Null()])),config:Type.Optional(Type.Union([Type.Record(Type.String(),Type.Any()),Type.Null()])),recipients:Type.Array(Type.Object({recipient_type:Type.Union([Type.Literal("user"),Type.Literal("role"),Type.Literal("all_verifiers"),Type.Literal("step_verifier"),Type.Literal("entity_creator")]),recipient_user_id:Type.Optional(Type.Union([Type.String(),Type.Null()])),recipient_role:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()]))})),channels:Type.Array(Type.Union([Type.Literal("portal"),Type.Literal("email"),Type.Literal("sms"),Type.Literal("telegram"),Type.Literal("webhook")]))}))});function createVerificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry}=routeConfig,{verificationService:defaultVerificationService,notificationService:defaultNotificationService}=buildVerificationServices({db,schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService}),getServicesForRequest=(request)=>{if(!tenantRegistry)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};return buildVerificationServices({db,schemaTables:ctx.schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService})},basePath=config.endpoints?.basePath||"/verifications",flowBasePath=config.flowEndpoints?.basePath||"/verification-flows",requireUser=({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,{success:!1,message:"Authentication required"}},mayStartFor=(request,entityName)=>{if(hasGodminRole(request))return!0;let claims=decodeHeaderList(request.headers.get("x-user-claims"));if(claims.length===0)return!1;let wanted=new Set;for(let name2 of bothSpellings(entityName))for(let verb of["post","patch","put"])wanted.add(`${verb}.${name2}`);return claims.some((c)=>{for(let w of wanted)if(c===w||c.startsWith(`${w}.`))return!0;return!1})},verificationDeclared=[defineRoute({method:"GET",path:"/status/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:status}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/cancel",params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({reason:Type.Optional(Type.String({maxLength:1000})),end_reason:Type.Optional(Type.Union([Type.Literal("cancelled"),Type.Literal("superseded")]))}),detail:{tags:["Verification"],summary:"Cancel the active chain on a record",description:"Closes a chain nobody can decide any more (verifiers gone, flow withdrawn). "+"The record returns to the verdict its last finished chain gave it \u2014 an approval only "+"if the record has not changed since \u2014 or to pending otherwise, and a new chain can "+'be started. History is kept. `end_reason: "superseded"` records that a newer record replaced this one; it is written only when the host confirms that (`isRecordSuperseded`), and refused with 409 otherwise.'},handler:async({params,body,request,set:set2})=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,{success:!1,message:"User ID required"};let{verificationService}=getServicesForRequest(request),isGod=hasGodminRole(request),startedBy=(await verificationService.getStatus(params.entity_name,params.entity_id)).instance?.started_by;if(!isGod&&startedBy!==userId)return set2.status=403,{success:!1,code:"cancel_not_allowed",detail:{},message:"Only the person who started this verification, or a godmin, can cancel it"};let result=await verificationService.cancelInstance({entity_name:params.entity_name,entity_id:params.entity_id,cancelled_by:userId,reason:body?.reason,end_reason:body?.end_reason});if(!result.success)set2.status=409;return result}}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/decide",handler:async({params,body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};let result=await verificationService.decide({entity_name:params.entity_name,entity_id:params.entity_id,user_id:userId,decision:body.decision,reason:body.reason,signature_id:body.signature_id,diff:body.diff,role_ceiling:apiKeyRoleCeiling(request)});if(result.success)try{let reqUrl=new URL(request.url);await logger2.audit({entityName:params.entity_name,entityId:params.entity_id,operation:body.decision==="approved"?"APPROVE":"REJECT",userId,summary:`${String(result.verification?.decision??body.decision)} by ${userId}: ${result.message}${body.reason?` \u2014 ${body.reason}`:""}`,ipAddress:request.headers.get("x-client-ip")?.trim()||"unknown",userAgent:request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}catch(err){logger2.error(`[Verification] Decision audit failed (decision stands): ${String(err)}`)}return result},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({decision:Type.Union([Type.Literal("approved"),Type.Literal("rejected")]),reason:Type.Optional(Type.String()),signature_id:Type.Optional(Type.String()),diff:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})}),defineRoute({method:"GET",path:"/pending",handler:async({request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return{success:!0,data:await verificationService.getPending(userId)}}}),defineRoute({method:"GET",path:"/history/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:{verifications:status.verifications,current_step:status.current_step,total_steps:status.total_steps,is_completed:status.is_completed,is_rejected:status.is_rejected}}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,code:"start_not_allowed",detail:{entityName:body.entity_name},message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlow({flow_id:body.flow_id,entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start-for-entity",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,code:"start_not_allowed",detail:{entityName:body.entity_name},message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlowForEntity({entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"GET",path:"/statuses/:entity_name",handler:async({params,query,request})=>{let isGod=hasGodminRole(request),userId=request.headers.get("x-user-id")??"",{verificationService}=getServicesForRequest(request);return{success:!0,data:{...await verificationService.listEntityStatuses({entity_name:params.entity_name,status:query.status||void 0,page:query.page?Number(query.page):void 0,limit:query.limit?Number(query.limit):void 0,...isGod?{}:{started_by:userId}}),scope:isGod?"all":"started_by_me"}}},params:Type.Object({entity_name:Type.String()}),query:Type.Object({status:Type.Optional(Type.String()),page:Type.Optional(Type.String()),limit:Type.Optional(Type.String())})})],groups=[];if(config.endpoints?.enabled!==!1)groups.push({prefix:basePath,guards:[requireUser],routes:verificationDeclared}),logger2.info(`[Verification] Routes registered at ${basePath}`);else logger2.info("[Verification] endpoints.enabled is false; review routes not mounted");if(config.flowEndpoints?.enabled!==!1){let flowDeclared=[defineRoute({method:"GET",path:"/",handler:async({query,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.listFlows(query.entity_name||void 0)}},query:Type.Object({entity_name:Type.Optional(Type.String())})}),defineRoute({method:"GET",path:"/:flow_id",handler:async({params,request,set:set2})=>{let{verificationService:vs}=getServicesForRequest(request),result=await vs.getFlow(params.flow_id);if(!result)return set2.status=404,{success:!1,code:"flow_not_found",detail:{},message:"Flow not found"};let running_chains=await vs.countRunningChains(params.flow_id);return{success:!0,data:{...result,running_chains}}},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.saveFlow(body)},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),name:Type.String(),description:Type.Optional(Type.String()),trigger_on:Type.Union([Type.Literal("create"),Type.Literal("update"),Type.Literal("delete"),Type.Literal("manual")]),trigger_fields:Type.Optional(Type.Array(Type.String())),is_draft:Type.Boolean(),viewport:Type.Optional(Type.Object({x:Type.Number(),y:Type.Number(),zoom:Type.Number()})),graph:Type.Object({steps:Type.Array(Type.Any()),edges:Type.Array(Type.Any()),verifier_configs:Type.Array(Type.Any()),notification_rules:Type.Array(Type.Any()),notification_recipients:Type.Array(Type.Any()),notification_channels:Type.Array(Type.Any())}),model_version:Type.Optional(Type.Union([Type.Literal(1),Type.Literal(2)])),max_passes:Type.Optional(Type.Integer({minimum:0,maximum:1e5})),model2:Type.Optional(MODEL_2_GRAPH_SCHEMA)})}),defineRoute({method:"POST",path:"/feasibility",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.checkModel2Feasibility({entity_name:body.entity_name,model2:body.model2,max_passes:body.max_passes})}},body:Type.Object({entity_name:Type.String(),max_passes:Type.Optional(Type.Integer({minimum:0,maximum:1e5})),model2:MODEL_2_GRAPH_SCHEMA})}),defineRoute({method:"POST",path:"/:flow_id/publish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.publishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/:flow_id/unpublish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.unpublishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"DELETE",path:"/:flow_id",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.deleteFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})})];groups.push({prefix:flowBasePath,guards:[createGodminGuard({db,schemaTables,logger:logger2},"verification flow management")],routes:flowDeclared}),logger2.info(`[Verification] Flow routes registered at ${flowBasePath}`)}return{routes:collectRoutes(groups),verificationService:defaultVerificationService,notificationService:defaultNotificationService}}function createNucleusRuntime(deps){return{sendEmail:async(payload)=>{let mailer=deps.getEmailService();if(!mailer?.isAvailable())return{success:!1,error:"No email provider is configured or available"};return mailer.sendEmail(payload)},emailProvider:()=>deps.activeEmailProvider(),isEmailAvailable:()=>!!deps.getEmailService()?.isAvailable(),emailSenderAddress:()=>deps.getEmailService()?.getSenderAddress?.()??""}}function unappliedSettings(config,swagger){let notes=[],say=(option,reality)=>notes.push(`${option} \u2014 ${reality}`);if(swagger?.provider&&swagger.provider!=="scalar")say(`swagger.provider: '${swagger.provider}'`,"only the Scalar viewer is shipped; the document itself is unaffected");if(swagger?.excludeStaticFile!==void 0)say("swagger.excludeStaticFile","nothing distinguishes a static-asset route from any other, so no route is excluded by it. Use `swagger.exclude` to name paths");let pubsub=config.pubsub;if(pubsub?.pubsubName)say("pubsub.pubsubName","names a Dapr component for a publish call this build never makes; realtime delivery goes straight to the connected sockets");if(pubsub?.ack?.retryIntervalMs!==void 0)say("pubsub.ack.retryIntervalMs","there is no interval-based retry loop; unacknowledged messages are redelivered when a client reconnects");if(config.domains?.cloudflare?.fallbackOrigin)say("domains.cloudflare.fallbackOrigin","never sent to Cloudflare; set the fallback origin on the zone itself");if(config.domains?.verification?.defaultMethod&&config.domains.verification.defaultMethod!=="txt")say(`domains.verification.defaultMethod: '${config.domains.verification.defaultMethod}'`,"ownership is always proved with a TXT record; cname and http are not implemented");if(config.database?.type)say("database.type","Postgres is the only engine this build talks to");let schemas=config.database?.schemas;if(Array.isArray(schemas)&&schemas.length>1)say(`database.schemas (${schemas.length} named)`,`only the first is used (\`${schemas[0]}\`); the rest are ignored`);let verification=config.authentication?.register?.emailVerification;if(verification?.provider)say(`authentication.register.emailVerification.provider: '${verification.provider}'`,"the sender is chosen globally from the `email` config and the secrets store, not per mail");let templates=verification?.templates,withTemplatePath=Object.entries(templates??{}).filter(([,t])=>t?.htmlTemplatePath).map(([name2])=>name2);if(withTemplatePath.length>0)say(`authentication.register.emailVerification.templates.${withTemplatePath.join("/")}.htmlTemplatePath`,"the mail bodies are built in code; only `subject` is taken from this config");return notes}init_utils5();function asText(value2){return typeof value2==="string"&&value2.trim()?value2.trim():void 0}function fieldOf(path7){let text3=asText(path7);if(!text3)return;return text3.replace(/^\//,"").replace(/\//g,".")||void 0}function fromValidator(error3){let candidate=error3;if(typeof candidate?.validator?.Errors!=="function")return;try{let fields=[],reason;for(let item of candidate.validator.Errors(candidate.value)){let field=fieldOf(item?.path);if(field&&!fields.includes(field))fields.push(field);if(reason??=asText(item?.message),fields.length>=4)break}return fields.length||reason?{fields,reason}:void 0}catch{return}}function compose(where,reason){if(where&&reason)return`Invalid request: ${where} \u2014 ${reason}`;if(where)return`Invalid request: ${where}`;if(reason)return`Invalid request: ${reason}`;return"Invalid request"}function fromMessage(raw){let text3=asText(raw);if(!text3)return"Invalid request";let payload;try{payload=JSON.parse(text3)}catch{return}if(!payload||typeof payload!=="object"||payload.type!=="validation")return;let on=asText(payload.on),property=fieldOf(payload.property),reason=asText(payload.summary)??asText(payload.message),where=property&&property!=="root"?`${on?`${on}.`:""}${property}`:on?`the request ${on}`:void 0;return compose(where,reason)}function describeValidationError(error3){if(typeof error3!=="string"&&error3){let detail=fromValidator(error3);if(detail){let on=asText(error3.type),where=detail.fields.length?detail.fields.map((field)=>on?`${on}.${field}`:field).join(", "):on?`the request ${on}`:void 0;return compose(where,detail.reason)}return fromMessage(error3.message)}return fromMessage(error3)}function statusOfError(code,error3){if(typeof code==="number")return code;let carried=error3?.status;if(typeof carried==="number"&&carried>=100&&carried<=599)return carried;return 500}init_auth();init_backup();init_payment();init_marketplace();init_storage2();var mergeEntitiesByName=(entities)=>{let entityMap=new Map;for(let entity of entities){let existing=entityMap.get(entity.table_name),mergedColumns=entity.columns??existing?.columns;entityMap.set(entity.table_name,{...existing||{},...entity,columns:mergedColumns})}return Array.from(entityMap.values())},effectiveConfigEntities=(configEntities)=>{if(!configEntities.some((e)=>e.extends))return configEntities;let{entities:resolved}=resolveEntities(SYSTEM_TABLES,configEntities),byName=new Map(resolved.map((t)=>[t.table_name,t]));return configEntities.map((e)=>e.extends?byName.get(e.table_name)??e:e)},normalizeSystemTable=(table)=>({table_name:table.table_name,excluded_methods:table.excluded_methods?[...table.excluded_methods]:void 0,columns:table.columns?table.columns.map((column3)=>({name:column3.name,type:column3.type})):void 0}),extractSchemaTableEntities=(schemaTables)=>{let entities=[];for(let[_key,tableValue]of Object.entries(schemaTables)){if(!tableValue||typeof tableValue!