@decaf-ts/integrations 0.10.5 → 0.11.0

package/dist/integrations.js

@@ -1,2 +1,2 @@
-import{exec as e}from"child_process";import{LogLevel as t,LoggedEnvironment as i}from"@decaf-ts/logging";import{InternalError as r,NotFoundError as n}from"@decaf-ts/db-decorators";import{Cascade as s,ModelService as o,pk as a,uuid as d,manyToOne as p,column as c,createdAt as y,updatedAt as l,table as u,unique as g,oneToMany as h,transactional as m,AuthorizationError as f,BaseModel as v,repository as w,service as b,Repository as S,Condition as A}from"@decaf-ts/core";export{AuthorizationError,transactional}from"@decaf-ts/core";import{Model as O,required as I,type as _,option as j,model as U}from"@decaf-ts/decorator-validation";import{__decorate as P,__metadata as K}from"tslib";import{Metadata as k,metadata as F,methodMetadata as R,propMetadata as T}from"@decaf-ts/decoration";async function x(i,n,s,o=t.info){return s.debug("Executing: "+i),new Promise((t,a)=>{const d=e(i,n),p=[],c=[];d.stdout?.on("data",e=>{p.push(e),s[o](e.trim())}),d.stderr?.on("data",e=>{c.push(e),s.debug(e.trim())}),d.on("close",e=>{0===e?(s.silly("Command completed successfully"),t({stdout:p.join("\n"),stderr:c.join("\n")})):(s.critical(`Command failed with code ${e}:\n ${c.join("\n")}`),a(new r(`Command failed with code ${e}: ${c.join("\n")}`)))}),d.on("error",e=>{s.critical("Command execution error",e),a(e)})})}var B,D,C,G,E,N,$,L;(e=>{e.Pooled="pooled",e.Bridge="bridge",e.Silo="silo"})(B||(B={})),(e=>{e.Invited="invited",e.Active="active",e.Suspended="suspended",e.Removed="removed"})(D||(D={})),(e=>{e.User="user",e.Group="group",e.ServiceAccount="service_account",e.Agent="agent",e.ApiKey="api_key"})(C||(C={})),(e=>{e.Tenant="tenant",e.OrgUnit="org_unit",e.Resource="resource"})(G||(G={})),(e=>{e.Admin="admin",e.ContentRead="content_read",e.ContentWrite="content_write",e.Memory="memory",e.Graph="graph",e.Vector="vector",e.Export="export",e.Billing="billing",e.Audit="audit",e.Security="security",e.Data="data",e.Automation="automation"})(E||(E={})),(e=>{e.Private="private",e.ResourceAcl="resource_acl",e.OrgUnit="org_unit",e.OrgSubtree="org_subtree",e.Tenant="tenant"})(N||(N={})),(e=>{e.Postgres="postgres",e.Arango="arango",e.Qdrant="qdrant",e.ObjectStorage="object_storage"})($||($={})),(e=>{e.Shared="shared",e.Dedicated="dedicated"})(L||(L={}));const z=Object.values(B),M=Object.values(D),q=Object.values(C),W=Object.values(G),V=Object.values(E),Z=Object.values(N),Q=Object.values($),J=Object.values(L),H={update:s.NONE,delete:s.NONE,nullable:!1},X={update:s.NONE,delete:s.NONE,nullable:!0},Y={update:s.CASCADE,delete:s.CASCADE,nullable:!1},ee={update:s.CASCADE,delete:s.NONE,nullable:!1};function te(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function ie(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function re(e,t){return`${e}:${t}`}function ne(){return new Date}function se(e){return e??[]}function oe(e,t){return ue(e)===t}function ae(e,t){return!!t&&ue(e)===t}function de(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function pe(e,t,i){const r=e??new Date;return!(t&&t>r||i&&r>i)}function ce(e){const t={},i={};for(const r of e.permissions){const e=re(r.scopeKind,r.scopeId);t[e]=t[e]??[],t[e].push(r.permissionKey),r.scopeKind===G.OrgUnit&&(i[r.permissionKey]=i[r.permissionKey]??[],i[r.permissionKey].push(r.scopeId))}return{tenantId:e.tenantId,principalId:e.principalId,permissionsByScope:t,allowedOrgUnitIdsByPermission:i,resourceGrants:e.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class ye extends o{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...i){const r=await this.repo.read(e,...i);return this.repo.update(Object.assign(r,t),...i)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...i){return this.repo.findOneBy(e,t,...i)}async findManyBy(e,t,...i){return this.repo.select().where({[e]:t}).execute(...i)}async listAll(...e){return this.repo.select().execute(...e)}}function le(){return crypto.randomUUID()}function ue(e){return"string"==typeof e?e:e.id}class ge extends O{constructor(e){super(e)}}let he=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],he.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_tenant_memberships_tenant"),I(),K("design:type",Object)],he.prototype,"tenant",void 0),P([p(()=>me,Y,!1,void 0,"fk_tenant_memberships_user"),I(),K("design:type",Object)],he.prototype,"user",void 0),P([I(),_(String),j(M),c(),K("design:type",String)],he.prototype,"status",void 0),P([y(),K("design:type",Date)],he.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],he.prototype,"updatedAt",void 0),he=P([u("tenant_memberships"),U(),K("design:paramtypes",[Object])],he);let me=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],me.prototype,"id",void 0),P([g(),_(String),c(),K("design:type",String)],me.prototype,"email",void 0),P([g(),_(String),c(),K("design:type",String)],me.prototype,"phone",void 0),P([I(),_(String),c(),K("design:type",String)],me.prototype,"displayName",void 0),P([h(()=>he,H,!1),K("design:type",Array)],me.prototype,"tenantMemberships",void 0),P([h(()=>fe,H,!1),K("design:type",Array)],me.prototype,"orgUnitMemberships",void 0),P([y(),K("design:type",Date)],me.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],me.prototype,"updatedAt",void 0),me=P([u("users"),U(),K("design:paramtypes",[Object])],me);let fe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],fe.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_org_memberships_tenant"),I(),K("design:type",Object)],fe.prototype,"tenant",void 0),P([p(()=>Ue,Y,!1,void 0,"fk_org_memberships_org_unit"),I(),K("design:type",Object)],fe.prototype,"orgUnit",void 0),P([p(()=>me,H,!1,void 0,"fk_org_memberships_user"),I(),K("design:type",Object)],fe.prototype,"user",void 0),P([I(),_(String),j(M),c(),K("design:type",String)],fe.prototype,"status",void 0),P([y(),K("design:type",Date)],fe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],fe.prototype,"updatedAt",void 0),fe=P([u("org_unit_memberships"),U(),K("design:paramtypes",[Object])],fe);let ve=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],ve.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_org_closure_tenant"),I(),K("design:type",Object)],ve.prototype,"tenant",void 0),P([p(()=>Ue,Y,!1,void 0,"fk_org_closure_ancestor"),I(),K("design:type",Object)],ve.prototype,"ancestor",void 0),P([p(()=>Ue,Y,!1,void 0,"fk_org_closure_descendant"),I(),K("design:type",Object)],ve.prototype,"descendant",void 0),P([I(),_(Number),c(),K("design:type",Number)],ve.prototype,"depth",void 0),P([y(),K("design:type",Date)],ve.prototype,"createdAt",void 0),ve=P([u("org_unit_closure"),U(),K("design:paramtypes",[Object])],ve);let we=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],we.prototype,"id",void 0),P([g(),I(),_(String),c(),K("design:type",String)],we.prototype,"key",void 0),P([I(),_(String),j(V),c(),K("design:type",String)],we.prototype,"category",void 0),P([_(String),c(),K("design:type",String)],we.prototype,"description",void 0),P([h(()=>be,H,!1),K("design:type",Array)],we.prototype,"rolePermissions",void 0),we=P([u("permissions"),U(),K("design:paramtypes",[Object])],we);let be=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],be.prototype,"id",void 0),P([p(()=>Se,Y,!1,void 0,"fk_role_permissions_role"),I(),K("design:type",Object)],be.prototype,"role",void 0),P([p(()=>we,Y,!1,void 0,"fk_role_permissions_permission"),I(),K("design:type",Object)],be.prototype,"permission",void 0),P([y(),K("design:type",Date)],be.prototype,"createdAt",void 0),be=P([u("role_permissions"),U(),K("design:paramtypes",[Object])],be);let Se=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Se.prototype,"id",void 0),P([p(()=>Ke,X,!1,void 0,"fk_roles_tenant"),K("design:type",Object)],Se.prototype,"tenant",void 0),P([I(),_(String),c(),K("design:type",String)],Se.prototype,"key",void 0),P([I(),_(String),c(),K("design:type",String)],Se.prototype,"name",void 0),P([_(String),c(),K("design:type",String)],Se.prototype,"description",void 0),P([_(Object),c(),K("design:type",Object)],Se.prototype,"metadata",void 0),P([h(()=>be,H,!1),K("design:type",Array)],Se.prototype,"rolePermissions",void 0),P([h(()=>Ae,H,!1),K("design:type",Array)],Se.prototype,"assignments",void 0),P([y(),K("design:type",Date)],Se.