@decaf-ts/integrations 0.10.5 → 0.10.8

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="aa047af",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.10.4-aa047af",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.10.4",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
+var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="9f5df0a",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.10.7-9f5df0a",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.10.7",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
 //# sourceMappingURL=integrations.cjs.map

package/lib/cjs/graph/engine/catalog/GraphBuiltInRegistrations.cjs

@@ -2,86 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.builtInGraphNodeRegistrations = builtInGraphNodeRegistrations;
 exports.registerBuiltInGraphNodes = registerBuiltInGraphNodes;
-const index_js_1 = require("./../execution/index.cjs");
-const index_js_2 = require("./../loops/index.cjs");
-const graph_1 = require("@decaf-ts/ui-decorators/graph");
+const index_js_1 = require("./../../nodes/index.cjs");
 const GraphNodeRegistration_js_1 = require("./GraphNodeRegistration.cjs");
-function executorOf(fn) {
-    return { execute: fn };
-}
-function forwardOutput(outputKey, inputKey = "value") {
-    return executorOf((request) => ({
-        [outputKey]: request.inputs[inputKey] ?? request.inputs,
-    }));
-}
-function triggerPayloadExecutor() {
-    return executorOf((request) => ({ payload: request.inputs["payload"] ?? null }));
-}
-function defaultFlowExecutors() {
-    return {
-        "core.flow.map": executorOf((request) => ({
-            result: { mapped: request.inputs["value"] ?? request.inputs },
-        })),
-        "core.flow.delay": forwardOutput("valueOut"),
-        "core.flow.return": forwardOutput("result"),
-        "core.flow.merge": forwardOutput("merged", "values"),
-        "core.flow.if": forwardOutput("then"),
-        "core.flow.parallel": executorOf((request) => ({
-            branches: [request.inputs["value"] ?? request.inputs],
-        })),
-        "core.flow.errorBoundary": forwardOutput("result"),
-        "core.flow.humanApproval": forwardOutput("approved"),
-        "core.flow.break": new index_js_1.BreakGraphNodeExecutor(),
-        "core.agent": executorOf((request) => ({
-            response: `[Agent response] ${String(request.inputs["prompt"] ?? "")}`,
-            actions: [],
-        })),
-    };
-}
-function defaultTriggerExecutors() {
+function executorOf(nodeClass) {
     return {
-        "core.trigger.manual": triggerPayloadExecutor(),
-        "core.trigger.webhook": triggerPayloadExecutor(),
-        "core.trigger.schedule": triggerPayloadExecutor(),
-        "core.trigger.event": triggerPayloadExecutor(),
-        "core.trigger.form": triggerPayloadExecutor(),