=="object")continue;let tableObj=tableValue,underscoreMeta=tableObj._;if(underscoreMeta?.name){entities.push({table_name:underscoreMeta.name});continue}let symbols3=Object.getOwnPropertySymbols(tableObj);for(let sym of symbols3){let symValue=tableObj[sym];if(symValue&&typeof symValue==="object"){let symMeta=symValue;if(symMeta.name&&typeof symMeta.name==="string"){entities.push({table_name:symMeta.name});break}}}}return entities},lastMountedGroups=[];function getMountedRuntime2(){return getMountedRuntime()}function getResolvedOptions2(){return getResolvedOptions()}function getMountedRouteGroups(){return lastMountedGroups}var lastMountedSocket=null;function getMountedSocket(){return lastMountedSocket}var lastStaticAssets=null;function getMountedStaticAssets(){return lastStaticAssets}var lastBootSteps=null,lastShutdownSteps=null,lastAuthMiddleware=null,lastErrorHandler=null,lastAfterHandler=null;function getAfterHandler(){return lastAfterHandler}function getErrorHandler(){if(!lastErrorHandler)throw Error("getErrorHandler() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastErrorHandler}function getAuthMiddleware(){if(!lastAuthMiddleware)throw Error("getAuthMiddleware() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastAuthMiddleware}function getBootSteps(){if(!lastBootSteps)throw Error("getBootSteps() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastBootSteps}function getShutdownSteps(){return lastShutdownSteps??[]}function resolveOverrides(groups,logger2){let claim=new Map,dropped=[],kept=[];for(let index=groups.length-1;index>=0;index--){let group=groups[index];if(!group)continue;let routes=[];for(let position=group.routes.length-1;position>=0;position--){let route=group.routes[position];if(!route)continue;let declared=route.path==="/"?"":route.path,key2=`${route.method} ${`${group.prefix??""}${declared}`||"/"}`,winner=claim.get(key2);if(winner){let summary=route.detail?.summary??"(no summary)";dropped.push(`${key2} \u2014 kept "${winner.summary}", dropped "${summary}"`);continue}claim.set(key2,{summary:route.detail?.summary??"(no summary)"}),routes.unshift(route)}if(routes.length>0)kept.unshift({...group,routes})}if(dropped.length>0)logger2.warn(`[Routes] ${dropped.length} route(s) replaced by a later declaration of the same path`,{replaced:dropped});return kept}async function buildNucleus(config){beginRouteRecording();let plugin=collectRoutes(),routeGetHealth=defineRoute({method:"GET",path:"/health",handler:()=>({status:"ok",timestamp:Date.now()})}),routeGetReady=defineRoute({method:"GET",path:"/health/ready",handler:async({set:set2})=>{let checks={database:"skipped",redis:"skipped"},ready=!0;if(db)try{await db.execute(sql15`select 1`),checks.database="ok"}catch{checks.database="fail",ready=!1}try{let client=getRedisManager()?.getDirectClient?.();if(client)await client.ping(),checks.redis="ok"}catch{checks.redis="fail",ready=!1}if(!ready)set2.status=503;return{status:ready?"ready":"not-ready",checks,timestamp:Date.now()}}});if(mountRoutes(plugin,[{routes:[routeGetHealth,routeGetReady]}]),config.staticAssets!==!1){let path8=__require("path"),fs3=__require("fs"),assetsPath;if(typeof config.staticAssets==="string")assetsPath=config.staticAssets;else{let localPath=path8.join(process.cwd(),"public"),resolvedPkgPath="";for(let pkgName of["nucleus-core-ts","nucleus-core"])try{let pkgJson=__require.resolve(`${pkgName}/package.json`),candidate=path8.join(path8.dirname(pkgJson),"public");if(fs3.existsSync(candidate)){resolvedPkgPath=candidate;break}}catch{}if(resolvedPkgPath)assetsPath=resolvedPkgPath;else if(fs3.existsSync(localPath))assetsPath=localPath;else assetsPath=localPath}recordStaticAssets(assetsPath)}let publicRoutes=[],resolvedOptions,configDir=process.cwd(),configFilePath=null;if(typeof config.options==="string"){let fs3=__require("fs"),path8=__require("path"),configPath=path8.isAbsolute(config.options)?config.options:path8.resolve(process.cwd(),config.options);configDir=path8.dirname(configPath),configFilePath=configPath;let configContent=fs3.readFileSync(configPath,"utf-8");resolvedOptions=JSON.parse(configContent)}else resolvedOptions=config.options;if(resolvedOptions.email?.gmail?.json_file_path){let path8=__require("path"),gmailPath=resolvedOptions.email.gmail.json_file_path;if(!path8.isAbsolute(gmailPath))resolvedOptions.email.gmail.json_file_path=path8.resolve(configDir,gmailPath)}recordResolvedOptions(resolvedOptions);let{authentication,audit,entities,database}=resolvedOptions,isDev=resolvedOptions.mode==="development",loggingConfig=resolvedOptions.logging,logger2=new Logger({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],auditEnabled:audit?.enabled??!1,...audit?.suppressReasons!==void 0?{auditSuppressReasons:audit.suppressReasons}:{},...audit?.minSeverity!==void 0?{auditMinSeverity:audit.minSeverity}:{},enabledScopes:loggingConfig?.scopes||["*"]});Logger.getInstance().configure({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],enabledScopes:loggingConfig?.scopes||["*"]});let serverLogsConfig=resolvedOptions.monitoring?.serverLogs,serverLogBuffer=serverLogsConfig?.enabled===!0?getServerLogBuffer({capacity:serverLogsConfig.capacity??2000,maxLineLength:serverLogsConfig.maxLineLength}):null;if(serverLogBuffer){let transport=new ServerLogTransport(serverLogBuffer);if(logger2.addTransport(transport),Logger.getInstance().addTransport(transport),serverLogsConfig?.captureStdout!==!1)attachStreamCapture(serverLogBuffer);logger2.info(`[ServerLogs] Buffer active (capacity: ${serverLogBuffer.getCapacity()}, stdout capture: ${serverLogsConfig?.captureStdout!==!1})`)}{let{entities:resolvedForBoot,errors:extendErrors,warnings:extendWarnings}=resolveEntities(SYSTEM_TABLES,entities??[],{consumerMode:authentication?.mode==="consumer"});for(let warning of extendWarnings)logger2.warn(warning);let syncErrors=[],syncMappings=resolvedOptions.authentication?.oauth?.profileSync?.mappings??[];if(syncMappings.length>0){let columnsFor=(name2)=>{return(resolvedForBoot.find((t)=>t.table_name===name2)?.columns??[]).map((c)=>c.name)};syncErrors.push(...validateProfileSyncTargets(syncMappings,{users:columnsFor("users"),profiles:columnsFor("profiles")}))}if(extendErrors.length>0||syncErrors.length>0){let detail=[...extendErrors.map((e)=>`  ${e.code}: ${e.message}`),...syncErrors.map((m)=>`  PROFILE_SYNC_TARGET: ${m}`)].join(`
+`)};function parseTimeToMs2(time2){let match=time2.match(/^(\d+)(ms|s|m|h)$/);if(!match?.[1]||!match[2])return 5000;let value2=parseInt(match[1],10);switch(match[2]){case"ms":return value2;case"s":return value2*1000;case"m":return value2*60*1000;case"h":return value2*60*60*1000;default:return 5000}}function createMonitoringRoutes(config){let{getService,logger:logger2,endpoints,db,schemaTables}=config,snapshotOrNull=async()=>await getService()?.getLatestSnapshot()??null,alertsOrEmpty=()=>getService()?.getActiveAlerts()??[],guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"monitoring",{allowRoles:endpoints.allowRoles}),mount=(routes2)=>collectRoutes([{prefix:endpoints.basePath,guards:[guard4],routes:routes2}]);if(!endpoints.enabled)return mount([]);logger2.info(`[Monitoring] Routes enabled at ${endpoints.basePath} (stream: ${endpoints.stream.enabled}, snapshot: ${endpoints.snapshot.enabled}, history: ${endpoints.history.enabled}, alerts: ${endpoints.alerts.enabled})`);let routes=[];if(endpoints.stream.enabled)routes.push(defineRoute({method:"GET",path:endpoints.stream.path,handler:({request})=>{let intervalMs=parseTimeToMs2(endpoints.stream.interval),abortSignal=request.signal;logger2.info("[Monitoring] SSE stream connected");let cleanup,stream=new ReadableStream({start(controller){let closed=!1,send2=(event,data)=>{if(closed)return;controller.enqueue(encodeEvent(event,data))},cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(timer),abortSignal?.removeEventListener("abort",cleanupHandler),logger2.info("[Monitoring] SSE stream disconnected");try{controller.close()}catch{}};cleanup=cleanupHandler;let tick=async()=>{if(closed)return;let snapshot=await snapshotOrNull();if(snapshot)send2("snapshot",snapshot);let alerts=alertsOrEmpty();if(alerts.length>0)send2("alerts",alerts)},timer=setInterval(tick,intervalMs);abortSignal?.addEventListener("abort",cleanupHandler),send2("open",{interval:intervalMs}),tick()},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Monitoring"],summary:"Stream real-time monitoring data",description:"Server-Sent Events stream for real-time monitoring metrics"}}));if(endpoints.snapshot.enabled)routes.push(defineRoute({method:"GET",path:endpoints.snapshot.path,handler:async()=>{let snapshot=await snapshotOrNull();if(!snapshot)return{isSuccess:!0,message:"No monitoring data available yet",data:null};return{isSuccess:!0,message:"Current monitoring snapshot",data:snapshot}},detail:{tags:["Monitoring"],summary:"Get current monitoring snapshot",description:"Returns the latest monitoring metrics snapshot"}}));if(endpoints.history.enabled)routes.push(defineRoute({method:"GET",path:endpoints.history.path,handler:async({query})=>{let minutes=Math.min(query.minutes?parseInt(String(query.minutes),10):60,endpoints.history.maxMinutes),history=await getService()?.getHistory(minutes)??[];return{isSuccess:!0,message:`Monitoring history for last ${minutes} minutes`,data:{minutes,count:history.length,snapshots:history}}},query:Type.Object({minutes:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Get monitoring history",description:"Returns historical monitoring data for the specified time range"}}));if(endpoints.alerts.enabled)routes.push(defineRoute({method:"GET",path:endpoints.alerts.path,handler:()=>{let alerts=alertsOrEmpty();return{isSuccess:!0,message:"Active alerts",data:{count:alerts.length,alerts}}},detail:{tags:["Monitoring"],summary:"Get active alerts",description:"Returns all currently active monitoring alerts"}})),routes.push(defineRoute({method:"POST",path:`${endpoints.alerts.path}/:alertId/acknowledge`,handler:({params,set:set2})=>{let service=getService();if(!service)return set2.status=503,{isSuccess:!1,message:"Monitoring service is not available",data:null};if(!service.acknowledgeAlert(params.alertId))return set2.status=404,{isSuccess:!1,message:"Alert not found",data:null};return{isSuccess:!0,message:"Alert acknowledged",data:{alertId:params.alertId}}},params:Type.Object({alertId:Type.String()}),detail:{tags:["Monitoring"],summary:"Acknowledge an alert",description:"Mark an alert as acknowledged"}}));return mount(routes)}init_esm3();init_routeCollector();init_adminGuard();function createLiveMonitoringRoutes(config){let{getService,getLifecycleRecorder,logger:logger2,basePath,streamInterval,db,schemaTables}=config,guard4=createGodminGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"live monitoring"),requireService=()=>{let svc=getService();if(!svc)throw Error("Live monitoring service not initialized");return svc};logger2.info(`[LiveMonitoring] Routes enabled at ${basePath} (stream interval: ${streamInterval}ms)`);let routes=[defineRoute({method:"GET",path:"/health",handler:()=>{let svc=getService();return{status:svc?"ok":"initializing",timestamp:Date.now(),monitoring:svc?.isEnabled()??!1}},detail:{tags:["Live Monitoring"],summary:"Health check for live monitoring"}}),defineRoute({method:"GET",path:"/settings",handler:()=>{return requireService().getSettings()},detail:{tags:["Live Monitoring"],summary:"Get live monitoring settings"}}),defineRoute({method:"PATCH",path:"/settings",handler:({body})=>{return requireService().changeSettings(body)},body:Type.Partial(Type.Object({logMemory:Type.Boolean(),logCpu:Type.Boolean(),logDapr:Type.Boolean(),logWebSocket:Type.Boolean(),memoryLogInterval:Type.Number(),cpuLogInterval:Type.Number(),memoryLogLimit:Type.Number(),cpuLogLimit:Type.Number(),daprLogLimit:Type.Number(),wsLogLimit:Type.Number(),requestLogLimit:Type.Number()})),detail:{tags:["Live Monitoring"],summary:"Change live monitoring settings"}}),defineRoute({method:"GET",path:"/incidents",handler:async({query})=>{let raw=Number(query?.limit),limit=Number.isFinite(raw)&&raw>0?Math.min(raw,50):20,recorder=getLifecycleRecorder?.();if(!recorder)return{available:!1,incidents:[]};return{available:!0,incidents:await recorder.incidents(limit)}},query:Type.Optional(Type.Object({limit:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Why previous runs of this process ended"}}),defineRoute({method:"GET",path:"/realtime",handler:({query})=>{let raw=Number(query?.windowMinutes),minutes=Number.isFinite(raw)&&raw>0?Math.min(raw,1440):void 0;return requireService().getRealtimeHealth(minutes?minutes*60000:void 0)},query:Type.Optional(Type.Object({windowMinutes:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Realtime (WebSocket) health digest"}}),defineRoute({method:"GET",path:"/logs",handler:()=>{return requireService().getLogs()},detail:{tags:["Live Monitoring"],summary:"Get all live monitoring logs"}}),defineRoute({method:"GET",path:"/logs/stream",handler:({request})=>{let abortSignal=request.signal,cleanup,svc=requireService(),snapshot=svc.getSnapshot(),lastTimestamps={memory:snapshot.memory.length?snapshot.memory[snapshot.memory.length-1]?.timestamp??0:0,cpu:snapshot.cpu.length?snapshot.cpu[snapshot.cpu.length-1]?.timestamp??0:0,request:snapshot.requests.length?snapshot.requests[snapshot.requests.length-1]?.timestamp??0:0,dapr:snapshot.dapr.length?snapshot.dapr[snapshot.dapr.length-1]?.timestamp??0:0,ws:snapshot.ws.length?snapshot.ws[snapshot.ws.length-1]?.timestamp??0:0},stream=new ReadableStream({start(controller){let closed=!1;controller.enqueue(encodeEvent("snapshot",snapshot));let interval=setInterval(()=>{if(closed)return;let update=svc.getUpdatesSince(lastTimestamps);if(!update){controller.enqueue(encodeEvent("heartbeat",{timestamp:Date.now()}));return}if(update.memory.length)lastTimestamps.memory=update.memory[update.memory.length-1]?.timestamp??lastTimestamps.memory;if(update.cpu.length)lastTimestamps.cpu=update.cpu[update.cpu.length-1]?.timestamp??lastTimestamps.cpu;if(update.requests.length)lastTimestamps.request=update.requests[update.requests.length-1]?.timestamp??lastTimestamps.request;if(update.dapr.length)lastTimestamps.dapr=update.dapr[update.dapr.length-1]?.timestamp??lastTimestamps.dapr;if(update.ws.length)lastTimestamps.ws=update.ws[update.ws.length-1]?.timestamp??lastTimestamps.ws;controller.enqueue(encodeEvent("update",update))},streamInterval),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(interval),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Live Monitoring"],summary:"Stream real-time live monitoring data via SSE"}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_routeCollector();init_adminGuard();var LOG_LEVELS=["debug","info","warn","error","fatal"],SOURCES=["logger","stdout","stderr"];function parseLevels(raw){if(!raw)return;let parsed=raw.split(",").map((value2)=>value2.trim().toLowerCase()).filter((value2)=>LOG_LEVELS.includes(value2));return parsed.length>0?parsed:void 0}function parseSource(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return SOURCES.includes(value2)?value2:void 0}function parseMinLevel(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return LOG_LEVELS.includes(value2)?value2:void 0}function parseCursor(raw){if(raw===void 0||raw===null||raw==="")return;let value2=Number(raw);return Number.isFinite(value2)&&value2>=0?value2:void 0}function buildQuery(query){return{levels:parseLevels(query.levels),minLevel:parseMinLevel(query.minLevel),scope:query.scope?.trim()||void 0,search:query.search||void 0,source:parseSource(query.source),after:parseCursor(query.after),before:parseCursor(query.before),limit:parseCursor(query.limit)}}var STREAM_KEEPALIVE_MS=25000;function createServerLogRoutes(config){let{buffer,logger:logger2,basePath,path:path7,allowRoles,streamEnabled=!0,clearEnabled=!0,db,schemaTables}=config,guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"server logs",{allowRoles}),routes=[defineRoute({method:"GET",path:path7,handler:({query})=>{return{isSuccess:!0,message:"Server logs",data:{...buffer.query(buildQuery(query)),scopes:buffer.scopes(),levelCounts:buffer.levelCounts()}}},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number()),before:Type.Optional(Type.Number()),limit:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Read buffered server logs",description:"Filtered, cursor-paged view of the in-memory server log buffer. Use `after` to tail forward and `before` to page backwards."