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Se.prototype,"updatedAt",void 0),Se=P([u("roles"),U(),K("design:paramtypes",[Object])],Se);let Ae=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ae.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_role_assignments_tenant"),I(),K("design:type",Object)],Ae.prototype,"tenant",void 0),P([p(()=>Ie,Y,!1,void 0,"fk_role_assignments_principal"),I(),K("design:type",Object)],Ae.prototype,"principal",void 0),P([p(()=>Se,H,!1,void 0,"fk_role_assignments_role"),I(),K("design:type",Object)],Ae.prototype,"role",void 0),P([I(),_(String),j(W),c(),K("design:type",String)],Ae.prototype,"scopeKind",void 0),P([I(),_(String),c(),K("design:type",String)],Ae.prototype,"scopeId",void 0),P([I(),_(Boolean),c(),K("design:type",Boolean)],Ae.prototype,"inheritDown",void 0),P([c(),K("design:type",Date)],Ae.prototype,"startsAt",void 0),P([c(),K("design:type",Date)],Ae.prototype,"expiresAt",void 0),P([_(Object),c(),K("design:type",Object)],Ae.prototype,"conditions",void 0),P([y(),K("design:type",Date)],Ae.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ae.prototype,"updatedAt",void 0),Ae=P([u("role_assignments"),U(),K("design:paramtypes",[Object])],Ae);let Oe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Oe.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_resource_grants_tenant"),I(),K("design:type",Object)],Oe.prototype,"tenant",void 0),P([p(()=>_e,Y,!1,void 0,"fk_resource_grants_resource"),I(),K("design:type",Object)],Oe.prototype,"resource",void 0),P([p(()=>Ie,Y,!1,void 0,"fk_resource_grants_principal"),I(),K("design:type",Object)],Oe.prototype,"principal",void 0),P([I(),_(String),c(),K("design:type",String)],Oe.prototype,"permissionKey",void 0),P([c(),K("design:type",Date)],Oe.prototype,"startsAt",void 0),P([c(),K("design:type",Date)],Oe.prototype,"expiresAt",void 0),P([_(Object),c(),K("design:type",Object)],Oe.prototype,"conditions",void 0),P([p(()=>Ie,H,!1,void 0,"fk_resource_grants_created_by"),K("design:type",Object)],Oe.prototype,"createdBy",void 0),P([y(),K("design:type",Date)],Oe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Oe.prototype,"updatedAt",void 0),Oe=P([u("resource_grants"),U(),K("design:paramtypes",[Object])],Oe);let Ie=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ie.prototype,"id",void 0),P([p(()=>Ke,H,!1,void 0,"fk_principals_tenant"),I(),K("design:type",Object)],Ie.prototype,"tenant",void 0),P([I(),_(String),j(q),c(),K("design:type",String)],Ie.prototype,"kind",void 0),P([I(),_(String),c(),K("design:type",String)],Ie.prototype,"subjectId",void 0),P([h(()=>Ae,H,!1),K("design:type",Array)],Ie.prototype,"roleAssignments",void 0),P([h(()=>Oe,H,!1),K("design:type",Array)],Ie.prototype,"resourceGrants",void 0),P([y(),K("design:type",Date)],Ie.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ie.prototype,"updatedAt",void 0),Ie=P([u("principals"),U(),K("design:paramtypes",[Object])],Ie);let _e=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],_e.prototype,"id",void 0),P([p(()=>Ke,H,!1,void 0,"fk_protected_resources_tenant"),I(),K("design:type",Object)],_e.prototype,"tenant",void 0),P([p(()=>Ue,H,!1,void 0,"fk_protected_resources_org_unit"),I(),K("design:type",Object)],_e.prototype,"orgUnit",void 0),P([I(),_(String),c(),K("design:type",String)],_e.prototype,"resourceType",void 0),P([I(),_(String),c(),K("design:type",String)],_e.prototype,"resourceId",void 0),P([I(),_(String),j(Z),c(),K("design:type",String)],_e.prototype,"visibility",void 0),P([p(()=>Ie,X,!1,void 0,"fk_protected_resources_owner"),K("design:type",Object)],_e.prototype,"owner",void 0),P([_(String),c(),K("design:type",String)],_e.prototype,"sensitivity",void 0),P([_(Object),c(),K("design:type",Object)],_e.prototype,"metadata",void 0),P([h(()=>Oe,H,!1),K("design:type",Array)],_e.prototype,"grants",void 0),P([y(),K("design:type",Date)],_e.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],_e.prototype,"updatedAt",void 0),_e=P([u("protected_resources"),U(),K("design:paramtypes",[Object])],_e);let je=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],je.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_inheritance_blocks_tenant"),I(),K("design:type",Object)],je.prototype,"tenant",void 0),P([p(()=>Ue,Y,!1,void 0,"fk_inheritance_blocks_org_unit"),I(),K("design:type",Object)],je.prototype,"orgUnit",void 0),P([p(()=>Ue,X,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),K("design:type",Object)],je.prototype,"blockedFromAncestor",void 0),P([I(),_(String),j(V),c(),K("design:type",String)],je.prototype,"permissionCategory",void 0),P([_(String),c(),K("design:type",String)],je.prototype,"reason",void 0),P([y(),K("design:type",Date)],je.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],je.prototype,"updatedAt",void 0),je=P([u("inheritance_blocks"),U(),K("design:paramtypes",[Object])],je);let Ue=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ue.prototype,"id",void 0),P([p(()=>Ke,H,!1,void 0,"fk_org_units_tenant"),I(),K("design:type",Object)],Ue.prototype,"tenant",void 0),P([p(()=>Ue,H,!1,void 0,"fk_org_units_parent"),K("design:type",Object)],Ue.prototype,"parent",void 0),P([h(()=>Ue,H,!1),K("design:type",Array)],Ue.prototype,"children",void 0),P([I(),_(String),c(),K("design:type",String)],Ue.prototype,"name",void 0),P([I(),_(String),c(),K("design:type",String)],Ue.prototype,"path",void 0),P([_(Object),c(),K("design:type",Object)],Ue.prototype,"metadata",void 0),P([h(()=>fe,H,!1),K("design:type",Array)],Ue.prototype,"memberships",void 0),P([h(()=>_e,H,!1),K("design:type",Array)],Ue.prototype,"resources",void 0),P([h(()=>je,H,!1),K("design:type",Array)],Ue.prototype,"inheritanceBlocks",void 0),P([h(()=>ve,H,!1),K("design:type",Array)],Ue.prototype,"ancestorLinks",void 0),P([h(()=>ve,H,!1),K("design:type",Array)],Ue.prototype,"descendantLinks",void 0),P([y(),K("design:type",Date)],Ue.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ue.prototype,"updatedAt",void 0),Ue=P([u("org_units"),U(),K("design:paramtypes",[Object])],Ue);let Pe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Pe.