-        "core.trigger.chat": executorOf((request) => ({
-            message: request.inputs["message"] ?? null,
-            sessionId: request.inputs["sessionId"] ?? null,
-            userId: request.inputs["userId"] ?? null,
-        })),
-    };
-}
-function engineBoundExecutors(engine) {
-    return {
-        "core.flow.code": new index_js_1.CodeGraphNodeExecutor(engine),
-        "core.flow.log": new index_js_1.LogGraphNodeExecutor(),
-        "core.utility.log": new index_js_1.LogGraphNodeExecutor(),
-        "core.flow.switch": new index_js_1.SwitchGraphNodeExecutor(engine),
-        "core.loop.foreach": new index_js_2.ForeachGraphNodeExecutor(engine),
-        "core.loop.while": new index_js_2.WhileGraphNodeExecutor(engine),
-        "core.loop.until": new index_js_2.UntilGraphNodeExecutor(engine),
+        execute: (request, context) => nodeClass.execute(request, context),
     };
 }
 /**
  * Builds the built-in node registrations (DECAF-50 §4.12): every built-in
- * manifest from {@link GRAPH_BUILT_IN_NODE_MANIFESTS_BY_KIND} that has a
- * default executor, paired with that executor as a
- * {@link GraphNodeRegistration}. Engine-bound executors (loops, switch) are
- * only included when an `engine` is provided.
+ * manifest from {@link GRAPH_BUILT_IN_NODE_MANIFESTS_BY_KIND} paired with the
+ * executor derived from its authoritative backend node class.
  */
-function builtInGraphNodeRegistrations(engine) {
-    const executors = {
-        ...defaultTriggerExecutors(),
-        ...defaultFlowExecutors(),
-        ...(engine ? engineBoundExecutors(engine) : {}),
-    };
+function builtInGraphNodeRegistrations() {
     const registrations = [];
-    for (const [kind, manifest] of Object.entries(graph_1.GRAPH_BUILT_IN_NODE_MANIFESTS_BY_KIND)) {
-        const executor = executors[kind];
-        if (!executor)
+    for (const [kind, manifest] of Object.entries(index_js_1.GRAPH_BUILT_IN_NODE_MANIFESTS_BY_KIND)) {
+        const nodeClass = index_js_1.GRAPH_BUILT_IN_NODE_CLASSES_BY_KIND[kind];
+        if (!nodeClass)
             continue;
-        registrations.push((0, GraphNodeRegistration_js_1.defineGraphNode)({ manifest, executor }));
+        registrations.push((0, GraphNodeRegistration_js_1.defineGraphNode)({ manifest, executor: executorOf(nodeClass) }));
     }
     return registrations;
 }
@@ -90,8 +29,8 @@ function builtInGraphNodeRegistrations(engine) {
  * {@link builtInGraphNodeRegistrations}) into the given
  * {@link GraphNodeCatalogue} and returns it for chaining.
  */
-function registerBuiltInGraphNodes(catalogue, engine) {
-    for (const registration of builtInGraphNodeRegistrations(engine)) {
+function registerBuiltInGraphNodes(catalogue) {
+    for (const registration of builtInGraphNodeRegistrations()) {
         catalogue.register(registration);
     }
     return catalogue;