}})];if(streamEnabled)routes.push(defineRoute({method:"GET",path:`${path7}/stream`,handler:({request,query})=>{let tailQuery=buildQuery(query),{after,before:_before,limit:_limit,...filter}=tailQuery,abortSignal=request.signal,cleanup,stream=new ReadableStream({start(controller){let closed=!1,backlog=buffer.query({...filter,...after!==void 0?{after}:{},limit:200});controller.enqueue(encodeEvent("backlog",backlog));let unsubscribe=buffer.subscribe((record3)=>{if(closed)return;if(!buffer.query({...filter,after:record3.seq-1,limit:1}).records.some((r)=>r.seq===record3.seq))return;try{controller.enqueue(encodeEvent("logs",[record3]))}catch{cleanup?.()}}),heartbeat=setInterval(()=>{if(closed)return;try{controller.enqueue(encodeEvent("ping",{timestamp:Date.now()}))}catch{cleanup?.()}},STREAM_KEEPALIVE_MS),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(heartbeat),unsubscribe(),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Tail server logs",description:"Server-Sent Events tail of the server log buffer, filtered server-side."}}));if(clearEnabled)routes.push(defineRoute({method:"DELETE",path:path7,handler:()=>{return buffer.clear(),logger2.info("[ServerLogs] Buffer cleared from the admin panel"),{isSuccess:!0,message:"Server log buffer cleared",data:null}},detail:{tags:["Monitoring"],summary:"Clear the server log buffer"}}));return logger2.info(`[ServerLogs] Routes enabled at ${basePath}${path7} (capacity: ${buffer.getCapacity()}, stream: ${streamEnabled})`),collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_Notification();init_routeCollector();init_adminGuard();import{timingSafeEqual as timingSafeEqual3}from"crypto";var CHANNELS=["portal","email","telegram","webhook"],SERVICE_TOKEN_HEADER="x-internal-identity-token",SEND_BODY=Type.Object({userId:Type.Optional(Type.String()),userIds:Type.Optional(Type.Array(Type.String())),title:Type.String(),body:Type.Optional(Type.String()),entityName:Type.Optional(Type.String()),entityId:Type.Optional(Type.String()),type:Type.Optional(Type.Union([Type.Literal("verification"),Type.Literal("system"),Type.Literal("custom")])),source:Type.Optional(Type.String()),channels:Type.Optional(Type.Array(Type.Union(CHANNELS.map((c)=>Type.Literal(c)))))});function tokensMatch(presented,expected){let a=Buffer.from(presented),b=Buffer.from(expected);return a.length===b.length&&timingSafeEqual3(a,b)}function createNotificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry,getEmailService}=routeConfig,basePath=routeConfig.basePath||config.endpoints?.basePath||"/notifications",buildService=(tables)=>new NotificationService({db,schemaTables:tables,config,logger:logger2,getEmailService}),defaultService=buildService(schemaTables),serviceFor=(request)=>{if(!tenantRegistry)return defaultService;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaultService;let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?buildService(ctx.schemaTables):defaultService},allowedSendRoles=new Set((config.endpoints?.sendRoles??[]).map((role)=>role.toLowerCase())),canSend=async(request)=>{if(allowedSendRoles.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowedSendRoles.has(role.toLowerCase())))return!0}return isGodminRequest(request,{db,schemaTables,logger:logger2})},requireUser=(request,set2)=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,null;return userId},fanOut=async(request,body,set2)=>{let recipients=body.userIds??(body.userId?[body.userId]:[]);if(recipients.length===0)return set2.status=400,{success:!1,message:"userId or userIds is required"};let channels=body.channels??[config.defaultChannel??"portal"],service=serviceFor(request),failed=(await Promise.allSettled(recipients.map((user_id)=>service.send({user_id,title:body.title,body:body.body,entity_name:body.entityName,entity_id:body.entityId,type:body.type??"custom",source:body.source,channels})))).map((result,index)=>{let userId=recipients[index];if(result.status==="rejected"){let reason=result.reason;return{userId,sent:!1,reason:reason instanceof Error?reason.message:String(reason)}}if(result.value.delivered.length>0)return{userId,sent:!0,reason:""};return{userId,sent:!1,reason:result.value.undelivered.map((one)=>`${one.channel}: ${one.reason}`).join("; ")||"no channel was requested"}}).filter((one)=>!one.sent),sentCount=recipients.length-failed.length,reasons=[...new Set(failed.map((one)=>one.reason))].join("; ");if(sentCount===0)set2.status=503;return{success:failed.length===0,message:failed.length===0?`Sent to ${recipients.length} recipient(s)`:`Sent to ${sentCount}, failed for ${failed.length}: ${reasons}`,data:{sent:sentCount,failed:failed.map((one)=>one.userId)}}},expectedServiceToken=()=>(config.endpoints?.serviceToken||process.env.IDENTITY_INTERNAL_TOKEN||"").trim(),clientIp=(request)=>request.headers.get("x-client-ip")||"unknown",refuseService=(request,set2)=>{let expected=expectedServiceToken();if(!expected)return logger2.warn("[Notification] Service send refused: no service token is configured"),set2.status=503,{success:!1,message:"Service sends are off: no service token is configured"};let presented=(request.headers.get(SERVICE_TOKEN_HEADER)??"").trim();if(presented&&tokensMatch(presented,expected))return null;let reason=presented?"mismatch":"missing";return logger2.warn("[Notification] Service send refused",{reason}),logger2.audit({entityName:"notifications",operation:"SERVICE_SEND_REFUSED",summary:`Service notification send refused: token ${reason}`,severity:"medium",category:"auth",ipAddress:clientIp(request),userAgent:request.headers.get("user-agent")||"unknown",path:new URL(request.url).pathname,query:""}),set2.status=403,{success:!1,message:`Forbidden: a valid ${SERVICE_TOKEN_HEADER} is required`}},auditServiceSend=async(request,body,answer)=>{let recipients=body.userIds??(body.userId?[body.userId]:[]),sent=answer.data?.sent??0,values={source:body.source??null,type:body.type??"custom",entity_name:body.entityName??null,entity_id:body.entityId??null,channels:body.channels??[config.defaultChannel??"portal"],recipients:recipients.length,sent,failed:answer.data?.failed.length??0};logger2.info("[Notification] Service send",values),await logger2.audit({entityName:"notifications",entityId:body.entityId??null,operation:"SERVICE_SEND",summary:`A service sent a notification (${body.source??"no source"}) to ${sent} of ${recipients.length} recipient(s)`,severity:"info",category:"system",newValues:values,ipAddress:clientIp(request),userAgent:request.headers.get("user-agent")||"unknown",path:new URL(request.url).pathname,query:""})},declared=[defineRoute({method:"GET",path:"/",handler:async({request,query,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};let asCount=(raw,max)=>{if(raw===void 0||raw==="")return;let n=Number(raw);if(!Number.isFinite(n))return;return Math.min(max,Math.max(0,Math.floor(n)))};return{success:!0,data:await serviceFor(request).getNotifications(userId,{limit:asCount(query.limit,200),offset:asCount(query.offset,Number.MAX_SAFE_INTEGER),type:query.type||void 0})}},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String()),type:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"List the caller\u2019s notifications"}}),defineRoute({method:"GET",path:"/unseen-count",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).getUnseenCount(userId)}}},detail:{tags:["Notifications"],summary:"Unseen notification count"}}),defineRoute({method:"POST",path:"/:notification_id/seen",handler:async({params,request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};if(!await serviceFor(request).markAsSeen(params.notification_id,userId))return set2.status=404,{success:!1,message:"Notification not found"};return{success:!0,message:"Marked as seen"}},params:Type.Object({notification_id:Type.String()}),detail:{tags:["Notifications"],summary:"Mark one notification as seen"}}),defineRoute({method:"POST",path:"/seen-all",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).markAllAsSeen(userId)}}},detail:{tags:["Notifications"],summary:"Mark every notification as seen"}}),defineRoute({method:"POST",path:"/send",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending notifications requires godmin or an allowed role"};return fanOut(request,body,set2)},body:SEND_BODY,detail:{tags:["Notifications"],summary:"Send a notification to one or more users",description:"Privileged. Delivers over the requested channels (portal, email, telegram, webhook). Email uses the configured provider \u2014 credentials resolve through the secrets store, so a rotation applies immediately."}}),defineRoute({method:"POST",path:"/send/service",handler:async({body,request,set:set2})=>{let refused=refuseService(request,set2);if(refused)return refused;let answer=await fanOut(request,body,set2);if(answer.data)await auditServiceSend(request,body,answer);return answer},body:SEND_BODY,detail:{tags:["Notifications"],summary:"Send a notification to one or more users, as an in-cluster service",description:`No session: the caller presents the shared service token in \`${SERVICE_TOKEN_HEADER}\` (\`notification.endpoints.serviceToken\`, else IDENTITY_INTERNAL_TOKEN). Same body, delivery and answer as POST /send; every send is audited. 503 while no token is configured, 403 for a missing or wrong one.`}}),defineRoute({method:"POST",path:"/email",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending email requires godmin or an allowed role"};let emailService=getEmailService?.()??null;if(!emailService?.isAvailable())return set2.status=503,{success:!1,message:"No email provider is configured or available"};let result=await emailService.sendEmail({to:body.to,subject:body.subject,html:body.html,text:body.text,replyTo:body.replyTo});if(!result.success)return set2.status=502,{success:!1,message:result.error??"Email delivery failed"};return logger2.info("[Notification] Transactional email sent",{recipients:Array.isArray(body.to)?body.to.length:1,subject:body.subject}),{success:!0,message:"Email sent",data:null}},body:Type.Object({to:Type.Union([Type.String(),Type.Array(Type.String())]),subject:Type.String(),html:Type.Optional(Type.String()),text:Type.Optional(Type.String()),replyTo:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"Send a transactional email to explicit recipients",description:"Backend-to-backend send through the configured provider \u2014 an app never needs an email SDK or the provider credentials of its own. Privileged, same gate as /send."}})];return{routes:collectRoutes([{prefix:basePath,routes:declared}]),notificationService:defaultService}}init_routeCollector();init_routeRecording();init_websocket();init_ack_manager();import{timingSafeEqual as timingSafeEqual4}from"crypto";init_ack_manager();var DEFAULT_MAX_TOPICS_PER_CLIENT=512;function createClientManager(config){let clients=new Map,presenceBroadcastDebounce=new Map,{redis,logger:logger2}=config,ackTtl=config.ack.ttlSeconds,ackEnabled=config.ack.enabled,maxRetries=config.ack.maxRetries,presenceEnabled=config.presence.enabled,presenceDebounceMs=config.presence.debounceMs,maxClientsPerUser=config.maxClientsPerUser,maxTopicsPerClient=config.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,MAX_TOPIC_LENGTH=256;function generateClientId(){return`client_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}function capTopics(topics){let accepted=[],dropped=[],seen=new Set;for(let t of topics){if(typeof t!=="string")continue;let trimmed=t.length>256?t.slice(0,256):t;if(seen.has(trimmed))continue;if(seen.add(trimmed),accepted.length>=maxTopicsPerClient){dropped.push(trimmed);continue}accepted.push(trimmed)}return{accepted,dropped}}function reportDropped(context,clientId,userId,dropped){if(dropped.length===0)return;logger2.warn("[PubSub] Topic subscription capped \u2014 events for these will NOT be delivered",{context,clientId,userId,cap:maxTopicsPerClient,droppedCount:dropped.length,dropped})}function registerClient(clientId,ws,userId,topics){let existingClients=getClientsByUser(userId);if(existingClients.length>=maxClientsPerUser){let oldestClientId=existingClients[0];if(oldestClientId)logger2.info("[PubSub] Max clients reached, closing oldest",{userId,oldestClientId}),unregisterClient(oldestClientId)}let{accepted,dropped}=capTopics(topics);return clients.set(clientId,{ws,userId,subscribedTopics:new Set(accepted),connectedAt:Date.now(),pendingAcks:new Map}),logger2.info("[PubSub] Client registered",{clientId,userId,topics:accepted,requestedCount:topics.length,subscribedCount:accepted.length,totalClients:clients.size}),reportDropped("registerClient",clientId,userId,dropped),{accepted,dropped}}function unregisterClient(clientId){let client=clients.get(clientId);if(!client)return;let userId=client.userId;if(clients.delete(clientId),logger2.info("[PubSub] Client unregistered",{clientId,userId,totalClients:clients.size}),presenceEnabled&&userId){if(getClientsByUser(userId).length===0)broadcastPresenceToOthers(userId,"offline")}}function updateClientTopics(clientId,topics){let client=clients.get(clientId);if(!client)return{accepted:[],dropped:[]};let{accepted,dropped}=capTopics(topics);return client.subscribedTopics=new Set(accepted),reportDropped("updateClientTopics",clientId,client.userId,dropped),{accepted,dropped}}function getClientsByUser(userId){let result=[];for(let[clientId,client]of clients)if(client.userId===userId)result.push(clientId);return result}function getConnectedUserIds(){let userIds=new Set;for(let[,client]of clients)if(client.userId)userIds.add(client.userId);return userIds}function getClientCount(){return clients.size}function sendToClient(clientId,message){let client=clients.get(clientId);if(!client)return!1;try{return client.ws.send(JSON.stringify(message)),!0}catch{return clients.delete(clientId),!1}}function broadcastEvent(topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0;for(let[clientId,client]of clients)if(client.subscribedTopics.has("*")||client.subscribedTopics.has(topic))try{if(client.ws.send(payload),sentCount++,ackEnabled){if(client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent(),client.userId)storePendingMessage(redis,{messageId,topic,clientId,userId:client.userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{})}}catch{clients.delete(clientId)}logger2.info("[PubSub] Broadcasted event",{topic,messageId,sentCount})}function broadcastToUser(userId,topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0,sentToAnyClient=!1;for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{if(client.ws.send(payload),sentCount++,sentToAnyClient=!0,ackEnabled)client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent()}catch{clients.delete(clientId)}}if(ackEnabled)storePendingMessage(redis,{messageId,topic,clientId:sentToAnyClient?"delivered":"pending",userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{});logger2.info("[PubSub] Broadcasted to user",{userId,topic,messageId,sentCount,storedForOffline:!sentToAnyClient})}function broadcastToUserNoAck(userId,topic,event){let timestamp=Date.now(),payload=JSON.stringify({type:"event",topic,data:event,timestamp});for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{client.ws.send(payload)}catch{clients.delete(clientId)}}}function broadcastPresenceToOthers(userId,status){let debounceKey=`${userId}:${status}`,now=Date.now(),lastBroadcast=presenceBroadcastDebounce.get(debounceKey);if(lastBroadcast&&now-lastBroadcast<presenceDebounceMs)return;if(presenceBroadcastDebounce.set(debounceKey,now),presenceBroadcastDebounce.size>1000){let cutoff=now-presenceDebounceMs*2;for(let[key2,timestamp]of presenceBroadcastDebounce)if(timestamp<cutoff)presenceBroadcastDebounce.delete(key2)}let connectedUserIds=getConnectedUserIds();for(let targetUserId of connectedUserIds)if(targetUserId!