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_storage_bindings_tenant"),I(),K("design:type",Object)],Pe.prototype,"tenant",void 0),P([I(),_(String),j(Q),c(),K("design:type",String)],Pe.prototype,"storageKind",void 0),P([I(),_(String),j(J),c(),K("design:type",String)],Pe.prototype,"bindingKind",void 0),P([I(),_(String),c(),K("design:type",String)],Pe.prototype,"bindingKey",void 0),P([I(),_(String),c(),K("design:type",String)],Pe.prototype,"region",void 0),P([_(Object),c(),K("design:type",Object)],Pe.prototype,"config",void 0),P([y(),K("design:type",Date)],Pe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Pe.prototype,"updatedAt",void 0),Pe=P([u("storage_bindings"),U(),K("design:paramtypes",[Object])],Pe);let Ke=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ke.prototype,"id",void 0),P([g(),I(),_(String),c(),K("design:type",String)],Ke.prototype,"slug",void 0),P([I(),_(String),c(),K("design:type",String)],Ke.prototype,"name",void 0),P([I(),_(String),j(z),c(),K("design:type",String)],Ke.prototype,"isolationTier",void 0),P([h(()=>Ue,H,!1),K("design:type",Array)],Ke.prototype,"orgUnits",void 0),P([h(()=>he,H,!1),K("design:type",Array)],Ke.prototype,"memberships",void 0),P([h(()=>Ie,H,!1),K("design:type",Array)],Ke.prototype,"principals",void 0),P([h(()=>Pe,H,!1),K("design:type",Array)],Ke.prototype,"storageBindings",void 0),P([y(),K("design:type",Date)],Ke.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ke.prototype,"updatedAt",void 0),Ke=P([u("tenants"),U(),K("design:paramtypes",[Object])],Ke);let ke=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],ke.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_tenant_profiles_tenant"),I(),K("design:type",Object)],ke.prototype,"tenant",void 0),P([I(),_(String),c(),K("design:type",String)],ke.prototype,"profileKey",void 0),P([_(Object),c(),K("design:type",Object)],ke.prototype,"metadata",void 0),P([y(),K("design:type",Date)],ke.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],ke.prototype,"updatedAt",void 0),ke=P([u("tenant_profiles"),U(),K("design:paramtypes",[Object])],ke);let Fe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Fe.prototype,"id",void 0),P([p(()=>Ue,Y,!1,void 0,"fk_org_unit_profiles_org_unit"),I(),K("design:type",Object)],Fe.prototype,"orgUnit",void 0),P([I(),_(String),c(),K("design:type",String)],Fe.prototype,"profileKey",void 0),P([_(Object),c(),K("design:type",Object)],Fe.prototype,"metadata",void 0),P([y(),K("design:type",Date)],Fe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Fe.prototype,"updatedAt",void 0),Fe=P([u("org_unit_profiles"),U(),K("design:paramtypes",[Object])],Fe);let Re=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Re.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_group_memberships_tenant"),I(),K("design:type",Object)],Re.prototype,"tenant",void 0),P([p(()=>Te,Y,!1,void 0,"fk_group_memberships_group"),I(),K("design:type",Object)],Re.prototype,"group",void 0),P([p(()=>Ie,Y,!1,void 0,"fk_group_memberships_principal"),I(),K("design:type",Object)],Re.prototype,"principal",void 0),P([_(Object),c(),K("design:type",Object)],Re.prototype,"metadata",void 0),P([y(),K("design:type",Date)],Re.prototype,"createdAt",void 0),Re=P([u("group_memberships"),U(),K("design:paramtypes",[Object])],Re);let Te=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Te.prototype,"id",void 0),P([p(()=>Ke,H,!1,void 0,"fk_groups_tenant"),I(),K("design:type",Object)],Te.prototype,"tenant",void 0),P([p(()=>Ue,X,!1,void 0,"fk_groups_org_unit"),K("design:type",Object)],Te.prototype,"orgUnit",void 0),P([I(),_(String),c(),K("design:type",String)],Te.prototype,"name",void 0),P([_(Object),c(),K("design:type",Object)],Te.prototype,"metadata",void 0),P([h(()=>Re,H,!1),K("design:type",Array)],Te.prototype,"members",void 0),P([y(),K("design:type",Date)],Te.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Te.prototype,"updatedAt",void 0),Te=P([u("groups"),U(),K("design:paramtypes",[Object])],Te);let xe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],xe.prototype,"id",void 0),P([p(()=>Ke,Y,!1,void 0,"fk_effective_permissions_tenant"),I(),K("design:type",Object)],xe.prototype,"tenant",void 0),P([p(()=>Ie,Y,!1,void 0,"fk_effective_permissions_principal"),I(),K("design:type",Object)],xe.prototype,"principal",void 0),P([I(),_(String),c(),K("design:type",String)],xe.prototype,"permissionKey",void 0),P([I(),_(String),j(W),c(),K("design:type",String)],xe.prototype,"scopeKind",void 0),P([I(),_(String),c(),K("design:type",String)],xe.prototype,"scopeId",void 0),P([I(),_(String),c(),K("design:type",String)],xe.prototype,"sourceKind",void 0),P([I(),_(String),c(),K("design:type",String)],xe.prototype,"sourceId",void 0),P([c(),K("design:type",Date)],xe.prototype,"startsAt",void 0),P([c(),K("design:type",Date)],xe.prototype,"expiresAt",void 0),P([y(),K("design:type",Date)],xe.prototype,"createdAt",void 0),xe=P([u("effective_permissions"),U(),K("design:paramtypes",[Object])],xe);class Be extends ye{constructor(){super(ke)}async createProfile(e,t,i,...r){return this.create({tenant:e,profileKey:t,metadata:i},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async deleteForTenant(e,...t){for(const i of await this.listForTenant(e,...t))await this.deleteById(i.id,...t)}}class De extends ye{constructor(){super(Fe)}async createProfile(e,t,i,...r){return this.create({orgUnit:e,profileKey:t,metadata:i},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}}class Ce extends ye{constructor(){super(ve)}async listAncestors(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,i,...r){return(await this.listAncestors(e,i,...r)).some(e=>ae(e.ancestor,t))}async createSelfLink(e,t,...i){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...i)}async insertAncestorLinksForNewChild(e,t,i,...r){const n=await this.listAncestors(e,t,...r);for(const t of n)await this.create({tenant:e,ancestor:t.ancestor,descendant:i,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...i){const r=await this.listDescendants(e,t,...i),n=new Set([t,...r.map(e=>ue(e.descendant))]),s=new Set([t,...r.map(e=>ue(e.ancestor))]),o=(await this.listAll(...i)).filter(t=>oe(t.tenant,e)&&(n.has(ue(t.descendant))||s.has(ue(t.ancestor))));for(const e of o)await this.deleteById(e.id,...i)}}class Ge extends ye{constructor(){super(je)}async blockCategory(e,t,i,r,n,...s){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:i,reason:n},...s)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.orgUnit,t))}async categoryBlockedForAncestor(e,t,i,r,...n){return(await this.listForOrgUnit(e,t,...n)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||ae(e.blockedFromAncestor,i)))}}class Ee extends ye{constructor(){super(Ke)}async createTenant(e,...t){return this.create({slug:e.slug,name:e.name,isolationTier:e.isolationTier??B.Pooled},...t)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...i){return this.updateOne(e,{name:t},...i)}async changeSlug(e,t,...i){return this.updateOne(e,{slug:t},...i)}async setIsolationTier(e,t,...i){return this.updateOne(e,{isolationTier:t},...i)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function Ne(e,t,...i){for(const r of t)await e.deleteById(r.id,...i)}class $e extends ye{constructor(){super(Ue)}orgUnitPath(e,t){const i=de(t);return e?`${e.replace(/\/+$/,"")}/${i}`:"/"+i}async createProfileIfNeeded(e,t,i,...r){t&&await(new De).createProfile(e,t,i,...r)}async createRoot(e,t,i,r,n,...s){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:i},...s);return await this.createProfileIfNeeded(o.id,r,n,...s),await(new Ce).createSelfLink(e,o.id,...s),o}async createChild(e,...t){const i=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:i?