package/lib/cjs/graph/engine/catalog/GraphBuiltInRegistrations.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graph/engine/catalog/GraphBuiltInRegistrations.cjs","sourceRoot":"","sources":["graph/engine/catalog/GraphBuiltInRegistrations.js"],"names":[],"mappings":";;AAoEA,sEAcC;AAMD,8DAKC;AA7FD,sDAAwI;AACxI,kDAAgH;AAChH,yDAAsF;AACtF,yEAA8D;AAC9D,SAAS,UAAU,CAAC,EAAE;IAClB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AACD,SAAS,aAAa,CAAC,SAAS,EAAE,QAAQ,GAAG,OAAO;IAChD,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM;KAC1D,CAAC,CAAC,CAAC;AACR,CAAC;AACD,SAAS,sBAAsB;IAC3B,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC;AACD,SAAS,oBAAoB;IACzB,OAAO;QACH,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE;SAChE,CAAC,CAAC;QACH,iBAAiB,EAAE,aAAa,CAAC,UAAU,CAAC;QAC5C,kBAAkB,EAAE,aAAa,CAAC,QAAQ,CAAC;QAC3C,iBAAiB,EAAE,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACpD,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;QACrC,oBAAoB,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;SACxD,CAAC,CAAC;QACH,yBAAyB,EAAE,aAAa,CAAC,QAAQ,CAAC;QAClD,yBAAyB,EAAE,aAAa,CAAC,UAAU,CAAC;QACpD,iBAAiB,EAAE,IAAI,iCAAsB,EAAE;QAC/C,YAAY,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnC,QAAQ,EAAE,oBAAoB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE;YACtE,OAAO,EAAE,EAAE;SACd,CAAC,CAAC;KACN,CAAC;AACN,CAAC;AACD,SAAS,uBAAuB;IAC5B,OAAO;QACH,qBAAqB,EAAE,sBAAsB,EAAE;QAC/C,sBAAsB,EAAE,sBAAsB,EAAE;QAChD,uBAAuB,EAAE,sBAAsB,EAAE;QACjD,oBAAoB,EAAE,sBAAsB,EAAE;QAC9C,mBAAmB,EAAE,sBAAsB,EAAE;QAC7C,mBAAmB,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI;YAC1C,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI;YAC9C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI;SAC3C,CAAC,CAAC;KACN,CAAC;AACN,CAAC;AACD,SAAS,oBAAoB,CAAC,MAAM;IAChC,OAAO;QACH,gBAAgB,EAAE,IAAI,gCAAqB,CAAC,MAAM,CAAC;QACnD,eAAe,EAAE,IAAI,+BAAoB,EAAE;QAC3C,kBAAkB,EAAE,IAAI,+BAAoB,EAAE;QAC9C,kBAAkB,EAAE,IAAI,kCAAuB,CAAC,MAAM,CAAC;QACvD,mBAAmB,EAAE,IAAI,mCAAwB,CAAC,MAAM,CAAC;QACzD,iBAAiB,EAAE,IAAI,iCAAsB,CAAC,MAAM,CAAC;QACrD,iBAAiB,EAAE,IAAI,iCAAsB,CAAC,MAAM,CAAC;KACxD,CAAC;AACN,CAAC;AACD;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,MAAM;IAChD,MAAM,SAAS,GAAG;QACd,GAAG,uBAAuB,EAAE;QAC5B,GAAG,oBAAoB,EAAE;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IACF,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6CAAqC,CAAC,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ;YACT,SAAS;QACb,aAAa,CAAC,IAAI,CAAC,IAAA,0CAAe,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,aAAa,CAAC;AACzB,CAAC;AACD;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM;IACvD,KAAK,MAAM,YAAY,IAAI,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AACD,qDAAqD"}
+{"version":3,"file":"graph/engine/catalog/GraphBuiltInRegistrations.cjs","sourceRoot":"","sources":["graph/engine/catalog/GraphBuiltInRegistrations.js"],"names":[],"mappings":";;AAYA,sEASC;AAMD,8DAKC;AAhCD,qDAAqH;AACrH,yEAA8D;AAC9D,SAAS,UAAU,CAAC,SAAS;IACzB,OAAO;QACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;KACrE,CAAC;AACN,CAAC;AACD;;;;GAIG;AACH,SAAgB,6BAA6B;IACzC,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gDAAqC,CAAC,EAAE,CAAC;QACnF,MAAM,SAAS,GAAG,8CAAmC,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS;YACV,SAAS;QACb,aAAa,CAAC,IAAI,CAAC,IAAA,0CAAe,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,aAAa,CAAC;AACzB,CAAC;AACD;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,SAAS;IAC/C,KAAK,MAAM,YAAY,IAAI,6BAA6B,EAAE,EAAE,CAAC;QACzD,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AACD,qDAAqD"}