==userId)broadcastToUserNoAck(targetUserId,"user-presence",{type:"user-presence",data:{userId,status}})}async function handleClientAck(clientId,messageId){if(!ackEnabled)return!0;let client=clients.get(clientId);if(!client)return!1;if(client.pendingAcks.get(messageId))client.pendingAcks.delete(messageId);if(client.userId)return acknowledgeMessage(redis,client.userId,messageId,ackTtl);return!0}async function deliverPendingMessages(userId,clientId){if(!ackEnabled)return 0;let client=clients.get(clientId);if(!client||client.userId!==userId)return 0;let pendingMessages=await getPendingMessagesForUser(redis,userId);if(pendingMessages.length===0)return 0;logger2.info("[PubSub] Delivering pending messages",{userId,count:pendingMessages.length});let deliveredCount=0;for(let message of pendingMessages){if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(message.topic))continue;let payload=JSON.stringify({type:"event",messageId:message.messageId,topic:message.topic,data:message.data,timestamp:message.sentAt,isRedelivery:!0});try{client.ws.send(payload),client.pendingAcks.set(message.messageId,{sentAt:Date.now(),retryCount:message.retryCount+1}),await incrementRetryCount(redis,userId,message.messageId,ackTtl,maxRetries),deliveredCount++}catch{break}}return deliveredCount}function sweepStaleClients(){let payload=JSON.stringify({type:"ping",data:{at:Date.now()}}),dropped=0,checked=clients.size;for(let[clientId,client]of[...clients])try{client.ws.send(payload)}catch{clients.delete(clientId),dropped++}return{checked,dropped}}return{generateClientId,registerClient,unregisterClient,updateClientTopics,getClientsByUser,getConnectedUserIds,getClientCount,sweepStaleClients,sendToClient,broadcastEvent,broadcastToUser,broadcastToUserNoAck,broadcastPresenceToOthers,handleClientAck,deliverPendingMessages,getPendingMessageCount:(userId)=>getPendingMessageCount(redis,userId)}}var OPAQUE_RUN=/[A-Za-z0-9_-]{24,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g;function previewOf2(frame){return frame.slice(0,120).replace(OPAQUE_RUN,(match)=>`[redacted ${match.length} chars]`)}function classifyClientFrame(message){if(typeof message==="string"){if(message.trim()==="")return{kind:"ignore"};let parsed;try{parsed=JSON.parse(message)}catch{return{kind:"malformed",preview:previewOf2(message)}}return asMessage(parsed,message.length)}if(message&&typeof message==="object")return asMessage(message,approximateSize(message));return{kind:"ignore"}}function approximateSize(value2){if(ArrayBuffer.isView(value2))return value2.byteLength;if(value2 instanceof ArrayBuffer)return value2.byteLength;try{return JSON.stringify(value2)?.length??0}catch{return 0}}function asMessage(value2,size){if(!value2||typeof value2!=="object"||Array.isArray(value2))return{kind:"ignore"};let record3=value2,type4=record3.type;if(typeof type4!=="string"||type4==="")return{kind:"ignore"};return{kind:"message",parsed:record3,type:type4,size}}function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}var HEARTBEAT_WS_TYPES=new Set(["ping","pong","ack"]);function buildHandshakeHeaders(rawHeaders,queryToken){let headers=new Headers;if(rawHeaders&&typeof rawHeaders==="object"){for(let[key2,value2]of Object.entries(rawHeaders))if(typeof value2==="string")headers.set(key2,value2)}if(queryToken)headers.set("authorization",`Bearer ${queryToken}`),headers.delete("cookie");return headers}function createPubSubRoutes(config){let{logger:logger2,getLiveMonitoringService}=config,clientManager=createClientManager(config);if(config.ack.enabled)initAckCleanup();let cleanupTimer=null,daprApiToken=config.daprApiToken||process.env.APP_API_TOKEN||process.env.DAPR_API_TOKEN,warnedNoDaprToken=!1;recordBootStep(()=>{if(config.cleanupIntervalMs>0)cleanupTimer=setInterval(()=>{let{checked,dropped}=clientManager.sweepStaleClients();if(dropped>0)logger2.info("[PubSub] Dropped clients whose socket no longer accepts a write",{checked,dropped,remaining:clientManager.getClientCount()})},config.cleanupIntervalMs);logger2.info("[PubSub] Routes initialized",{basePath:config.basePath,wsPath:config.wsPath,ackEnabled:config.ack.enabled,presenceEnabled:config.presence.enabled})}),recordShutdownStep(()=>{if(cleanupTimer)clearInterval(cleanupTimer),cleanupTimer=null});let routePostTopic=defineRoute({method:"POST",path:"/:topic",handler:async({params,body,request,set:set2})=>{let topic=params.topic;if(daprApiToken){let presented=request.headers.get("dapr-api-token")??"";if(!tokensMatch2(presented,daprApiToken))return logger2.warn("[PubSub] Rejected Dapr event: missing/invalid dapr-api-token",{topic}),set2.status=403,{status:"DROP"}}else if(!warnedNoDaprToken)warnedNoDaprToken=!0,logger2.warn("[PubSub] Dapr subscription endpoint is UNAUTHENTICATED \u2014 set config.pubsub.daprApiToken or the APP_API_TOKEN/DAPR_API_TOKEN env so only the Dapr sidecar can inject events");let eventData;try{if(!body){let text3=await request.text();eventData=JSON.parse(text3)}else eventData=body}catch{return set2.status=200,{status:"DROP"}}logger2.info("[PubSub] Dapr event received",{topic,eventId:eventData.id,source:eventData.source});let userId=eventData.data?.user_id;if(userId)clientManager.broadcastToUser(userId,topic,eventData);else clientManager.broadcastEvent(topic,eventData);return getLiveMonitoringService?.()?.recordDaprEvent("pubsub_subscribe",{topic,success:!0,metadata:{eventId:eventData.id,source:eventData.source,userId:userId||null}}),set2.status=200,{status:"SUCCESS"}}}),routes=collectRoutes([{prefix:config.basePath,routes:[routePostTopic]}]),socketRoute=defineWebSocketRoute({path:config.wsPath,idleTimeout:config.wsIdleTimeout,async open(ws){let data=ws.data,query=data.query,userId;if(config.authenticate){let handshakeHeaders=buildHandshakeHeaders(data.headers,query.token),authResult=await config.authenticate(handshakeHeaders);if(!authResult||!("userId"in authResult)){let reason=authResult?.reason??"unspecified";ws.send(JSON.stringify({type:"error",error:"Unauthorized: a valid session is required for this connection",reason,timestamp:Date.now()})),ws.close(4001,`Unauthorized: ${reason}`),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:`Unauthorized WebSocket handshake: ${reason}`,metadata:{reason}});return}userId=authResult.userId}else userId=query.userId;if(!userId){ws.send(JSON.stringify({type:"error",error:"userId is required for WebSocket connection",timestamp:Date.now()})),ws.close(4001,"userId is required"),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:"userId is required"});return}let clientId=clientManager.generateClientId(),topics=query.topics?.split(",").map((t)=>t.trim())||["*"];ws.data.clientId=clientId,ws.data.openedAt=Date.now();let registration=clientManager.registerClient(clientId,ws,userId,topics);if(ws.send(JSON.stringify({type:"connected",clientId,subscribedTopics:registration.accepted,...registration.dropped.length>0?{droppedTopics:registration.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})),getLiveMonitoringService?.()?.recordWsEvent("connection",{clientId,userId,topic:topics.join(","),success:!0}),config.presence.enabled)clientManager.broadcastPresenceToOthers(userId,"online");let connectedUserId=userId;if(config.ack.enabled&&connectedUserId)clientManager.getPendingMessageCount(connectedUserId).then((count2)=>{if(count2>0)logger2.info("[PubSub] Delivering pending messages",{userId:connectedUserId,count:count2}),clientManager.deliverPendingMessages(connectedUserId,clientId).catch(()=>{})}).catch(()=>{})},message(ws,message){let clientId=ws.data.clientId,frame=classifyClientFrame(message);if(frame.kind==="ignore")return;if(frame.kind==="malformed"){logger2.debug("[PubSub] Failed to parse client message",{clientId,frame:frame.preview});return}let{parsed}=frame;try{if(!HEARTBEAT_WS_TYPES.has(frame.type))getLiveMonitoringService?.()?.recordWsEvent("message",{clientId,messageType:frame.type,success:!0,dataSize:frame.size});switch(frame.type){case"subscribe":if(Array.isArray(parsed.topics)){let update=clientManager.updateClientTopics(clientId,parsed.topics);clientManager.sendToClient(clientId,{type:"subscribed",topics:update.accepted,...update.dropped.length>0?{droppedTopics:update.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})}break;case"unsubscribe":logger2.info("[PubSub] Unsubscribe request",{clientId,topics:parsed.topics});break;case"ping":clientManager.sendToClient(clientId,{type:"pong",timestamp:Date.now()});break;case"ack":if(parsed.messageId)clientManager.handleClientAck(clientId,parsed.messageId).catch(()=>{});break}}catch(error3){logger2.error("[PubSub] Client message handler failed",error3,{clientId,messageType:frame.type})}},close(ws,code,reason){let state=ws.data,clientId=state.clientId,openedAt=state.openedAt,livedMs=typeof openedAt==="number"?Date.now()-openedAt:null;if(!clientId)return;clientManager.unregisterClient(clientId),getLiveMonitoringService?.()?.recordWsEvent("close",{clientId,success:!0,metadata:{code,reason:reason||"",livedMs,shortLived:livedMs!==null&&livedMs<60000}}),logger2.info("[PubSub] Client disconnected",{clientId,code,reason,livedMs})}});return{routes,socket:socketRoute,clientManager}}init_JWT();init_utils5();init_sessionBinding();function classifyRefusal(error3){if(!error3)return"unspecified";switch(error3){case"Token expired":return"expired";case"Invalid signature":return"invalid-signature";case"Invalid token format: expected 3 parts":case"Invalid token format: missing parts":case"Invalid header: failed to decode":case"Invalid header: typ must be JWT":case"Invalid payload: failed to decode":return"malformed";case"Invalid issuer":case"Invalid audience":return"wrong-audience";case"Token issued in the future":return"not-yet-valid";default:if(error3.startsWith("Unsupported algorithm:"))return"malformed";return"unspecified"}}function createHandshakeAuthenticator(deps){return async(headers)=>{let wsTokens=parseTokenValuesFromHeaders(headers,deps.tokenNames);if(!wsTokens.access_token)return deps.logger.debug("[PubSub] WS handshake rejected: no access token presented"),{reason:"no-token"};let jwtResult=verifyJWT(wsTokens.access_token,deps.accessTokenSecret,{issuer:deps.issuer,audience:deps.audience});if(!jwtResult.valid){let reason=classifyRefusal(jwtResult.error);return deps.logger.warn("[PubSub] WS handshake rejected: JWT verification failed",{reason:jwtResult.error,classified:reason}),{reason}}let sub=jwtResult.payload?.sub;if(typeof sub!=="string"||sub.length===0)return{reason:"token-without-subject"};if(!deps.requireLiveSession)return{userId:sub};let boundSessionId=typeof jwtResult.payload.sessionId==="string"?jwtResult.payload.sessionId:"";if(!boundSessionId)return deps.logger.warn("[PubSub] WS handshake rejected: token carries no session",{userId:sub}),{reason:"session-unbound"};let tenant=typeof jwtResult.payload.tenant==="string"?jwtResult.payload.tenant:void 0,sessionsTable=deps.resolveSessionsTable?.(tenant)??null,session;try{session=await refreshSessionIsAlive({sessionId:boundSessionId,db:deps.db,sessionsTable})}catch(error3){return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId,error:error3 instanceof Error?error3.message:String(error3)}),{reason:"session-unreadable"}}if(session.unavailable)return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId}),{reason:"session-unreadable"};if(!session.alive)return deps.logger.warn("[PubSub] WS handshake rejected: session is no longer active",{userId:sub,sessionId:boundSessionId,reason:session.reason}),{reason:"session-revoked"};if(session.userId&&session.userId!==sub)return deps.logger.warn("[PubSub] WS handshake rejected: token subject is not the session owner",{userId:sub,sessionId:boundSessionId,sessionOwner:session.userId}),{reason:"session-subject-mismatch"};return{userId:sub}}}init_esm3();init_Secrets();var timed=async(fn)=>{let started=performance.now();return{result:await fn(),durationMs:Math.round(performance.now()-started)}},postForm=async(url,body)=>{let response=await fetch(url,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams(body).toString(),signal:AbortSignal.timeout(12000)}),text3=await response.text(),json={};try{json=JSON.parse(text3)}catch{json=Object.fromEntries(new URLSearchParams(text3))}return{status:response.status,json,text:text3}},describeError=(error3)=>{if(error3 instanceof Error){if(error3.name==="TimeoutError")return"Provider did not respond within 12s";return error3.message}return String(error3)},MICROSOFT_TOKEN_URL=(tenant)=>`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,DEFAULT_TOKEN_URLS={google:"https://oauth2.googleapis.com/token",github:"https://github.com/login/oauth/access_token"},describeRedirectUri=(value2)=>{let trimmed=value2?.trim();if(!trimmed)return"The reply URL (Redirect URI) is empty \u2014 sign-in cannot complete";if(/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))return`The reply URL looks like an environment variable name ("${trimmed}") and that variable is not set`;let parsed;try{parsed=new URL(trimmed)}catch{return`The reply URL is not a valid URL: "${trimmed}"`}if(parsed.protocol!=="https:"&&parsed.hostname!=="localhost")return`The reply URL must be https (it is "${parsed.protocol}//")`;return null};async function testOAuthProvider(provider,config){if(!config.clientId||!config.clientSecret)return{ok:!1,status:"failed",message:"Client ID and Client Secret must both be filled in",durationMs:0};let redirectProblem=describeRedirectUri(config.redirectUri);if(redirectProblem)return{ok:!1,status:"failed",message:redirectProblem,durationMs:0};try{if(provider==="microsoft"){let tenant=config.tenantId||"common";if(tenant==="common"||tenant==="organizations"||tenant==="consumers")return await probeWithBogusCode(MICROSOFT_TOKEN_URL(tenant),config);let{result,durationMs}=await timed(()=>postForm(MICROSOFT_TOKEN_URL(tenant),{grant_type:"client_credentials",client_id:config.clientId,client_secret:config.clientSecret,scope:"https://graph.microsoft.com/.default"}));if(result.status===200&&result.json.access_token)return{ok:!0,status:"ok",message:`Entra credentials verified (tenant ${tenant})`,durationMs};let code=String(result.json.error??result.status);return{ok:!1,status:"failed",message:String(result.json.error_description??result.text).slice(0,400),code,durationMs}}let tokenUrl=config.tokenUrl||DEFAULT_TOKEN_URLS[provider];if(!tokenUrl)return{ok:!1,status:"unknown",message:`No token URL is known for "${provider}" \u2014 enter a tokenUrl`,durationMs:0};return await probeWithBogusCode(tokenUrl,config)}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function probeWithBogusCode(tokenUrl,config){let{result,durationMs}=await timed(()=>postForm(tokenUrl,{grant_type:"authorization_code",code:"nucleus-credential-probe",client_id:config.clientId,client_secret:config.clientSecret,redirect_uri:config.redirectUri||"https://localhost/callback"})),code=String(result.json.error??""),description=String(result.json.error_description??result.text).slice(0,400);if(code==="invalid_grant"||code==="bad_verification_code")return{ok:!0,status:"ok",message:"The provider accepted these credentials",code,durationMs};if(code==="invalid_client"||code==="unauthorized_client"||result.status===401)return{ok:!1,status:"failed",message:description||"The provider refused this Client ID/Secret pair",code:code||"invalid_client",durationMs};if(description.includes("AADSTS7000215")||description.includes("AADSTS700016"))return{ok:!1,status:"failed",message:description,code,durationMs};return{ok:!1,status:"unknown",message:description||"The provider returned an unexpected answer",code:code||String(result.status),durationMs}}async function testStorageProvider(provider){if(!provider)return{ok:!1,status:"failed",message:"No storage provider is configured",durationMs:0};try{let{result,durationMs}=await timed(()=>provider.isAvailable());return result?