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(i?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const n=new Ce;return await n.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await n.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async listDescendantOrgUnits(e,t,i=!1,...r){const n=await(new Ce).listDescendants(e,t,...r),s=new Set(n.map(e=>ue(e.descendant)));return i&&s.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>s.has(e.id))}async listAncestorOrgUnits(e,t,i=!1,...r){const n=await(new Ce).listAncestors(e,t,...r),s=new Set(n.map(e=>ue(e.ancestor)));return i&&s.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>s.has(e.id))}async renameOrgUnit(e,t,...i){const r=await this.getById(e,...i);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...i)}async moveOrgUnit(e,t,i,...r){const n=await this.getById(i,...r),s=await this.getById(t,...r),o=await this.updateOne(t,{parent:n.id,path:this.orgUnitPath(n.path,s.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const i=new Ce,r=await i.listAll(...t);await Ne(i,r.filter(t=>oe(t.tenant,e)),...t);const n=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of n)await i.createSelfLink(e,r.id,...t),r.parent&&await i.insertAncestorLinksForNewChild(e,ue(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...i){const r=new Ce,n=await this.listDescendantOrgUnits(e,t,!0,...i),s=new Set(n.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...i)).filter(e=>s.has(e.id));await Ne(this,o,...i),await r.deleteLinksForSubtree(e,t,...i)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object,String,Object,Object]),K("design:returntype",Promise)],$e.prototype,"createRoot",null),P([m(),K("design:type",Function),K("design:paramtypes",[Object,Object]),K("design:returntype",Promise)],$e.prototype,"createChild",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],$e.prototype,"moveOrgUnit",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,Object]),K("design:returntype",Promise)],$e.prototype,"rebuildTenantClosure",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object]),K("design:returntype",Promise)],$e.prototype,"deleteOrgUnitTree",null);class Le extends ye{constructor(){super(me)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...i){return this.updateOne(e,{displayName:t},...i)}async updateEmail(e,t,...i){return this.updateOne(e,{email:t},...i)}async updatePhone(e,t,...i){return this.updateOne(e,{phone:t},...i)}}class ze extends ye{constructor(){super(Ie)}async createPrincipal(e,t,i,...r){return this.create({tenant:e,kind:t,subjectId:i},...r)}async getForSubject(e,t,i,...r){return(await this.listAll(...r)).find(r=>oe(r.tenant,e)&&r.kind===t&&r.subjectId===i)}async getOrCreateForSubject(e,t,i,...r){return await this.getForSubject(e,t,i,...r)??await this.createPrincipal(e,t,i,...r)}async getUserPrincipal(e,t,...i){return this.getOrCreateForSubject(e,C.User,t,...i)}async getGroupPrincipal(e,t,...i){return this.getOrCreateForSubject(e,C.Group,t,...i)}}class Me extends ye{constructor(){super(he)}async addUserToTenant(e,t,i=D.Active,...r){return this.create({tenant:e,user:t,status:i},...r)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class qe extends ye{constructor(){super(fe)}async addUserToOrgUnit(e,t,i,r=D.Active,...n){return this.create({tenant:e,orgUnit:t,user:i,status:r},...n)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class We extends ye{constructor(){super(Te)}async createGroup(e,t,i,r,...n){return this.create({tenant:e,orgUnit:i,name:t,metadata:r},...n)}async renameGroup(e,t,...i){return this.updateOne(e,{name:t},...i)}async moveGroupToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}}class Ve extends ye{constructor(){super(Re)}async addPrincipalToGroup(e,t,i,r,...n){return this.create({tenant:e,group:t,principal:i,metadata:r},...n)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const i=new ze,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=ue(e.tenant),n=ue(e.group);return(await i.getGroupPrincipal(r,n,...t)).id}))}}class Ze extends ye{constructor(){super(we)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...i){return this.updateOne(e,{description:t},...i)}}class Qe extends ye{constructor(){super(Se)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const i=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!i)throw Error(`Role "${e}" not found`);return i}async getTenantRoleByKey(e,t,...i){const r=(await this.listAll(...i)).find(i=>oe(i.tenant,e)&&i.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...i){return this.updateOne(e,{name:t},...i)}async updateRoleMetadata(e,t,...i){return this.updateOne(e,{metadata:t},...i)}async listTenantRoles(e,t=!1,...i){return(await this.listAll(...i)).filter(i=>t&&!i.tenant||oe(i.tenant,e))}}class Je extends ye{constructor(){super(be)}async addPermissionToRole(e,t,...i){return this.create({role:e,permission:t},...i)}async addPermissionKeyToRole(e,t,...i){const r=await(new Ze).getByKey(t,...i);return this.addPermissionToRole(e,r.id,...i)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.permission,e))}async replaceRolePermissions(e,t,...i){const r=await this.listRolePermissions(e,...i);return await(async(e,t,...i)=>{for(const r of t)await e.deleteById(r.id,...i)})(this,r,...i),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...i)))}async createRoleWithPermissions(e,t,...i){const r=await(new Qe).createRole(e,...i);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...i);return r}}class He extends ye{constructor(){super(Ae)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async updateAssignmentWindow(e,t,i,...r){return this.updateOne(e,{startsAt:t,expiresAt:i},...r)}}class Xe extends ye{constructor(){super(xe)}async listForPrincipal(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async listForScope(e,t,i,...r){return(await this.listAll(...r)).filter(r=>oe(r.tenant,e)&&r.scopeKind===t&&r.scopeId===i)}async hasPermission(e,t,i,r,n,s,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==i||e.scopeKind!==r||e.scopeId!==n||e.startsAt&&s&&e.startsAt>s||e.expiresAt&&s&&e.expiresAt<s))}async deleteForPrincipal(e,t,...i){for(const r of await this.listForPrincipal(e,t,...i))await this.deleteById(r.id,...i)}async deleteForTenant(e,...t){for(const i of(await this.listAll(...t)).filter(t=>oe(t.tenant,e)))await this.deleteById(i.id,...t)}async rebuildForPrincipal(e,t,...i){await this.deleteForPrincipal(e,t,...i);const r=new He,n=new Je,s=new Ze,o=new Ve,a=new ze,d=new Ce,p=new Ge,c=[],y=await r.listPrincipalAssignments(e,t,...i),l=await o.listPrincipalGroups(t,...i),u=[...y,...(await Promise.all(l.map(async t=>{const n=await a.getGroupPrincipal(ue(t.tenant),ue(t.group),...i);return r.listPrincipalAssignments(e,n.id,...i)}))).flat()];for(const r of u){const o=await n.listRolePermissions(ue(r.role),...i),a=await Promise.all(o.map(async e=>s.findOneBy("id",ue(e.permission),...i)));for(const n of a){if(!n)continue;const s=r.scopeKind,o=r.scopeId,a=[];if(s===G.Tenant)a.push({scopeKind:s,scopeId:e});else if(s===G.Resource)a.push({scopeKind:s,scopeId:o});else if(s!