package/lib/cjs/graph/engine/execution/GraphExecutionContext.cjs

@@ -37,8 +37,11 @@ class GraphExecutionContext extends core_1.Context {
      * @param path - Dotted path from the workflow root to this node.
      * @param emitFn - Callback invoked when an event is emitted from this context.
      * @param metadata - Free-form metadata attached to this context.
+     * @param engine - The owning execution engine, exposed to node classes
+     *   whose `execute` needs engine-level services (nested workflow
+     *   execution, code sandbox evaluation).
      */
-    constructor(runId, parentRunId, workflowId, document, node, manifest, path, emitFn, metadata = {}) {
+    constructor(runId, parentRunId, workflowId, document, node, manifest, path, emitFn, metadata = {}, engine) {
         super();
         this.runId = runId;
         this.parentRunId = parentRunId;
@@ -49,6 +52,7 @@ class GraphExecutionContext extends core_1.Context {
         this.path = path;
         this.emitFn = emitFn;
         this.metadata = metadata;
+        this.engine = engine;
         const user = typeof metadata?.["user"] === "string" ? metadata["user"] : null;
         this.runLogger = new GraphRunLogger_js_1.GraphRunLogger({
             runId,

package/lib/cjs/graph/engine/execution/GraphExecutionContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graph/engine/execution/GraphExecutionContext.cjs","sourceRoot":"","sources":["graph/engine/execution/GraphExecutionContext.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,yCAAyC;AACzC,yDAAwE;AACxE,qEAA+D;AAC/D;;;;;;;;GAQG;AACH,MAAa,qBAAsB,SAAQ,cAAO;IAC9C;;;;;;;;;;OAUG;IACH,YAAY,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE;QAC7F,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,IAAI,CAAC,SAAS,GAAG,IAAI,kCAAc,CAAC;YAChC,KAAK;YACL,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IACD;;;;;OAKG;IACH,IAAI,MAAM;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAK;QACZ,MAAM,IAAI,CAAC,MAAM,CAAC;YACd,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;SAChC,CAAC,CAAC;IACP,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAO;QAClB,MAAM,IAAI,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,+BAAuB,CAAC,WAAW;YACzC,OAAO;SACV,CAAC,CAAC;IACP,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO;QACtB,MAAM,IAAI,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,+BAAuB,CAAC,WAAW;YACzC,OAAO,EAAE;gBACL,OAAO;gBACP,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;CACJ;AAhFD,sDAgFC;AACD,iDAAiD"}
+{"version":3,"file":"graph/engine/execution/GraphExecutionContext.cjs","sourceRoot":"","sources":["graph/engine/execution/GraphExecutionContext.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,yCAAyC;AACzC,yDAAwE;AACxE,qEAA+D;AAC/D;;;;;;;;GAQG;AACH,MAAa,qBAAsB,SAAQ,cAAO;IAC9C;;;;;;;;;;;;;OAaG;IACH,YAAY,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM;QACrG,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,IAAI,CAAC,SAAS,GAAG,IAAI,kCAAc,CAAC;YAChC,KAAK;YACL,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IACD;;;;;OAKG;IACH,IAAI,MAAM;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAK;QACZ,MAAM,IAAI,CAAC,MAAM,CAAC;YACd,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;SAChC,CAAC,CAAC;IACP,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAO;QAClB,MAAM,IAAI,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,+BAAuB,CAAC,WAAW;YACzC,OAAO;SACV,CAAC,CAAC;IACP,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO;QACtB,MAAM,IAAI,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,+BAAuB,CAAC,WAAW;YACzC,OAAO,EAAE;gBACL,OAAO;gBACP,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;CACJ;AApFD,sDAoFC;AACD,iDAAiD"}