{ok:!0,status:"ok",message:`Connection verified: ${provider.describe}`,durationMs}:{ok:!1,status:"failed",message:`Unreachable: ${provider.describe} \u2014 check the server, the share name and the credentials`,durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function testEmailProvider(service,recipient){if(!service)return{ok:!1,status:"failed",message:"No email provider is configured",durationMs:0};if(!service.isAvailable())return{ok:!1,status:"failed",message:"The provider could not be started with these credentials",durationMs:0};if(!recipient)return{ok:!0,status:"ok",message:"The provider started \u2014 enter a recipient address to send for real",durationMs:0};try{let{result,durationMs}=await timed(()=>service.sendEmail({to:recipient,subject:"Nucleus connection test",html:"<p>This email was sent by a connection test run from the admin panel.</p>"}));return result.success?{ok:!0,status:"ok",message:`Test email sent to ${recipient}`,durationMs}:{ok:!1,status:"failed",message:result.error??"Sending failed",durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}init_routeCollector();init_godminGuard();var SECRET_KINDS=["text","password","json","connection_string","pem","boolean","list"];var SCOPE_PATTERN=/^[A-Za-z0-9_.-]{1,200}$/,KEY_PATTERN=/^[A-Za-z0-9_-]{1,120}$/,fail5=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createSecretsRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,getService,resolvedOptions,getEmailService,getStorageProvider:getStorageProvider2}=routeConfig,guard4=createGodminGuard2({logger:logger2,db,schemaTables,area:"secrets management",allowedRoles:routeConfig.adminRoles}),requireService=(set2)=>{let service=getService();if(!service)return set2.status=503,null;return service},actorOf=(request)=>request.headers.get("x-user-id")??void 0,declared=[defineRoute({method:"GET",path:"/slots",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled \u2014 set secrets.enabled and provide an encryption key",data:null};let slots=await service.describe(resolvedOptions),groups=[...new Set(slots.map((s)=>s.group))].sort();return{isSuccess:!0,message:"Credential slots",data:{slots,groups,counts:{total:slots.length,fromDb:slots.filter((s)=>s.source==="db").length,fromEnv:slots.filter((s)=>s.source==="env").length,missing:slots.filter((s)=>s.source==="missing").length,missingRequired:slots.filter((s)=>s.source==="missing"&&s.required).length}}}},detail:{tags:["Secrets"],summary:"List credential slots discovered from the running config",description:"Slots are derived by walking the config tree, so a new integration appears without a code change. Values are never returned \u2014 only a masked preview and the resolution source."}}),defineRoute({method:"GET",path:"/",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};return{isSuccess:!0,message:"Stored credentials",data:{secrets:await service.list()}}},detail:{tags:["Secrets"],summary:"List stored credentials",description:"Metadata only \u2014 the encrypted value is never returned."}}),defineRoute({method:"PUT",path:"/:scope/:key",handler:async({params,body,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{scope,key:key2}=params;if(!SCOPE_PATTERN.test(scope))return fail5(set2,400,"Invalid scope");if(!KEY_PATTERN.test(key2))return fail5(set2,400,"Invalid key");let value2=body.value;if(typeof value2!=="string"||value2.length===0)return fail5(set2,400,"value is required");if(value2.length>65536)return fail5(set2,400,"value exceeds 64KB");if(body.kind==="json")try{JSON.parse(value2)}catch{return fail5(set2,400,"value is not valid JSON")}let saved=await service.set({scope,key:key2,value:value2,kind:body.kind,description:body.description,actorId:actorOf(request)});if(!saved)return fail5(set2,500,"Could not store the credential");return{isSuccess:!0,message:"Credential stored",data:{secret:saved}}},params:Type.Object({scope:Type.String(),key:Type.String()}),body:Type.Object({value:Type.String(),kind:Type.Optional(Type.Union(SECRET_KINDS.map((kind)=>Type.Literal(kind)))),description:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Set or rotate a credential",description:"Stores the value encrypted (AES-256-GCM). Rotating retains the previous value for a one-step rollback. Takes effect within seconds on every pod \u2014 no restart."}}),defineRoute({method:"POST",path:"/:scope/:key/rollback",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let restored=await service.rollback(params.scope,params.key,actorOf(request));if(!restored)return fail5(set2,404,"No previous value to roll back to");return{isSuccess:!0,message:"Previous credential restored",data:{secret:restored}}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Roll back to the value replaced by the last rotation"}}),defineRoute({method:"DELETE",path:"/:scope/:key",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!await service.remove(params.scope,params.key,actorOf(request)))return fail5(set2,404,"Credential not found");return{isSuccess:!0,message:"Credential removed \u2014 the config falls back to env or literal",data:null}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Delete a stored credential",description:"Resolution falls back to the env var or literal declared in config."}}),defineRoute({method:"POST",path:"/test",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{target:target2}=body,result;if(target2==="email")result=await testEmailProvider(getEmailService?.()??null,body.recipient);else if(target2==="oauth"){let provider=body.provider;if(!provider)return fail5(set2,400,"provider is required for an oauth test");let scope=`authentication.oauth.providers.${provider}`,providerConfig=(resolvedOptions.authentication?.oauth?.providers??{})[provider]??{},declaredString=(key2)=>{let raw=providerConfig[key2];return typeof raw==="string"?raw:void 0};result=await testOAuthProvider(provider,{clientId:service.value(scope,"clientId",declaredString("clientId")),clientSecret:service.value(scope,"clientSecret",declaredString("clientSecret")),tenantId:service.value(scope,"tenantId",declaredString("tenantId")),tokenUrl:declaredString("tokenUrl"),redirectUri:service.value(scope,"redirectUri",declaredString("redirectUri"))})}else if(target2==="storage")result=await testStorageProvider(getStorageProvider2?.()??null);else return fail5(set2,400,`Unsupported test target "${target2}"`);return logger2.info("[Secrets] Connection test",{target:target2,provider:body.provider,status:result.status,durationMs:result.durationMs}),{isSuccess:result.ok,message:result.message,data:{result}}},body:Type.Object({target:Type.Union([Type.Literal("oauth"),Type.Literal("email"),Type.Literal("storage")]),provider:Type.Optional(Type.String()),recipient:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Test a credential against the real provider",description:"Backend-to-backend only. OAuth uses client_credentials where the provider supports it and a client-authentication probe otherwise; email optionally sends a real test message."}}),defineRoute({method:"POST",path:"/reencrypt",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!body.newMasterKey||body.newMasterKey.length<16)return fail5(set2,400,"newMasterKey must be at least 16 characters");let result=await service.reencryptAll(body.newMasterKey),uncovered="Credentials stored outside this store \u2014 an integration connection\u2019s token, client secret and service password \u2014 are NOT re-encrypted by this. Re-enter them from the integrations panel after the new key is deployed.";return{isSuccess:result.failed.length===0,message:result.failed.length===0?`Re-encrypted ${result.migrated} credentials \u2014 deploy the new key before the next restart. ${uncovered}`:`Nothing was re-encrypted: ${result.failed.length} credential(s) could not be read with the current key, so none were rewritten.`,data:{...result,uncovered}}},body:Type.Object({newMasterKey:Type.String()}),detail:{tags:["Secrets"],summary:"Re-encrypt every credential under a new master key",description:"Rotates the key protecting the store. The new key must be deployed to the environment before the next restart, or nothing will decrypt."}}),defineRoute({method:"GET",path:"/discover",handler:()=>({isSuccess:!0,message:"Slots discovered from the running config",data:{slots:discoverSlots(resolvedOptions).map(({configValue:_configValue,...slot})=>slot)}}),detail:{tags:["Secrets"],summary:"Show which credential slots the config declares",description:"Diagnostics \u2014 resolution state is not consulted and no value is read."}}),defineRoute({method:"POST",path:"/storage/migrate",handler:async(ctx)=>{let body=ctx.body,build=routeConfig.buildStorageProvider;if(!build)return fail5(ctx.set,503,"Storage is not configured");let destination=build(body.to),source=build(body.to==="smb"?"local":"smb");if(!source||!destination)return fail5(ctx.set,503,"Storage is not configured");if(!await destination.isAvailable())return fail5(ctx.set,422,`The destination store is unreachable (${destination.describe}) \u2014 test the connection first`);if(body.dryRun){let preview=await migrateStorage({from:source,to:Object.assign(Object.create(Object.getPrototypeOf(destination)),destination,{exists:async()=>!1,write:async()=>{},ensureDir:async()=>{}}),maxFiles:1e5},{logger:logger2});return{isSuccess:!0,message:`${preview.copied} file${preview.copied===1?"":"s"} would be copied`,data:{preview}}}let report=await migrateStorage({from:source,to:destination},{logger:logger2}),clean=report.failed===0&&!report.truncated;return logger2.warn("[Storage] Migration run from the admin panel",{to:body.to,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),{isSuccess:clean,message:clean?`${report.copied} file${report.copied===1?"":"s"} copied, ${report.skipped} already present`:`${report.copied} copied, ${report.failed} failed${report.truncated?", list truncated":""}`,data:{report}}},body:Type.Object({to:Type.Union([Type.Literal("local"),Type.Literal("smb")]),dryRun:Type.Optional(Type.Boolean())}),detail:{tags:["Secrets"],summary:"Copy every stored file to the other backend",description:"Copy-only: the source is never deleted, and a file already on the target is skipped so a re-run resumes. Run BEFORE switching storage.provider."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function readAttemptedIdentity(parsedBody,rawBodyText,contentType){let fromJson=parsedBody.email;if(typeof fromJson==="string"&&fromJson.trim())return fromJson;if(!rawBodyText)return;if((contentType||"").toLowerCase().includes("application/x-www-form-urlencoded"))try{let value2=new URLSearchParams(rawBodyText).get("email");return value2?.trim()?value2:void 0}catch{return}return}var snakeToCamel4=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function warnOnEntityBasePathCollision(feature,basePath,entities,logger2){let segment=basePath.replace(/^\/+|\/+$/g,"");if(!segment||segment.includes("/"))return!1;let clash=(entities??[]).find((entity)=>snakeToCamel4(entity.table_name)===segment);if(!clash)return!1;return logger2.error(`[${feature}] basePath "${basePath}" is also the generated entity route for "${clash.table_name}". Both are registered and one will shadow the other. Move the feature (e.g. "/nucleus${basePath}") or rename the entity.`),!0}var ipMatches=(ip,entry)=>entry.includes("/")?isIpInCidr(ip,entry):ip===entry;function canonicalIp(ip){let trimmed=ip.trim();return/^::ffff:((?:\d{1,3}\.){3}\d{1,3})$/i.exec(trimmed)?.[1]??trimmed}function resolveClientIp(socketIp,forwardedFor,trustedProxies=[]){let peer=canonicalIp(socketIp||""),chain=(forwardedFor||"").split(",").map((s)=>canonicalIp(s)).filter(Boolean);if(!peer)return chain[0]||"unknown";if(trustedProxies.length===0)return peer;let trusted=(ip)=>trustedProxies.some((p)=>ipMatches(ip,p));if(!trusted(peer))return peer;for(let i=chain.length-1;i>=0;i--){let hop=chain[i];if(hop&&!trusted(hop))return hop}return chain[0]||peer}var isNonDiscriminatingPeer=(ip)=>ip==="::1"||ip==="unknown"||/^(::ffff:)?127\./.test(ip);function createPeerDiversityWatcher(sampleSize=200){let seen=new Set,seenCount=0,settled=!1;return{observe(ip){if(settled)return null;if(seenCount++,seen.add(ip),seen.size>1)return settled=!0,null;if(seenCount>=sampleSize)return settled=!0,ip;return null}}}var DEFAULTS={cookieName:"csrf_token",headerName:"x-csrf-token"},resolveCsrfConfig=(raw)=>{if(raw===!0)return{enabled:!0,...DEFAULTS};if(!raw)return{enabled:!1,...DEFAULTS};return{enabled:raw.enabled!==!1,cookieName:raw.cookieName||DEFAULTS.cookieName,headerName:(raw.headerName||DEFAULTS.headerName).toLowerCase()}},parseCookies=(cookieHeader)=>{let out={};if(!cookieHeader)return out;for(let part of cookieHeader.split(";")){let trimmed=part.trim(),eq41=trimmed.indexOf("=");if(eq41>0)out[trimmed.slice(0,eq41)]=trimmed.slice(eq41+1)}return out},SAFE_METHODS=new Set(["GET","HEAD","OPTIONS"]),isStateChanging=(method)=>!SAFE_METHODS.has(method.toUpperCase()),requiresCsrf=(params)=>{if(!isStateChanging(params.method))return!1;if(params.hasAuthorizationHeader)return!1;return params.authCookieNames.some((n)=>!!params.cookies[n])},csrfTokenMatches=(csrfCookie,csrfHeader)=>{if(!csrfCookie||!csrfHeader)return!1;return csrfCookie===csrfHeader};init_redactSecrets();var SENSITIVE_HEADER_NAMES=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-access-token","x-refresh-token","x-session-id","x-user-id","x-user-roles","x-user-claims","x-user-email","x-api-key","x-api-key-id","x-api-key-owner-type","x-auth-type"]);function redactSensitiveHeaders(headers){return redactHeaders(headers,{alwaysRedact:SENSITIVE_HEADER_NAMES})}init_sensitiveColumns();var TENANT_CLAIM="tenant",verifyTenantBinding=(tokenTenant,resolvedSchema,mode="lenient")=>{if(mode==="off")return{ok:!0};if(!resolvedSchema)return{ok:!0};let claim=typeof tokenTenant==="string"&&tokenTenant.length>0?tokenTenant:void 0;if(!claim)return mode==="strict"?{ok:!1,reason:"token is not bound to a tenant"}:{ok:!0};return claim===resolvedSchema?{ok:!0}:{ok:!1,reason:"token tenant does not match the requested tenant"}};init_storage2();init_routeMount();init_esm3();init_routeCollector();import{eq as eq41}from"drizzle-orm";var RESERVED_SUBDOMAINS=["www","api","app","admin","dashboard","mail","ftp","cdn","static","assets","docs","help","support","status","blog","dev","staging","test","demo","localhost"],DEFAULT_SELF_SIGNUP_LIMITS={maxSignupsPerIpPerWindow:3,ipWindowMs:3600000,maxTenantsPerEmail:1};var col9=(table,name2)=>table[name2];function createCheckSubdomainRoute(config){let declared=[defineRoute({method:"GET",path:"/tenants/check-subdomain/:subdomain",handler:async(ctx)=>{let{subdomain}=ctx.params,normalized=subdomain.toLowerCase().trim();if(!