==G.OrgUnit||r.inheritDown){if(s===G.OrgUnit&&r.inheritDown){const t=await d.listDescendants(e,o,...i);a.push(...t.map(e=>({scopeKind:s,scopeId:ue(e.descendant)})))}}else a.push({scopeKind:s,scopeId:o});for(const d of a)s===G.OrgUnit&&r.inheritDown&&d.scopeId!==o&&await p.categoryBlockedForAncestor(e,d.scopeId,o,n.category,...i)||c.push({id:"",tenantId:e,principalId:t,permissionKey:n.key,scopeKind:d.scopeKind,scopeId:d.scopeId,sourceKind:"role_assignment",sourceId:r.id,startsAt:r.startsAt,expiresAt:r.expiresAt})}}return await Promise.all(c.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...i)))}async rebuildForTenant(e,...t){const i=(await(new ze).listAll(...t)).filter(t=>oe(t.tenant,e));for(const r of i)await this.rebuildForPrincipal(e,r.id,...t)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object]),K("design:returntype",Promise)],Xe.prototype,"rebuildForPrincipal",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,Object]),K("design:returntype",Promise)],Xe.prototype,"rebuildForTenant",null);class Ye extends ye{constructor(){super(_e)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,i,...r){return(await this.listAll(...r)).find(r=>oe(r.tenant,e)&&r.resourceType===t&&r.resourceId===i)}async moveResourceToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async setVisibility(e,t,...i){return this.updateOne(e,{visibility:t},...i)}async transferOwnership(e,t,...i){return this.updateOne(e,{owner:t},...i)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}}class et extends ye{constructor(){super(Oe)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.resource,e))}async listPrincipalGrants(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async hasGrant(e,t,i,r,n,...s){return(await this.listPrincipalGrants(e,t,...s)).some(e=>ae(e.resource,i)&&e.permissionKey===r&&(!e.startsAt||!n||e.startsAt<=n)&&(!e.expiresAt||!n||e.expiresAt>=n))}async deleteAllForResource(e,...t){for(const i of await this.listResourceGrants(e,...t))await this.deleteById(i.id,...t)}}class tt{async unregisterResource(e,...t){await(new et).deleteAllForResource(e,...t),await(new Ye).deleteById(e,...t)}async resolveResourceScope(e,...t){const i=await(new Ye).getById(e,...t);return{tenantId:ue(i.tenant),orgUnitId:ue(i.orgUnit),visibility:i.visibility,ownerPrincipalId:i.owner?ue(i.owner):void 0}}}class it extends ye{constructor(){super(Pe)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>ue(t.tenant)===e)}async getBinding(e,t,...i){return(await this.listTenantBindings(e,...i)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...i){return this.updateOne(e,{config:t},...i)}async promoteToDedicated(e,t,i,r,...n){return this.updateOne(e,{bindingKind:L.Dedicated,bindingKey:t,region:i,config:r},...n)}async setShared(e,t,i,r,...n){return this.updateOne(e,{bindingKind:L.Shared,bindingKey:t,region:i,config:r},...n)}}class rt{constructor(){this.tenantService=new Ee,this.tenantProfileService=new Be,this.orgUnitService=new $e,this.orgUnitProfileService=new De,this.userService=new Le,this.membershipService=new Me,this.principalService=new ze,this.permissionService=new Ze,this.roleService=new Qe,this.rolePermissionService=new Je,this.roleAssignmentService=new He,this.effectivePermissionService=new Xe}async bootstrapTenantFromTemplate(e,...t){const i=await this.tenantService.createTenant(e.tenant,...t);e.tenant.profileKey&&await this.tenantProfileService.createProfile(i.id,e.tenant.profileKey,e.tenant.profileMetadata,...t);const r=async(e,n)=>{const s=void 0===e?await this.orgUnitService.createRoot(i.id,n.name,n.metadata,n.profileKey,n.metadata,...t):await this.orgUnitService.createChild({tenantId:i.id,parentOrgUnitId:e,name:n.name,metadata:n.metadata,profileKey:n.profileKey,profileMetadata:n.metadata},...t);for(const e of n.children??[])await r(s.id,e);return s},n=await r(void 0,e.rootOrgUnit),s=await this.userService.createUser(e.ownerUser,...t);await this.membershipService.addUserToTenant(i.id,s.id,D.Active,...t);const o=await this.principalService.getUserPrincipal(i.id,s.id,...t);for(const i of e.permissions)await this.permissionService.createPermission(i,...t);for(const r of e.roles){const e=await this.roleService.createRole({tenantId:i.id,key:r.key,name:r.name,description:r.description},...t);for(const i of r.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(e.id,i,...t)}const a=await this.roleService.getTenantRoleByKey(i.id,e.ownerRoleKey,...t);return await this.roleAssignmentService.assignRole({tenantId:i.id,principalId:o.id,roleId:a.id,scopeKind:G.OrgUnit,scopeId:n.id,inheritDown:!0},...t),await this.effectivePermissionService.rebuildForPrincipal(i.id,o.id,...t),{tenantId:i.id,rootOrgUnitId:n.id,ownerUserId:s.id,ownerPrincipalId:o.id}}}P([m(),K("design:type",Function),K("design:paramtypes",[Object,Object]),K("design:returntype",Promise)],rt.prototype,"bootstrapTenantFromTemplate",null);class nt{constructor(){this.membershipService=new Me,this.orgMembershipService=new qe,this.principalService=new ze,this.roleService=new Qe,this.roleAssignmentService=new He,this.effectivePermissionService=new Xe}async onboardUserToTenantAndOrgUnit(e,t,i,r,...n){await this.membershipService.addUserToTenant(e,t,D.Active,...n),await this.orgMembershipService.addUserToOrgUnit(e,i,t,D.Active,...n);const s=await this.principalService.getUserPrincipal(e,t,...n),o=await this.roleService.getTenantRoleByKey(e,r,...n);return await this.roleAssignmentService.assignRole({tenantId:e,principalId:s.id,roleId:o.id,scopeKind:G.OrgUnit,scopeId:i,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(e,s.id,...n),{principalId:s.id}}async changeUserOrgRole(e,t,i,r,n,...s){const o=await this.roleService.getTenantRoleByKey(e,r,...s),a=await this.roleAssignmentService.listPrincipalAssignments(e,t,...s);for(const e of a.filter(e=>e.scopeKind===G.OrgUnit&&e.scopeId===i))await this.roleAssignmentService.revokeAssignment(e.id,...s);await this.roleAssignmentService.assignRole({tenantId:e,principalId:t,roleId:o.id,scopeKind:G.OrgUnit,scopeId:i,inheritDown:n},...s),await this.effectivePermissionService.rebuildForPrincipal(e,t,...s)}async suspendUserInTenant(e,t,i,...r){await this.membershipService.setStatus(e,D.Suspended,...r),await this.effectivePermissionService.deleteForPrincipal(t,i,...r)}async reactivateUserInTenant(e,t,i,...r){await this.membershipService.setStatus(e,D.Active,...r),await this.effectivePermissionService.rebuildForPrincipal(t,i,...r)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"onboardUserToTenantAndOrgUnit",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,String,Boolean,Object]),K("design:returntype",Promise)],nt.prototype,"changeUserOrgRole",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"suspendUserInTenant",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"reactivateUserInTenant",null);class st{constructor(e={}){this.dataSources=e}async canAccess(e,...t){const i=e.at??new Date;if(e.scopeKind&&e.scopeId)return se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,e.scopeKind,e.scopeId))).some(t=>t.permissionKey===e.permissionKey&&pe(i,t.startsAt,t.expiresAt));if(!e.resourceProtectedId)return!1;const r=await(this.dataSources.loadResource?.(e.tenantId,e.resourceProtectedId));if(!r)return!1;if(r.tenantId!==e.tenantId)return!1;if(r.ownerPrincipalId===e.principalId)return!0;if(se(await(this.dataSources.listResourceGrants?.