package/lib/cjs/graph/engine/execution/GraphExecutionEngine.cjs

@@ -292,6 +292,10 @@ class GraphExecutionEngine {
      */
     async executeNode(frame, plan, planNode, opts, emitFn) {
         this.assertNotAborted(opts);
+        if (!this.isNodeActivated(frame, plan, planNode)) {
+            await this.skipInactiveNode(frame, plan, planNode, opts);
+            return;
+        }
         if (planNode.instance.disabled === true) {
             await this.executeDisabledNode(frame, plan, planNode, opts);
             return;
@@ -350,7 +354,7 @@ class GraphExecutionEngine {
             }
         }
         try {
-            const context = new GraphExecutionContext_js_1.GraphExecutionContext(frame.runId, opts.parentRunId, plan.workflowId, plan.resolved.document, planNode.instance, planNode.manifest, nodePath, emitFn, opts.metadata);
+            const context = new GraphExecutionContext_js_1.GraphExecutionContext(frame.runId, opts.parentRunId, plan.workflowId, plan.resolved.document, planNode.instance, planNode.manifest, nodePath, emitFn, opts.metadata, this);
             const request = {
                 nodeId: planNode.id,
                 kind: planNode.kind,
@@ -412,6 +416,52 @@ class GraphExecutionEngine {
                 throw error;
         }
     }
+    /**
+     * Resolves whether a plan node is activated for execution under the
+     * DECAF-50 §4.9 branch semantics. A node with no incoming data edges is
+     * a root/source node and always runs. A node fed by one or more data
+     * edges runs only when at least one of those edges was activated by a
+     * routed upstream output port — a branch the upstream switch (or any
+     * partial-output node) did not select leaves its downstream edges
+     * unactivated, so the branch is never executed. Workflow-boundary edges
+     * are active from the start because workflow inputs are seeded before
+     * execution begins.
+     */
+    isNodeActivated(frame, plan, planNode) {
+        const incoming = (plan.incomingByNode.get(planNode.id) ?? []).filter((edge) => edge.type === "data");
+        if (incoming.length === 0)
+            return true;
+        return incoming.some((edge) => edge.sourceNodeId === constants_js_1.GRAPH_WORKFLOW_BOUNDARY ||
+            frame.isDataEdgeActive(edge.id));
+    }
+    /**
+     * Skips a node whose incoming data edges were all left unactivated by an
+     * upstream branch selection. The node is not executed and its outputs are
+     * never routed or collected into workflow outputs (DECAF-50 §4.9).
+     */
+    async skipInactiveNode(frame, plan, planNode, opts) {
+        const startedAt = new Date();
+        const nodePath = [...(opts.path ?? []), planNode.id];
+        await this.emitEvent(frame, {
+            type: graph_1.GraphExecutionEventType.NODE_SKIPPED,
+            runId: frame.runId,
+            workflowId: plan.workflowId,
+            nodeId: planNode.id,
+            path: nodePath,
+            status: graph_1.GraphExecutionStatus.SKIPPED,
+            payload: { reason: "branchNotSelected" },
+        });
+        const result = {
+            nodeId: planNode.id,
+            status: graph_1.GraphExecutionStatus.SKIPPED,
+            inputs: {},
+            startedAt,
+            finishedAt: new Date(),
+            events: [],
+        };
+        frame.recordNodeResult(result);
+        this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.SKIPPED, graph_1.GraphExecutionStatus.SKIPPED);
+    }
     /**
      * Applies the explicit disabled-node semantics (§4.9):
      * `skip`, `passThroughFirstInput`, or `emitDefaults`, resolved from the
@@ -653,11 +703,26 @@ class GraphExecutionEngine {
     /**
      * Routes a node's outputs to downstream inputs and workflow outputs along
      * data edges (connection edges are structural and never route values).
+     *
+     * An edge is traversed only when the source node actually emitted the
+     * edge's `sourcePort` (DECAF-50 §4.9 branch semantics). A node that
+     * emitted a subset of its declared outputs — e.g. a switch that selected
+     * one case — therefore activates only the downstream branch edges of the
+     * emitted ports; unselected branch edges are left unactivated, so their
+     * downstream nodes are skipped and never contribute to workflow outputs.
+     * Emitting an output port explicitly with `undefined` still counts as
+     * activated (the port was produced by the executor).
      */
     routeOutgoingEdges(frame, plan, planNode, outputs) {
         const outgoing = (plan.outgoingByNode.get(planNode.id) ?? []).filter((edge) => edge.type === "data");
         for (const edge of outgoing) {
+            if (!Object.prototype.hasOwnProperty.call(outputs, edge.sourcePort)) {
+                // The source node did not emit this output port: the edge's branch
+                // was not selected, so no value is routed.
+                continue;
+            }
             const value = outputs[edge.sourcePort];
+            frame.activateDataEdge(edge.id);
             if (edge.targetNodeId === constants_js_1.GRAPH_WORKFLOW_BOUNDARY) {
                 frame.valueStore.setWorkflowOutput(edge.targetPort, value);
             }