/^[a-z][a-z0-9-]*$/.test(normalized)||normalized.length<2||normalized.length>63)return ctx.set.status=400,{isSuccess:!1,message:"Invalid subdomain format. Must start with a letter, contain only lowercase letters, numbers, and hyphens, and be 2-63 characters.",data:{available:!1,subdomain:normalized}};if(RESERVED_SUBDOMAINS.includes(normalized))return{isSuccess:!0,message:"Subdomain is reserved",data:{available:!1,subdomain:normalized}};let tenantRegistry=config.getTenantRegistry(),db=config.getDb();if(tenantRegistry){if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===normalized))return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}if(db&&tenantRegistry){let tenantsTable=tenantRegistry.getMainContext().schemaTables.tenants;if(tenantsTable)try{if((await db.select().from(tenantsTable).where(eq41(col9(tenantsTable,"subdomain"),normalized)).limit(1)).length>0)return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}catch{}}return{isSuccess:!0,message:"Subdomain is available",data:{available:!0,subdomain:normalized}}},params:Type.Object({subdomain:Type.String({minLength:2,maxLength:63})}),detail:{tags:["Tenants"],summary:"Check subdomain availability",description:"Public endpoint to check if a subdomain is available for registration. No authentication required."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Logger2();init_routeCollector();init_adminGuard();import{eq as eq42}from"drizzle-orm";var col10=(table,name2)=>table[name2];function createManageRoutes(config){let log4=config.logger.scoped(TENANT_SUSPEND),declared=[defineRoute({method:"GET",path:"/tenants",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let allTenants=[...tenantRegistry.getActiveTenants(),...Array.from(getAllTenants(tenantRegistry)).filter((t)=>t.status!=="active")];return{success:!0,message:`Found ${allTenants.length} tenants`,data:{items:allTenants.map((t)=>({id:t.id,subdomain:t.subdomain,schemaName:t.schemaName,companyId:t.companyId,companyName:t.companyName,godAdminEmail:t.godAdminEmail,status:t.status,plan:t.plan,domain:t.domain,maxUsers:t.maxUsers,provisionedAt:t.provisionedAt,suspendedAt:t.suspendedAt})),totalCount:allTenants.length}}},detail:{tags:["Tenants"],summary:"List tenants",description:"List all tenants in the platform. Requires godmin privileges."}}),defineRoute({method:"GET",path:"/tenants/:id",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found",data:null};let features=tenantRegistry.getTenantFeatures(id);return{success:!0,message:"Tenant found",data:{...tenant,features:features.map((f)=>({featureName:f.featureName,enabled:f.enabled}))}}},detail:{tags:["Tenants"],summary:"Get tenant details",description:"Get detailed information about a specific tenant. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/suspend",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,body=ctx.body,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status==="suspended")return ctx.set.status=400,{success:!1,message:"Tenant is already suspended"};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"suspended",suspendedAt:now,suspendedReason:body.reason||"Suspended by godmin",updatedAt:now}).where(eq42(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"suspended",eventData:JSON.stringify({reason:body.reason||"Suspended by godmin"}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log4.warn("Failed to record suspend event")}return await tenantRegistry.refreshTenant(id),log4.info("Tenant suspended",{tenantId:id,reason:body.reason}),{success:!0,message:`Tenant "${tenant.subdomain}" suspended`}},body:Type.Object({reason:Type.Optional(Type.String())}),detail:{tags:["Tenants"],summary:"Suspend tenant",description:"Suspend a tenant, preventing all access. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/reactivate",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(ctx.request,db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status!=="suspended")return ctx.set.status=400,{success:!1,message:`Tenant is not suspended (current: ${tenant.status})`};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"active",suspendedAt:null,suspendedReason:null,updatedAt:now}).where(eq42(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"reactivated",eventData:JSON.stringify({previousReason:tenant.suspendedReason}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log4.warn("Failed to record reactivate event")}return await tenantRegistry.refreshTenant(id),log4.info("Tenant reactivated",{tenantId:id}),{success:!0,message:`Tenant "${tenant.subdomain}" reactivated`}},detail:{tags:["Tenants"],summary:"Reactivate tenant",description:"Reactivate a suspended tenant. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}var verifyGodmin=async(request,db,tenantRegistry,userId)=>{if(!mayActAsGodmin(request))return!1;let usersTable=tenantRegistry.getMainContext().schemaTables.users;if(!usersTable)return!1;return(await db.select().from(usersTable).where(eq42(col10(usersTable,"id"),userId)).limit(1))[0]?.isGod===!0},getAllTenants=(registry4)=>{let schemaNames=registry4.getAllSchemaNames(),tenants=[];for(let name2 of schemaNames){let ctx=registry4.getSchemaContext(name2);if(ctx?.tenant)tenants.push(ctx.tenant)}return tenants};init_esm3();init_Logger2();init_routeCollector();init_utils6();init_adminGuard();import{eq as eq43}from"drizzle-orm";var col11=(table,name2)=>table[name2],ProvisionBodySchema=Type.Object({subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),companyId:Type.String({format:"uuid"}),companyName:Type.Optional(Type.String()),godAdminEmail:Type.String({format:"email"}),plan:Type.Optional(Type.String()),domain:Type.Optional(Type.String())});function createProvisionRoute(config){let log4=config.logger.scoped(TENANT_PROVISION),declared=[defineRoute({method:"POST",path:"/tenants/provision",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users;if(!usersTable)return ctx.set.status=503,{success:!1,message:"Users table not available"};let requestingUser=(await db.select().from(usersTable).where(eq43(col11(usersTable,"id"),requestingUserId)).limit(1))[0];if(!mayActAsGodmin(ctx.request)||!requestingUser?.isGod)return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let body=ctx.body,tenantSchemaName=`tenant_${body.subdomain.replace(/-/g,"_")}`;if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===body.subdomain))return ctx.set.status=409,{success:!1,message:`Subdomain "${body.subdomain}" is already taken`};let tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available in main schema"};let tenantId=crypto.randomUUID(),now=new Date;try{await db.insert(tenantsTable).values({id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,createdAt:now,updatedAt:now}),log4.info("Tenant record created",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName})}catch(err){let msg=err instanceof Error?err.message:String(err);return log4.error("Failed to insert tenant record",{error:msg}),ctx.set.status=500,{success:!1,message:`Failed to create tenant record: ${msg}`}}try{let tenantRecord={id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log4.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable){let godminId=crypto.randomUUID(),tempPassword=crypto.randomUUID().slice(0,16),hashedPassword=await hashPassword(tempPassword);await db.insert(tenantUsersTable).values({id:godminId,email:body.godAdminEmail,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log4.info("Godmin user seeded",{tenantId,godminEmail:body.godAdminEmail,godminId})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq43(col11(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"provisioned",eventData:JSON.stringify({schemaName:tenantSchemaName,godAdminEmail:body.godAdminEmail,plan:body.plan||null}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log4.warn("Failed to record tenant_event, continuing")}return await tenantRegistry.refreshTenant(tenantId),log4.info("Provisioning complete",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"PROVISION",userId:requestingUserId,summary:`Tenant "${body.subdomain}" provisioned by godmin`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant provisioned successfully",data:{tenantId,schemaName:tenantSchemaName,subdomain:body.subdomain,godAdminEmail:body.godAdminEmail,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log4.error("Provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq43(col11(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:`Provisioning failed: ${msg}`}}},body:ProvisionBodySchema,detail:{tags:["Tenants"],summary:"Provision new tenant",description:"Create a new tenant with its own schema, tables, and godmin user. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Authorization();init_Logger2();init_routeCollector();init_passwordPolicy();init_utils6();import{eq as eq44}from"drizzle-orm";var col12=(table,name2)=>table[name2],ipRateMap=new Map,lastCleanup=Date.now();function cleanupRateMap(windowMs){let now=Date.now();if(now-lastCleanup<600000)return;lastCleanup=now;for(let[key2,entry]of ipRateMap.entries())if(now-entry.windowStart>windowMs)ipRateMap.delete(key2)}function isIpRateLimited(ip,maxPerWindow,windowMs){let now=Date.now(),entry=ipRateMap.get(ip);if(!entry||now-entry.windowStart>windowMs)return ipRateMap.set(ip,{count:1,windowStart:now}),!1;return entry.count++,entry.count>maxPerWindow}var SelfSignupBodySchema=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),plan:Type.Optional(Type.String()),companyName:Type.Optional(Type.String())});function createSelfSignupRoute(config){let log4=config.logger.scoped(TENANT_SELF_SIGNUP),limits={...DEFAULT_SELF_SIGNUP_LIMITS,...config.selfSignupLimits},declared=[defineRoute({method:"POST",path:"/tenants/self-signup",handler:async(ctx)=>{cleanupRateMap(limits.ipWindowMs);let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let ip=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown";if(isIpRateLimited(ip,limits.maxSignupsPerIpPerWindow,limits.ipWindowMs))return log4.warn("Self-signup rate limited",{ip}),ctx.set.status=429,{success:!1,message:"Too many signup attempts. Please try again later."};let body=ctx.body,email=body.email.toLowerCase().trim(),subdomain=body.subdomain.toLowerCase().trim();if(RESERVED_SUBDOMAINS.includes(subdomain))return ctx.set.status=400,{success:!1,message:"This subdomain is reserved."};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users,tenantsTable=mainContext.schemaTables.tenants;if(!usersTable||!tenantsTable)return ctx.set.status=503,{success:!1,message:"Required tables not available."};if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===subdomain))return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."};try{if((await db.select().from(tenantsTable).where(eq44(col12(tenantsTable,"subdomain"),subdomain)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."}}catch{}try{if((await db.select().from(tenantsTable).where(eq44(col12(tenantsTable,"godAdminEmail"),email))).length>=limits.maxTenantsPerEmail)return ctx.set.status=409,{success:!1,message:`Tenant limit reached. Maximum ${limits.maxTenantsPerEmail} tenant(s) per account.`}}catch{}let strength=validateAgainstPolicy(body.password,void 0,body.email);if(!strength.valid)return ctx.set.status=400,{success:!1,message:"Password too weak",errors:strength.errors};let userId,hashedPassword=await hashPassword(body.password),now=new Date,existingUsers=await db.select().from(usersTable).where(eq44(col12(usersTable,"email"),email)).limit(1);if(existingUsers.length>0)userId=existingUsers[0].id,log4.info("Self-signup: existing user resolved",{userId,email});else{userId=crypto.randomUUID();try{await db.insert(usersTable).values({id:userId,email,password:hashedPassword,isActive:!0,createdAt:now,updatedAt:now}),log4.info("Self-signup: user created",{userId,email})}catch(err){let msg=err instanceof Error?err.message:String(err);return log4.error("Self-signup: user creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create account."}}}let tenantId=crypto.randomUUID(),tenantSchemaName=`tenant_${subdomain.replace(/-/g,"_")}`;try{await db.insert(tenantsTable).values({id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,createdAt:now,updatedAt:now}),log4.info("Tenant record created",{tenantId,subdomain})}catch(err){let msg=err instanceof Error?err.message:String(err);return log4.error("Tenant record creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create tenant."}}try{let tenantRecord={id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,domain:null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log4.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable)await db.insert(tenantUsersTable).values({id:userId,email,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log4.info("Godmin seeded in tenant schema",{tenantId,email,userId});let tenantRolesTable=tenantContext.schemaTables.roles,tenantUserRolesTable=tenantContext.schemaTables.userRoles;if(tenantRolesTable&&tenantUserRolesTable)try{let godminRoles=await db.select().from(tenantRolesTable).where(eq44(tenantRolesTable.name,GODMIN_ROLE_NAME)).limit(1),godminRoleId;if(godminRoles.length>0)godminRoleId=godminRoles[0].id;else{let[newRole]=await db.insert(tenantRolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();godminRoleId=newRole.id,log4.info("Created godmin role in tenant schema",{tenantId,roleId:godminRoleId})}if(godminRoleId)await db.insert(tenantUserRolesTable).values({userId,roleId:godminRoleId}),log4.info("Assigned godmin role to signup user",{tenantId,userId,roleId:godminRoleId})}catch(roleErr){log4.warn("Failed to assign godmin role to signup user",{tenantId,userId,error:roleErr instanceof Error?roleErr.message:String(roleErr)})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq44(col12(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"self_signup",eventData:JSON.stringify({email,subdomain,plan:body.plan||null}),performedBy:userId,ipAddress:ip,createdAt:now,updatedAt:now})}catch{}return await tenantRegistry.refreshTenant(tenantId),log4.info("Self-signup complete",{tenantId,subdomain,email}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"SELF_SIGNUP",userId,summary:`Self-signup: tenant "${subdomain}" provisioned by ${email}`,ipAddress:ip,userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant created successfully",data:{tenantId,subdomain,schemaName:tenantSchemaName,userId,email,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log4.error("Self-signup provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq44(col12(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:"Provisioning failed. Please try again."}}},body:SelfSignupBodySchema,detail:{tags:["Tenants"],summary:"Self-service tenant signup",description:"Public endpoint for self-service signup. Creates user account, provisions tenant schema, and seeds godmin. Rate-limited by IP with configurable max tenants per email."