(e.tenantId,e.resourceProtectedId))).filter(t=>t.principalId===e.principalId&&t.permissionKey===e.permissionKey&&pe(i,t.startsAt,t.expiresAt)).length>0)return!0;const n=r.visibility;return n!==N.Private&&n!==N.ResourceAcl&&(n===N.OrgUnit||n===N.OrgSubtree?se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,G.OrgUnit,r.orgUnitId))).some(t=>t.permissionKey===e.permissionKey&&pe(i,t.startsAt,t.expiresAt)):n===N.Tenant&&se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,G.Tenant,e.tenantId))).some(t=>t.permissionKey===e.permissionKey&&pe(i,t.startsAt,t.expiresAt)))}async requireAccess(e,...t){if(!await this.canAccess(e,...t))throw new f(`Access denied for ${e.permissionKey} on ${e.resourceProtectedId??(i=e.scopeKind??G.Resource,r=e.scopeId??"",`${i}:${r}`)}`);var i,r}async buildAccessContext(e,t,...i){return ce({tenantId:e,principalId:t,permissions:se(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:se(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,i,...r){const n=await this.buildAccessContext(e,t,...r),s=n.allowedOrgUnitIdsByPermission[i]??[],o=n.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId);return te({tenantId:e,principalId:t,permissionKey:i,allowedOrgUnitIds:s,allowedResourceIds:o})}async buildQdrantFilter(e,t,i,...r){const n=await this.buildAccessContext(e,t,...r);return ie({tenantId:e,principalId:t,allowedOrgUnitIds:n.allowedOrgUnitIdsByPermission[i]??[],allowedResourceIds:n.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId)})}}const ot="featureFlag",at="FEATURE_FLAG",dt="feature-flags:model",pt="feature-flags:auth",ct="feature-flags:block",yt="feature-flags:render-if",lt="feature-flags:hide-on";function ut(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const i=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===i.length)return t;const[r,...n]=i;return[r,...n.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function gt(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ht(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return gt(e);const t={};return Object.entries(e).forEach(([e,i])=>{const r=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[i,...r]=t;return[i.toLowerCase(),...r.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==i&&(t[r]=ht(i)??i)}),t}function mt(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,i])=>{const r=ut(t),n=ht(i);return void 0!==n&&(e[r]=n),e},{})}function ft(e){return!0===e||!!e&&"object"==typeof e}function vt(e,t){return ft(e?.[ut(t)])}function wt(e,t="any"){return{features:[...new Set(e.map(ut).filter(Boolean))],match:t}}function bt(e,t){if(!e||0===e.features.length)return!0;const i=e.features.filter(e=>vt(t,e));return"all"===e.match?i.length===e.features.length:i.length>0}function St(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>vt(t,e))}function At(e,t){return k.get(e,t)}function Ot(e){return e.trim().toLowerCase()}function It(e){return e.trim()}const _t=i.accumulate({[ot]:{}});async function jt(e=_t){return mt(e.featureFlag)}async function Ut(e,t=_t){return(await jt(t))[ut(e)]}async function Pt(e,t=_t){return!!await Ut(e,t)}let Kt=class extends v{constructor(e){super(e),this.enabled=!0}};P([a(),d(),K("design:type",String)],Kt.prototype,"id",void 0),P([g(),I(),c(),K("design:type",String)],Kt.prototype,"key",void 0),P([c(),K("design:type",Boolean)],Kt.prototype,"enabled",void 0),P([c(),K("design:type",String)],Kt.prototype,"description",void 0),P([c(),K("design:type",String)],Kt.prototype,"scope",void 0),P([c(),K("design:type",Object)],Kt.prototype,"metadata",void 0),P([c(),K("design:type",Object)],Kt.prototype,"config",void 0),P([c(),K("design:type",String)],Kt.prototype,"createdBy",void 0),P([c(),K("design:type",String)],Kt.prototype,"updatedBy",void 0),P([y(),K("design:type",Date)],Kt.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Kt.prototype,"updatedAt",void 0),Kt=P([u("feature_flags"),U(),K("design:paramtypes",[Object])],Kt);let kt=class extends v{constructor(e){super(e),this.enabled=!0}};P([a(),d(),K("design:type",String)],kt.prototype,"id",void 0),P([I(),c(),K("design:type",String)],kt.prototype,"featureKey",void 0),P([I(),c(),K("design:type",String)],kt.prototype,"subjectType",void 0),P([I(),c(),K("design:type",String)],kt.prototype,"subjectKey",void 0),P([c(),K("design:type",Boolean)],kt.prototype,"enabled",void 0),P([c(),K("design:type",Object)],kt.prototype,"metadata",void 0),P([c(),K("design:type",String)],kt.prototype,"createdBy",void 0),P([c(),K("design:type",String)],kt.prototype,"updatedBy",void 0),P([y(),K("design:type",Date)],kt.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],kt.prototype,"updatedAt",void 0),kt=P([u("feature_flag_access"),U(),K("design:paramtypes",[Object])],kt);class Ft{async readOne(e,t){return(await this.read(t))[ut(e)]}}class Rt extends Ft{async read(e={}){return jt(e.source??{[ot]:{}})}}let Tt=class extends o{constructor(){super(Kt),this.reader=new Rt,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Rt;const i={...t.readerConfig??{},source:t.readerConfig?.source??_t};return this.cachedRegistry=await this.refreshCachedRegistry(i,...e),{config:{...t,reader:this.reader,readerConfig:i},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,i])=>(e[t]=i&&"object"==typeof i&&!Array.isArray(i)?{...i}:i,e),{})}async refreshCachedRegistry(e={},...t){const i=await this.reader.read({...e,source:e.source??_t});let r=[];try{r=await this.repo.select().execute(...t)}catch{r=[]}const n=this.cloneRegistry(i);for(const e of r)n[e.key]=!!e.enabled&&(e.config??!0);return n}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??S.forModel(kt)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:ut(e.featureKey),subjectType:Ot(e.subjectType),subjectKey:It(e.subjectKey)}}buildAccessCondition(e){let t=A.attr("subjectType").eq(Ot(e.subjectType));return t=t.and(A.attr("subjectKey").eq(It(e.subjectKey))),void 0!==e.enabled&&(t=t.and(A.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(A.attr("featureKey").in(e.featureKeys.map(ut)))),t}async create(e,...t){e.key=ut(e.key),e.enabled??=!0;const i=await super.create(e,...t);return this.setCachedFlag(i),i}async update(e,...t){e.key=ut(e.key),e.enabled??=!0;const i=await super.update(e,...t);return this.setCachedFlag(i),i}async findOneBy(e,t,...i){const r="key"===e&&"string"==typeof t?ut(t):t;return this.repo.findOneBy(e,r,...i)}async readAll(e,...t){const i=await this.repo.readAll(e,...t);for(const e of i)this.setCachedFlag(e);return i}async listEnabled(...e){return this.repo.select().where(A.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(e,...t){const i=this.normalizeFeatureAccessInput(e),r=await this.findFeatureAccess(i,...t).catch(()=>{});return r?this.getAccessRepository().update(Object.assign(r,i),...t):this.getAccessRepository().create(new kt(i),...t)}async revokeFeatureAccess(e,...t){const i=await this.findFeatureAccess(e,...t).catch(()=>{});if(i)return this.getAccessRepository().delete(i.id,...t)}async findFeatureAccess(e,...t){const i=this.buildAccessCondition(e),r=(await this.getAccessRepository().select().where(i).execute(...t))[0];if(!r)throw new n(`Feature access for ${Ot(e.subjectType)}:${It(e.subjectKey)} not found`);return r}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const i=await this.listFeatureAccess({...e,enabled:!0},...t),r=[...new Set(i.map(e=>e.featureKey))];if(0===r.length)return{};const n=A.attr("enabled").eq(!0).and(A.attr("key").in(r.map(ut)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...i){return vt(await this.resolveFeatureFlagsForSubject(t,...i),e)}isEnabled(e){this.assertInitialized();const t=ut(e);return vt(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(e={},...t){this.assertInitialized();const i=await this.reader.read({...e,source:e.source??