}})];return collectRoutes([{routes:declared}])}function createTenantRoutes(app,config){return useRoutes(app,createCheckSubdomainRoute(config)),useRoutes(app,createProvisionRoute(config)),useRoutes(app,createSelfSignupRoute(config)),useRoutes(app,createManageRoutes(config)),app}init_esm3();init_routeCollector();init_adminGuard();init_apiKeyCeiling();init_buildServices();var MODEL_2_GRAPH_SCHEMA=Type.Object({steps:Type.Array(Type.Object({node_id:Type.String({minLength:1,maxLength:255}),step_order:Type.Integer({minimum:1,maximum:200}),name:Type.Optional(Type.String({maxLength:255})),description:Type.Optional(Type.String({maxLength:4000})),kind:Type.Optional(Type.Union([Type.Literal("approval"),Type.Literal("revision")])),approval_mode:Type.Optional(Type.Union([Type.Literal("all_assignees"),Type.Literal("any_assignee")])),on_approved:Type.Optional(Type.Union([Type.Literal("next"),Type.Literal("complete"),Type.Literal("goto_step")])),on_approved_step_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),on_rejected:Type.Optional(Type.Union([Type.Literal("end"),Type.Literal("goto_step")])),on_rejected_step_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),assignees:Type.Array(Type.Object({slot_index:Type.Integer({minimum:1,maximum:50}),verifier_type:Type.Union([Type.Literal("role"),Type.Literal("user"),Type.Literal("entity_author")]),verifier_user_id:Type.Optional(Type.Union([Type.String(),Type.Null()])),verifier_role:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),require_signature:Type.Optional(Type.Boolean()),role_quorum:Type.Optional(Type.Union([Type.Literal("one"),Type.Literal("all")])),legacy_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()]))}))})),actions:Type.Array(Type.Object({step_node_id:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()])),trigger:Type.Union([Type.Literal("on_flow_started"),Type.Literal("on_step_reached"),Type.Literal("on_approved"),Type.Literal("on_rejected"),Type.Literal("on_flow_completed"),Type.Literal("on_flow_rejected"),Type.Literal("on_resubmitted")]),action_type:Type.Optional(Type.Literal("notify")),action_order:Type.Optional(Type.Integer({minimum:1,maximum:200})),is_enabled:Type.Optional(Type.Boolean()),fires_on_pass:Type.Optional(Type.Union([Type.Literal("every"),Type.Literal("first"),Type.Literal("repeat")])),title_template:Type.Optional(Type.Union([Type.String({maxLength:8000}),Type.Null()])),body_template:Type.Optional(Type.Union([Type.String({maxLength:8000}),Type.Null()])),starts_at:Type.Optional(Type.Union([Type.String(),Type.Null()])),expires_at:Type.Optional(Type.Union([Type.String(),Type.Null()])),config:Type.Optional(Type.Union([Type.Record(Type.String(),Type.Any()),Type.Null()])),recipients:Type.Array(Type.Object({recipient_type:Type.Union([Type.Literal("user"),Type.Literal("role"),Type.Literal("all_verifiers"),Type.Literal("step_verifier"),Type.Literal("entity_creator")]),recipient_user_id:Type.Optional(Type.Union([Type.String(),Type.Null()])),recipient_role:Type.Optional(Type.Union([Type.String({maxLength:255}),Type.Null()]))})),channels:Type.Array(Type.Union([Type.Literal("portal"),Type.Literal("email"),Type.Literal("sms"),Type.Literal("telegram"),Type.Literal("webhook")]))}))});function createVerificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry}=routeConfig,{verificationService:defaultVerificationService,notificationService:defaultNotificationService}=buildVerificationServices({db,schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService}),getServicesForRequest=(request)=>{if(!tenantRegistry)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};return buildVerificationServices({db,schemaTables:ctx.schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService})},basePath=config.endpoints?.basePath||"/verifications",flowBasePath=config.flowEndpoints?.basePath||"/verification-flows",requireUser=({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,{success:!1,message:"Authentication required"}},mayStartFor=(request,entityName)=>{if(hasGodminRole(request))return!0;let claims=decodeHeaderList(request.headers.get("x-user-claims"));if(claims.length===0)return!1;let wanted=new Set;for(let name2 of bothSpellings(entityName))for(let verb of["post","patch","put"])wanted.add(`${verb}.${name2}`);return claims.some((c)=>{for(let w of wanted)if(c===w||c.startsWith(`${w}.`))return!0;return!1})},verificationDeclared=[defineRoute({method:"GET",path:"/status/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:status}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/cancel",params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({reason:Type.Optional(Type.String({maxLength:1000})),end_reason:Type.Optional(Type.Union([Type.Literal("cancelled"),Type.Literal("superseded")]))}),detail:{tags:["Verification"],summary:"Cancel the active chain on a record",description:"Closes a chain nobody can decide any more (verifiers gone, flow withdrawn). "+"The record returns to the verdict its last finished chain gave it \u2014 an approval only "+"if the record has not changed since \u2014 or to pending otherwise, and a new chain can "+'be started. History is kept. `end_reason: "superseded"` records that a newer record replaced this one; it is written only when the host confirms that (`isRecordSuperseded`), and refused with 409 otherwise.'},handler:async({params,body,request,set:set2})=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,{success:!1,message:"User ID required"};let{verificationService}=getServicesForRequest(request),isGod=hasGodminRole(request),startedBy=(await verificationService.getStatus(params.entity_name,params.entity_id)).instance?.started_by;if(!isGod&&startedBy!==userId)return set2.status=403,{success:!1,code:"cancel_not_allowed",detail:{},message:"Only the person who started this verification, or a godmin, can cancel it"};let result=await verificationService.cancelInstance({entity_name:params.entity_name,entity_id:params.entity_id,cancelled_by:userId,reason:body?.reason,end_reason:body?.end_reason});if(!result.success)set2.status=409;return result}}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/decide",handler:async({params,body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};let result=await verificationService.decide({entity_name:params.entity_name,entity_id:params.entity_id,user_id:userId,decision:body.decision,reason:body.reason,signature_id:body.signature_id,diff:body.diff,role_ceiling:apiKeyRoleCeiling(request)});if(result.success)try{let reqUrl=new URL(request.url);await logger2.audit({entityName:params.entity_name,entityId:params.entity_id,operation:body.decision==="approved"?"APPROVE":"REJECT",userId,summary:`${String(result.verification?.decision??body.decision)} by ${userId}: ${result.message}${body.reason?` \u2014 ${body.reason}`:""}`,ipAddress:request.headers.get("x-client-ip")?.trim()||"unknown",userAgent:request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}catch(err){logger2.error(`[Verification] Decision audit failed (decision stands): ${String(err)}`)}return result},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({decision:Type.Union([Type.Literal("approved"),Type.Literal("rejected")]),reason:Type.Optional(Type.String()),signature_id:Type.Optional(Type.String()),diff:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})}),defineRoute({method:"GET",path:"/pending",handler:async({request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return{success:!0,data:await verificationService.getPending(userId)}}}),defineRoute({method:"GET",path:"/history/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:{verifications:status.verifications,current_step:status.current_step,total_steps:status.total_steps,is_completed:status.is_completed,is_rejected:status.is_rejected}}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,code:"start_not_allowed",detail:{entityName:body.entity_name},message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlow({flow_id:body.flow_id,entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start-for-entity",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,code:"start_not_allowed",detail:{entityName:body.entity_name},message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlowForEntity({entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"GET",path:"/statuses/:entity_name",handler:async({params,query,request})=>{let isGod=hasGodminRole(request),userId=request.headers.get("x-user-id")??"",{verificationService}=getServicesForRequest(request);return{success:!0,data:{...await verificationService.listEntityStatuses({entity_name:params.entity_name,status:query.status||void 0,page:query.page?Number(query.page):void 0,limit:query.limit?Number(query.limit):void 0,...isGod?{}:{started_by:userId}}),scope:isGod?"all":"started_by_me"}}},params:Type.Object({entity_name:Type.String()}),query:Type.Object({status:Type.Optional(Type.String()),page:Type.Optional(Type.String()),limit:Type.Optional(Type.String())})})],groups=[];if(config.endpoints?.enabled!==!1)groups.push({prefix:basePath,guards:[requireUser],routes:verificationDeclared}),logger2.info(`[Verification] Routes registered at ${basePath}`);else logger2.info("[Verification] endpoints.enabled is false; review routes not mounted");if(config.flowEndpoints?.enabled!==!1){let flowDeclared=[defineRoute({method:"GET",path:"/",handler:async({query,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.listFlows(query.entity_name||void 0)}},query:Type.Object({entity_name:Type.Optional(Type.String())})}),defineRoute({method:"GET",path:"/:flow_id",handler:async({params,request,set:set2})=>{let{verificationService:vs}=getServicesForRequest(request),result=await vs.getFlow(params.flow_id);if(!result)return set2.status=404,{success:!1,code:"flow_not_found",detail:{},message:"Flow not found"};let running_chains=await vs.countRunningChains(params.flow_id);return{success:!0,data:{...result,running_chains}}},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.saveFlow(body)},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),name:Type.String(),description:Type.Optional(Type.String()),trigger_on:Type.Union([Type.Literal("create"),Type.Literal("update"),Type.Literal("delete"),Type.Literal("manual")]),trigger_fields:Type.Optional(Type.Array(Type.String())),is_draft:Type.Boolean(),viewport:Type.Optional(Type.Object({x:Type.Number(),y:Type.Number(),zoom:Type.Number()})),graph:Type.Object({steps:Type.Array(Type.Any()),edges:Type.Array(Type.Any()),verifier_configs:Type.Array(Type.Any()),notification_rules:Type.Array(Type.Any()),notification_recipients:Type.Array(Type.Any()),notification_channels:Type.Array(Type.Any())}),model_version:Type.Optional(Type.Union([Type.Literal(1),Type.Literal(2)])),max_passes:Type.Optional(Type.Integer({minimum:0,maximum:1e5})),model2:Type.Optional(MODEL_2_GRAPH_SCHEMA)})}),defineRoute({method:"POST",path:"/feasibility",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.checkModel2Feasibility({entity_name:body.entity_name,model2:body.model2,max_passes:body.max_passes})}},body:Type.Object({entity_name:Type.String(),max_passes:Type.Optional(Type.Integer({minimum:0,maximum:1e5})),model2:MODEL_2_GRAPH_SCHEMA})}),defineRoute({method:"POST",path:"/:flow_id/publish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.publishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/:flow_id/unpublish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.unpublishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"DELETE",path:"/:flow_id",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.deleteFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})})];groups.push({prefix:flowBasePath,guards:[createGodminGuard({db,schemaTables,logger:logger2},"verification flow management")],routes:flowDeclared}),logger2.info(`[Verification] Flow routes registered at ${flowBasePath}`)}return{routes:collectRoutes(groups),verificationService:defaultVerificationService,notificationService:defaultNotificationService}}function createNucleusRuntime(deps){return{sendEmail:async(payload)=>{let mailer=deps.getEmailService();if(!mailer?.isAvailable())return{success:!1,error:"No email provider is configured or available"};return mailer.sendEmail(payload)},emailProvider:()=>deps.activeEmailProvider(),isEmailAvailable:()=>!!deps.getEmailService()?.isAvailable(),emailSenderAddress:()=>deps.getEmailService()?.getSenderAddress?.()??""}}function unappliedSettings(config,swagger){let notes=[],say=(option,reality)=>notes.push(`${option} \u2014 ${reality}`);if(swagger?.provider&&swagger.provider!=="scalar")say(`swagger.provider: '${swagger.provider}'`,"only the Scalar viewer is shipped; the document itself is unaffected");if(swagger?.excludeStaticFile!==void 0)say("swagger.excludeStaticFile","nothing distinguishes a static-asset route from any other, so no route is excluded by it. Use `swagger.exclude` to name paths");let pubsub=config.pubsub;if(pubsub?.pubsubName)say("pubsub.pubsubName","names a Dapr component for a publish call this build never makes; realtime delivery goes straight to the connected sockets");if(pubsub?.ack?.retryIntervalMs!==void 0)say("pubsub.ack.retryIntervalMs","there is no interval-based retry loop; unacknowledged messages are redelivered when a client reconnects");if(config.domains?.cloudflare?.fallbackOrigin)say("domains.cloudflare.fallbackOrigin","never sent to Cloudflare; set the fallback origin on the zone itself");if(config.domains?.verification?.defaultMethod&&config.domains.verification.defaultMethod!=="txt")say(`domains.verification.defaultMethod: '${config.domains.verification.defaultMethod}'`,"ownership is always proved with a TXT record; cname and http are not implemented");if(config.database?.type)say("database.type","Postgres is the only engine this build talks to");let schemas=config.database?.schemas;if(Array.isArray(schemas)&&schemas.length>1)say(`database.schemas (${schemas.length} named)`,`only the first is used (\`${schemas[0]}\`); the rest are ignored`);let verification=config.authentication?.register?.emailVerification;if(verification?.provider)say(`authentication.register.emailVerification.provider: '${verification.provider}'`,"the sender is chosen globally from the `email` config and the secrets store, not per mail");let templates=verification?.templates,withTemplatePath=Object.entries(templates??{}).filter(([,t])=>t?.htmlTemplatePath).map(([name2])=>name2);if(withTemplatePath.length>0)say(`authentication.register.emailVerification.templates.${withTemplatePath.join("/")}.htmlTemplatePath`,"the mail bodies are built in code; only `subject` is taken from this config");return notes}init_utils5();function asText(value2){return typeof value2==="string"&&value2.trim()?value2.trim():void 0}function fieldOf(path7){let text3=asText(path7);if(!text3)return;return text3.replace(/^\//,"").replace(/\//g,".")||void 0}function fromValidator(error3){let candidate=error3;if(typeof candidate?.validator?.Errors!=="function")return;try{let fields=[],reason;for(let item of candidate.validator.Errors(candidate.value)){let field=fieldOf(item?.path);if(field&&!fields.includes(field))fields.push(field);if(reason??=asText(item?.message),fields.length>=4)break}return fields.length||reason?{fields,reason}:void 0}catch{return}}function compose(where,reason){if(where&&reason)return`Invalid request: ${where} \u2014 ${reason}`;if(where)return`Invalid request: ${where}`;if(reason)return`Invalid request: ${reason}`;return"Invalid request"}function fromMessage(raw){let text3=asText(raw);if(!text3)return"Invalid request";let payload;try{payload=JSON.parse(text3)}catch{return}if(!payload||typeof payload!=="object"||payload.type!=="validation")return;let on=asText(payload.on),property=fieldOf(payload.property),reason=asText(payload.summary)??asText(payload.message),where=property&&property!=="root"?`${on?`${on}.`:""}${property}`:on?`the request ${on}`:void 0;return compose(where,reason)}function describeValidationError(error3){if(typeof error3!=="string"&&error3){let detail=fromValidator(error3);if(detail){let on=asText(error3.type),where=detail.fields.length?detail.fields.map((field)=>on?`${on}.${field}`:field).join(", "):on?`the request ${on}`:void 0;return compose(where,detail.reason)}return fromMessage(error3.message)}return fromMessage(error3)}function statusOfError(code,error3){if(typeof code==="number")return code;let carried=error3?.status;if(typeof carried==="number"&&carried>=100&&carried<=599)return carried;return 500}init_auth();init_backup();init_payment();init_marketplace();init_storage2();var mergeEntitiesByName=(entities)=>{let entityMap=new Map;for(let entity of entities){let existing=entityMap.get(entity.table_name),mergedColumns=entity.columns??existing?.columns;entityMap.set(entity.table_name,{...existing||{},...entity,columns:mergedColumns})}return Array.from(entityMap.values())},effectiveConfigEntities=(configEntities)=>{if(!configEntities.some((e)=>e.extends))return configEntities;let{entities:resolved}=resolveEntities(SYSTEM_TABLES,configEntities),byName=new Map(resolved.map((t)=>[t.table_name,t]));return configEntities.map((e)=>e.extends?byName.get(e.table_name)??e:e)},normalizeSystemTable=(table)=>({table_name:table.table_name,excluded_methods:table.excluded_methods?[...table.excluded_methods]:void 0,columns:table.columns?table.columns.map((column3)=>({name:column3.name,type:column3.type})):void 0}),extractSchemaTableEntities=(schemaTables)=>{let entities=[];for(let[_key,tableValue]of Object.entries(schemaTables)){if(!tableValue||typeof tableValue!=="object")continue;let tableObj=tableValue,underscoreMeta=tableObj._;if(underscoreMeta?.name){entities.push({table_name:underscoreMeta.name});continue}let symbols3=Object.getOwnPropertySymbols(tableObj);for(let sym of symbols3){let symValue=tableObj[sym];if(symValue&&typeof symValue==="object"){let symMeta=symValue;if(symMeta.name&&typeof symMeta.name==="string"){entities.push({table_name:symMeta.name});break}}}}return entities},lastMountedGroups=[];function getMountedRuntime2(){return getMountedRuntime()}function getResolvedOptions2(){return getResolvedOptions()}function getMountedRouteGroups(){return lastMountedGroups}var lastMountedSocket=null;function getMountedSocket(){return lastMountedSocket}var lastStaticAssets=null;function getMountedStaticAssets(){return lastStaticAssets}var lastBootSteps=null,lastShutdownSteps=null,lastAuthMiddleware=null,lastErrorHandler=null,lastAfterHandler=null;function getAfterHandler(){return lastAfterHandler}function getErrorHandler(){if(!lastErrorHandler)throw Error("getErrorHandler() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastErrorHandler}function getAuthMiddleware(){if(!lastAuthMiddleware)throw Error("getAuthMiddleware() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastAuthMiddleware}function getBootSteps(){if(!lastBootSteps)throw Error("getBootSteps() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastBootSteps}function getShutdownSteps(){return lastShutdownSteps??[]}function resolveOverrides(groups,logger2){let claim=new Map,dropped=[],kept=[];for(let index=groups.length-1;index>=0;index--){let group=groups[index];if(!group)continue;let routes=[];for(let position=group.routes.length-1;position>=0;position--){let route=group.routes[position];if(!route)continue;let declared=route.path==="/"?"":route.path,key2=`${route.method} ${`${group.prefix??""}${declared}`||"/"}`,winner=claim.get(key2);if(winner){let summary=route.detail?.summary??"(no summary)";dropped.push(`${key2} \u2014 kept "${winner.summary}", dropped "${summary}"`);continue}claim.set(key2,{summary:route.detail?.summary??"(no summary)"}),routes.unshift(route)}if(routes.length>0)kept.unshift({...group,routes})}if(dropped.length>0)logger2.warn(`[Routes] ${dropped.length} route(s) replaced by a later declaration of the same path`,{replaced:dropped});return kept}async function buildNucleus(config){beginRouteRecording();let plugin=collectRoutes(),routeGetHealth=defineRoute({method:"GET",path:"/health",handler:()=>({status:"ok",timestamp:Date.now()})}),routeGetReady=defineRoute({method:"GET",path:"/health/ready",handler:async({set:set2})=>{let checks={database:"skipped",redis:"skipped"},ready=!0;if(db)try{await db.execute(sql15`select 1`),checks.database="ok"}catch{checks.database="fail",ready=!1}try{let client=getRedisManager()?.getDirectClient?.();if(client)await client.ping(),checks.redis="ok"}catch{checks.redis="fail",ready=!1}if(!ready)set2.status=503;return{status:ready?"ready":"not-ready",checks,timestamp:Date.now()}}});if(mountRoutes(plugin,[{routes:[routeGetHealth,routeGetReady]}]),config.staticAssets!==!1){let path8=__require("path"),fs3=__require("fs"),assetsPath;if(typeof config.staticAssets==="string")assetsPath=config.staticAssets;else{let localPath=path8.join(process.cwd(),"public"),resolvedPkgPath="";for(let pkgName of["nucleus-core-ts","nucleus-core"])try{let pkgJson=__require.resolve(`${pkgName}/package.json`),candidate=path8.join(path8.dirname(pkgJson),"public");if(fs3.existsSync(candidate)){resolvedPkgPath=candidate;break}}catch{}if(resolvedPkgPath)assetsPath=resolvedPkgPath;else if(fs3.existsSync(localPath))assetsPath=localPath;else assetsPath=localPath}recordStaticAssets(assetsPath)}let publicRoutes=[],resolvedOptions,configDir=process.cwd(),configFilePath=null;if(typeof config.options==="string"){let fs3=__require("fs"),path8=__require("path"),configPath=path8.isAbsolute(config.options)?config.options:path8.resolve(process.cwd(),config.options);configDir=path8.dirname(configPath),configFilePath=configPath;let configContent=fs3.readFileSync(configPath,"utf-8");resolvedOptions=JSON.parse(configContent)}else resolvedOptions=config.options;if(resolvedOptions.email?.gmail?.json_file_path){let path8=__require("path"),gmailPath=resolvedOptions.email.gmail.json_file_path;if(!path8.isAbsolute(gmailPath))resolvedOptions.email.gmail.json_file_path=path8.resolve(configDir,gmailPath)}recordResolvedOptions(resolvedOptions);let{authentication,audit,entities,database}=resolvedOptions,isDev=resolvedOptions.mode==="development",loggingConfig=resolvedOptions.logging,logger2=new Logger({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],auditEnabled:audit?.enabled??!1,...audit?.suppressReasons!==void 0?{auditSuppressReasons:audit.suppressReasons}:{},...audit?.minSeverity!==void 0?{auditMinSeverity:audit.minSeverity}:{},enabledScopes:loggingConfig?.scopes||["*"]});Logger.getInstance().configure({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],enabledScopes:loggingConfig?.scopes||["*"]});let serverLogsConfig=resolvedOptions.monitoring?.serverLogs,serverLogBuffer=serverLogsConfig?.enabled===!0?getServerLogBuffer({capacity:serverLogsConfig.capacity??2000,maxLineLength:serverLogsConfig.maxLineLength}):null;if(serverLogBuffer){let transport=new ServerLogTransport(serverLogBuffer);if(logger2.addTransport(transport),Logger.getInstance().addTransport(transport),serverLogsConfig?.captureStdout!==!1)attachStreamCapture(serverLogBuffer);logger2.info(`[ServerLogs] Buffer active (capacity: ${serverLogBuffer.getCapacity()}, stdout capture: ${serverLogsConfig?.captureStdout!==!1})`)}{let{entities:resolvedForBoot,errors:extendErrors,warnings:extendWarnings}=resolveEntities(SYSTEM_TABLES,entities??[],{consumerMode:authentication?.mode==="consumer"});for(let warning of extendWarnings)logger2.warn(warning);let syncErrors=[],syncMappings=resolvedOptions.authentication?.oauth?.profileSync?.mappings??[];if(syncMappings.length>0){let columnsFor=(name2)=>{return(resolvedForBoot.find((t)=>t.table_name===name2)?.columns??[]).map((c)=>c.name)};syncErrors.push(...validateProfileSyncTargets(syncMappings,{users:columnsFor("users"),profiles:columnsFor("profiles")}))}if(extendErrors.length>0||syncErrors.length>0){let detail=[...extendErrors.map((e)=>`  ${e.code}: ${e.message}`),...syncErrors.map((m)=>`  PROFILE_SYNC_TARGET: ${m}`)].join(`
 `);throw Error(`Invalid Nucleus config:
 ${detail}`)}let sensitiveNames=resolvedForBoot.flatMap((e)=>e.columns??[]).filter((c)=>c.sensitive===!0).map((c)=>c.name);{registerSensitiveColumns(sensitiveNames);let redactUnion=[...loggingConfig?.redactKeys||[],...sensitiveColumnNames()];if(logger2.configure({redactKeys:redactUnion}),Logger.getInstance().configure({redactKeys:redactUnion}),sensitiveNames.length>0)logger2.info("[Schema] Sensitive columns registered",{columns:sensitiveNames})}}let requestLogConfig={enabled:loggingConfig?.requests?.enabled!==!1,logArrival:loggingConfig?.requests?.logArrival===!0,includeQuery:loggingConfig?.requests?.includeQuery!==!1,slowThresholdMs:loggingConfig?.requests?.slowThresholdMs??3000,excludePaths:loggingConfig?.requests?.excludePaths??["/health"]},isRequestLogExcluded=(pathname)=>requestLogConfig.excludePaths.some((p)=>p.endsWith("*")?pathname.startsWith(p.slice(0,-1)):pathname===p),envValidation=validateEnvVariables(resolvedOptions);if(!envValidation.valid){for(let error3 of envValidation.errors)logger2.error(`[CONFIG] ${error3.message}`,{field:error3.field,envName:error3.envName});throw Error("Nucleus configuration error: Missing required environment variables. Check logs for details.")}let{resolved:envResolved}=envValidation;{let secretEntries=[["accessToken",envResolved.accessTokenSecret],["refreshToken",envResolved.refreshTokenSecret],["sessionToken",envResolved.sessionTokenSecret]];for(let[name2,value2]of secretEntries)if(value2&&value2.length<32)logger2.warn(`[Security] authentication.${name2}.secret is only ${value2.length} chars \u2014 use at least ${"32"} random bytes.`);let present=secretEntries.map(([,v])=>v).filter((v)=>!!v);if(present.length>1&&new Set(present).size<present.length)logger2.warn("[Security] Two or more of the access/refresh/session token secrets are identical \u2014 use a distinct secret for each.")}let tokenNames={access_token:authentication?.accessToken?.name||"access_token",refresh_token:authentication?.refreshToken?.name||"refresh_token",session_token:authentication?.sessionToken?.name||"session_token"},csrfConfig=resolveCsrfConfig(authentication?.csrf),csrfAuthCookieNames=[tokenNames.session_token,tokenNames.access_token],targetSchemaName=database?.sharedSchema||database?.schemas?.[0]||"main",targetSchema=pgSchema2(targetSchemaName);if(envResolved.databaseUrl)await ensureDatabaseExists(envResolved.databaseUrl,logger2,envResolved.databaseAuthMode);let db=null,dbPool=null,dbAuthMode=envResolved.databaseAuthMode||"password",backgroundIntervals=[],trackInterval=(timer)=>{timer.unref?.(),backgroundIntervals.push(timer)};if(envResolved.databaseUrl){let{Pool:Pool2}=await import("pg"),poolOptions=resolveDbPoolConfig(database?.pool);if(dbAuthMode==="password")dbPool=new Pool2({connectionString:envResolved.databaseUrl,...poolOptions});else{let{getPostgresToken:getPostgresToken2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure));await getPostgresToken2(),dbPool=new Pool2({connectionString:envResolved.databaseUrl,password:getPostgresToken2,ssl:{rejectUnauthorized:!0},...poolOptions}),logger2.info(`[Database] Using Entra ID auth mode: ${dbAuthMode}`)}db=drizzle2(dbPool),dbPool.on("error",(err)=>{logger2.warn("[Database] idle pool client error",{error:err instanceof Error?err.message:String(err)})})}let isMultiTenant=database?.isMultiTenant===!0,tenantRegistry=null,schemaTables={},schemaRelations={},claimsCache=null;if(config.schema){let schemasPath=__require("path").resolve(process.cwd(),config.schema),schemas=__require(schemasPath);schemaTables=schemas.createAllTablesForSchema?schemas.createAllTablesForSchema(targetSchema):{}}if(config.relations){let relationsPath=__require("path").resolve(process.cwd(),config.relations);schemaRelations=__require(relationsPath)}let secretsService=null;if(resolvedOptions.secrets?.enabled){let masterKey=resolveMasterKey(resolvedOptions.secrets.encryptionKey);if(!db)logger2.warn("[Secrets] secrets.enabled=true but no database is configured \u2014 disabled");else if(!masterKey)logger2.error("[Secrets] secrets.enabled=true but no encryption key resolved \u2014 set secrets.encryptionKey or NUCLEUS_SECRETS_KEY. Credential storage is disabled; env and literal values still work.");else if(!schemaTables[SECRETS_TABLE])logger2.error(`[Secrets] secrets.enabled=true but the "${SECRETS_TABLE}" table is missing from the generated schema \u2014 re-run schema generation. Credential storage is disabled.`);else{secretsService=new SecretsService({store:new SecretsStore({db,resolveTable:(tableName)=>schemaTables[tableName],masterKey}),logger:logger2,refreshIntervalMs:resolvedOptions.secrets.refreshIntervalMs,getRedis:()=>getRedisManager()}),logger2.info("[Secrets] Credential store enabled");try{if(await secretsService.refresh(),secretsService.isReady())logger2.info("[Secrets] Credentials preloaded for boot-time resolution",{storedCredentials:secretsService.size()})}catch(error3){logger2.warn("[Secrets] Preload failed \u2014 env and literal values still resolve",{error:error3 instanceof Error?error3.message:String(error3)})}}}let resolveCredential=(scope,key2,configValue)=>{if(secretsService)return secretsService.value(scope,key2,configValue);if(!configValue)return;let fromEnv=process.env[configValue];if(fromEnv)return fromEnv;return/^[A-Z][A-Z0-9_]{2,}$/.test(configValue)?void 0:configValue},resolveRedirectUrl=(value2)=>{if(!value2)return;let fromEnv=process.env[value2];if(fromEnv)return fromEnv;return/^[A-Z][A-Z0-9_]{2,}$/.test(value2)?void 0:value2},withResolvedRedirects=(node,keys)=>{if(!node)return node;let resolved={...node};for(let key2 of keys)if(typeof node[key2]==="string")resolved[key2]=resolveRedirectUrl(node[key2]);return resolved},trustedAppOrigins=()=>{let configured=normalizeTrustedOrigins(resolvedOptions.authentication?.trustedAppOrigins);if(!secretsService)return configured;let resolved=secretsService.listValue("authentication","trustedAppOrigins",configured);return resolved.length>0?resolved:configured},liveOAuthProviders=(resolvedProviders)=>{if(!secretsService)return resolvedProviders;let declared=resolvedOptions.authentication?.oauth?.providers??{},live={};for(let[providerName,providerConfig]of Object.entries(resolvedProviders)){let declaredConfig=declared[providerName]??{},entry={...providerConfig};for(let key2 of["clientId","clientSecret","tenantId","redirectUri"]){let declaredValue=declaredConfig[key2],bootValue=providerConfig[key2];Object.defineProperty(entry,key2,{get:()=>{let resolved=secretsService?.value(`authentication.oauth.providers.${providerName}`,key2,typeof declaredValue==="string"?declaredValue:void 0);if(resolved!==void 0)return resolved;return looksLikeEnvName(typeof bootValue==="string"?bootValue:void 0)?void 0:bootValue},enumerable:!0,configurable:!0})}live[providerName]=entry}return live},storageProvider=null;if(resolvedOptions.storage?.enabled){let storageBase=resolvedOptions.storage.basePath||"./uploads";storageProvider=createStorageProvider({provider:resolvedOptions.storage.provider,basePath:storageBase,smb:resolvedOptions.storage.smb,resolveCredential},{logger:logger2}),setStorageProvider(storageProvider)}let buildStorageProvider=(kind)=>{if(!resolvedOptions.storage?.enabled)return null;return createStorageProvider({provider:kind,basePath:resolvedOptions.storage.basePath||"./uploads",smb:resolvedOptions.storage.smb,resolveCredential:(scope,key2,configValue)=>scope==="storage"&&key2==="provider"?kind:resolveCredential(scope,key2,configValue)},{logger:logger2})};recordSwagger(config.swagger);let systemTables2=config.systemTables||[];publicRoutes=buildPublicRoutes(resolvedOptions,systemTables2,"",targetSchemaName);for(let note of unhonouredIsPublicDeclarations(resolvedOptions))logger2.warn(`[Auth] ${note}`);let unapplied=unappliedSettings(resolvedOptions,config.swagger);if(unapplied.length>0)logger2.warn(`[Config] ${unapplied.length} setting(s) are accepted but do nothing in this build:
   ${unapplied.join(`