_t}),r=[];for(const[e,n]of Object.entries(i)){const i=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:s,...o}=i,a=ut(e),d=await this.findOneBy("key",a,...t).catch(()=>{}),p=d?Object.assign(d,{enabled:ft(n),description:o.description??d.description,scope:o.scope??d.scope,metadata:o.metadata??d.metadata,config:{...o,enabled:ft(n)}}):new Kt({key:a,enabled:ft(n),description:o.description,scope:o.scope,metadata:o.metadata,config:{...o,enabled:ft(n)}});r.push(d?await this.update(p,...t):await this.create(p,...t))}return this.cachedRegistry=await this.refreshCachedRegistry({...e,source:e.source??_t},...t),r}};function xt(e,t){return void 0===t?e:k.key(e,t.toString())}function Bt(e,t,i="any"){const r=wt(t,i);return(t,i,n)=>{if(void 0===i)return F(e,r)(t);const s=xt(e,i);return n?R(s,r)(t,i,n):T(s,r)(t,i)}}function Dt(...e){return Bt(dt,e)}function Ct(...e){return Bt(pt,e)}function Gt(...e){return Bt(ct,e)}function Et(...e){return Bt(yt,e)}function Nt(...e){return Bt(lt,e)}function $t(e,t,i){return At(e,xt(t,i))}function Lt(e,t,i,r){return bt($t(e,i,r),t)}function zt(e,t,i,r){return St($t(e,i,r),t)}P([w(kt),K("design:type",Object)],Tt.prototype,"accessRepository",void 0),Tt=P([b(Kt),K("design:paramtypes",[])],Tt);const Mt="##VERSION##",qt="##COMMIT##",Wt="##FULL_VERSION##",Vt="##PACKAGE##";export{ge as AuthorizationModel,st as AuthzService,ye as BaseModelService,rt as BootstrapService,qt as COMMIT,xe as EffectivePermission,Xe as EffectivePermissionService,Rt as EnvironmeFlagReader,pt as FEATURE_FLAG_AUTH_KEY,ct as FEATURE_FLAG_BLOCK_KEY,at as FEATURE_FLAG_ENV_PREFIX,ot as FEATURE_FLAG_ENV_ROOT,lt as FEATURE_FLAG_HIDE_KEY,dt as FEATURE_FLAG_MODEL_KEY,yt as FEATURE_FLAG_RENDER_KEY,Wt as FULL_VERSION,Kt as FeatureFlag,kt as FeatureFlagAccess,_t as FeatureFlagEnvironment,Ft as FeatureFlagReader,Tt as FeatureFlagService,Te as Group,Re as GroupMembership,Ve as GroupMembershipService,We as GroupService,je as InheritanceBlock,Ge as InheritanceBlockService,B as IsolationTier,z as IsolationTierOptions,D as MembershipStatus,M as MembershipStatusOptions,Ue as OrgUnit,ve as OrgUnitClosure,Ce as OrgUnitClosureService,fe as OrgUnitMembership,qe as OrgUnitMembershipService,Fe as OrgUnitProfile,De as OrgUnitProfileService,$e as OrgUnitService,Vt as PACKAGE_NAME,we as Permission,E as PermissionCategory,V as PermissionCategoryOptions,Ze as PermissionService,Ie as Principal,C as PrincipalKind,q as PrincipalKindOptions,ze as PrincipalService,_e as ProtectedResource,Ye as ProtectedResourceService,Y as REL_CASCADE_DEPENDENT,ee as REL_CASCADE_INSERT_UPDATE,X as REL_NULLIFY,H as REL_RESTRICT,Oe as ResourceGrant,et as ResourceGrantService,tt as ResourceLifecycleService,N as ResourceVisibility,Z as ResourceVisibilityOptions,Se as Role,Ae as RoleAssignment,He as RoleAssignmentService,be as RolePermission,Je as RolePermissionService,Qe as RoleService,G as ScopeKind,W as ScopeKindOptions,Pe as StorageBinding,L as StorageBindingKind,J as StorageBindingKindOptions,it as StorageBindingService,$ as StorageKind,Q as StorageKindOptions,nt as SystemManagementService,Ke as Tenant,he as TenantMembership,Me as TenantMembershipService,ke as TenantProfile,Be as TenantProfileService,Ee as TenantService,me as User,Le as UserService,Mt as VERSION,se as asArray,Gt as blockFeatureOperations,ce as buildAccessContext,te as buildArangoContext,ie as buildQdrantFilter,x as execWithLogging,Ct as featureAuth,Dt as featureFlags,$t as getFeatureGateMetadata,Pt as hasFeatureFlagInEnvironment,Nt as hideOnFeature,le as id,ft as isFeatureFlagEnabled,vt as isFeatureFlagEnabledByName,St as isFeatureRuleBlocked,bt as isFeatureRuleSatisfied,pe as isTimeValid,jt as loadFeatureFlagsFromEnvironment,de as lowerSlug,ht as normalizeFeatureConfig,ut as normalizeFeatureName,mt as normalizeFeatureRegistry,wt as normalizeFeatureRule,It as normalizeFeatureSubjectKey,Ot as normalizeFeatureSubjectType,ne as nowIso,gt as parseRuntimeValue,At as readMetadata,ue as relationId,ae as relationMatch,Et as renderIfFeature,Ut as resolveFeatureFlagFromEnvironment,oe as sameTenant,Lt as shouldExposeForFeatures,zt as shouldHideForFeatures};
+import{exec as e}from"child_process";import{LogLevel as t,LoggedEnvironment as i}from"@decaf-ts/logging";import{InternalError as r,NotFoundError as n}from"@decaf-ts/db-decorators";import{Cascade as s,ModelService as o,pk as a,uuid as d,manyToOne as c,column as p,createdAt as y,updatedAt as l,table as u,unique as g,oneToMany as h,transactional as m,AuthorizationError as f,BaseModel as v,repository as w,service as b,Repository as S,Condition as A}from"@decaf-ts/core";export{AuthorizationError,transactional}from"@decaf-ts/core";import{Model as O,required as I,type as _,option as j,model as U}from"@decaf-ts/decorator-validation";import{__decorate as P,__metadata as K}from"tslib";import{Metadata as k,metadata as F,methodMetadata as R,propMetadata as T}from"@decaf-ts/decoration";async function x(i,n,s,o=t.info){return s.debug("Executing: "+i),new Promise((t,a)=>{const d=e(i,n),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),s[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),s.debug(e.trim())}),d.on("close",e=>{0===e?(s.silly("Command completed successfully"),t({stdout:c.join("\n"),stderr:p.join("\n")})):(s.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),a(new r(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{s.critical("Command execution error",e),a(e)})})}var B,D,C,E,G,N,$,L;(e=>{e.Pooled="pooled",e.Bridge="bridge",e.Silo="silo"})(B||(B={})),(e=>{e.Invited="invited",e.Active="active",e.Suspended="suspended",e.Removed="removed"})(D||(D={})),(e=>{e.User="user",e.Group="group",e.ServiceAccount="service_account",e.Agent="agent",e.ApiKey="api_key"})(C||(C={})),(e=>{e.Tenant="tenant",e.OrgUnit="org_unit",e.Resource="resource"})(E||(E={})),(e=>{e.Admin="admin",e.ContentRead="content_read",e.ContentWrite="content_write",e.Memory="memory",e.Graph="graph",e.Vector="vector",e.Export="export",e.Billing="billing",e.Audit="audit",e.Security="security",e.Data="data",e.Automation="automation"})(G||(G={})),(e=>{e.Private="private",e.ResourceAcl="resource_acl",e.OrgUnit="org_unit",e.OrgSubtree="org_subtree",e.Tenant="tenant"})(N||(N={})),(e=>{e.Postgres="postgres",e.Arango="arango",e.Qdrant="qdrant",e.ObjectStorage="object_storage"})($||($={})),(e=>{e.Shared="shared",e.Dedicated="dedicated"})(L||(L={}));const z=Object.values(B),M=Object.values(D),q=Object.values(C),W=Object.values(E),V=Object.values(G),Z=Object.values(N),Q=Object.values($),J=Object.values(L),H={update:s.NONE,delete:s.NONE,nullable:!1},X={update:s.NONE,delete:s.NONE,nullable:!0},Y={update:s.CASCADE,delete:s.CASCADE,nullable:!1},ee={update:s.CASCADE,delete:s.NONE,nullable:!1};function te(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function ie(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function re(e,t){return`${e}:${t}`}function ne(){return new Date}function se(e){return e??[]}function oe(e,t){return ue(e)===t}function ae(e,t){return!!t&&ue(e)===t}function de(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function ce(e,t,i){const r=e??new Date;return!(t&&t>r||i&&r>i)}function pe(e){const t={},i={};for(const r of e.permissions){const e=re(r.scopeKind,r.scopeId);t[e]=t[e]??[],t[e].push(r.permissionKey),r.scopeKind===E.OrgUnit&&(i[r.permissionKey]=i[r.permissionKey]??[],i[r.permissionKey].push(r.scopeId))}return{tenantId:e.tenantId,principalId:e.principalId,permissionsByScope:t,allowedOrgUnitIdsByPermission:i,resourceGrants:e.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class ye extends o{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...i){const r=await this.repo.read(e,...i);return this.repo.update(Object.assign(r,t),...i)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...i){return this.repo.findOneBy(e,t,...i)}async findManyBy(e,t,...i){return this.repo.select().where({[e]:t}).execute(...i)}async listAll(...e){return this.repo.select().execute(...e)}}function le(){return crypto.randomUUID()}function ue(e){return"string"==typeof e?e:e.id}class ge extends O{constructor(e){super(e)}}let he=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],he.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_tenant_memberships_tenant"),I(),K("design:type",Object)],he.prototype,"tenant",void 0),P([c(()=>me,Y,!1,void 0,"fk_tenant_memberships_user"),I(),K("design:type",Object)],he.prototype,"user",void 0),P([I(),_(String),j(M),p(),K("design:type",String)],he.prototype,"status",void 0),P([y(),K("design:type",Date)],he.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],he.prototype,"updatedAt",void 0),he=P([u("tenant_memberships"),U(),K("design:paramtypes",[Object])],he);let me=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],me.prototype,"id",void 0),P([g(),_(String),p(),K("design:type",String)],me.prototype,"email",void 0),P([g(),_(String),p(),K("design:type",String)],me.prototype,"phone",void 0),P([I(),_(String),p(),K("design:type",String)],me.prototype,"displayName",void 0),P([h(()=>he,H,!1),K("design:type",Array)],me.prototype,"tenantMemberships",void 0),P([h(()=>fe,H,!1),K("design:type",Array)],me.prototype,"orgUnitMemberships",void 0),P([y(),K("design:type",Date)],me.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],me.prototype,"updatedAt",void 0),me=P([u("users"),U(),K("design:paramtypes",[Object])],me);let fe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],fe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_org_memberships_tenant"),I(),K("design:type",Object)],fe.prototype,"tenant",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_memberships_org_unit"),I(),K("design:type",Object)],fe.prototype,"orgUnit",void 0),P([c(()=>me,H,!1,void 0,"fk_org_memberships_user"),I(),K("design:type",Object)],fe.prototype,"user",void 0),P([I(),_(String),j(M),p(),K("design:type",String)],fe.prototype,"status",void 0),P([y(),K("design:type",Date)],fe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],fe.prototype,"updatedAt",void 0),fe=P([u("org_unit_memberships"),U(),K("design:paramtypes",[Object])],fe);let ve=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],ve.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_org_closure_tenant"),I(),K("design:type",Object)],ve.prototype,"tenant",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_closure_ancestor"),I(),K("design:type",Object)],ve.prototype,"ancestor",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_closure_descendant"),I(),K("design:type",Object)],ve.prototype,"descendant",void 0),P([I(),_(Number),p(),K("design:type",Number)],ve.prototype,"depth",void 0),P([y(),K("design:type",Date)],ve.prototype,"createdAt",void 0),ve=P([u("org_unit_closure"),U(),K("design:paramtypes",[Object])],ve);let we=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],we.prototype,"id",void 0),P([g(),I(),_(String),p(),K("design:type",String)],we.prototype,"key",void 0),P([I(),_(String),j(V),p(),K("design:type",String)],we.prototype,"category",void 0),P([_(String),p(),K("design:type",String)],we.prototype,"description",void 0),P([h(()=>be,H,!1),K("design:type",Array)],we.prototype,"rolePermissions",void 0),we=P([u("permissions"),U(),K("design:paramtypes",[Object])],we);let be=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],be.prototype,"id",void 0),P([c(()=>Se,Y,!1,void 0,"fk_role_permissions_role"),I(),K("design:type",Object)],be.prototype,"role",void 0),P([c(()=>we,Y,!1,void 0,"fk_role_permissions_permission"),I(),K("design:type",Object)],be.prototype,"permission",void 0),P([y(),K("design:type",Date)],be.prototype,"createdAt",void 0),be=P([u("role_permissions"),U(),K("design:paramtypes",[Object])],be);let Se=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Se.prototype,"id",void 0),P([c(()=>Ke,X,!1,void 0,"fk_roles_tenant"),K("design:type",Object)],Se.prototype,"tenant",void 0),P([I(),_(String),p(),K("design:type",String)],Se.prototype,"key",void 0),P([I(),_(String),p(),K("design:type",String)],Se.prototype,"name",void 0),P([_(String),p(),K("design:type",String)],Se.prototype,"description",void 0),P([_(Object),p(),K("design:type",Object)],Se.prototype,"metadata",void 0),P([h(()=>be,H,!1),K("design:type",Array)],Se.prototype,"rolePermissions",void 0),P([h(()=>Ae,H,!1),K("design:type",Array)],Se.prototype,"assignments",void 0),P([y(),K("design:type",Date)],Se.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Se.prototype,"updatedAt",void 0),Se=P([u("roles"),U(),K("design:paramtypes",[Object])],Se);let Ae=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ae.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_role_assignments_tenant"),I(),K("design:type",Object)],Ae.prototype,"tenant",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_role_assignments_principal"),I(),K("design:type",Object)],Ae.prototype,"principal",void 0),P([c(()=>Se,H,!1,void 0,"fk_role_assignments_role"),I(),K("design:type",Object)],Ae.prototype,"role",void 0),P([I(),_(String),j(W),p(),K("design:type",String)],Ae.prototype,"scopeKind",void 0),P([I(),_(String),p(),K("design:type",String)],Ae.prototype,"scopeId",void 0),P([I(),_(Boolean),p(),K("design:type",Boolean)],Ae.prototype,"inheritDown",void 0),P([p(),K("design:type",Date)],Ae.prototype,"startsAt",void 0),P([p(),K("design:type",Date)],Ae.prototype,"expiresAt",void 0),P([_(Object),p(),K("design:type",Object)],Ae.prototype,"conditions",void 0),P([y(),K("design:type",Date)],Ae.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ae.prototype,"updatedAt",void 0),Ae=P([u("role_assignments"),U(),K("design:paramtypes",[Object])],Ae);let Oe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Oe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_resource_grants_tenant"),I(),K("design:type",Object)],Oe.prototype,"tenant",void 0),P([c(()=>_e,Y,!1,void 0,"fk_resource_grants_resource"),I(),K("design:type",Object)],Oe.prototype,"resource",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_resource_grants_principal"),I(),K("design:type",Object)],Oe.prototype,"principal",void 0),P([I(),_(String),p(),K("design:type",String)],Oe.prototype,"permissionKey",void 0),P([p(),K("design:type",Date)],Oe.prototype,"startsAt",void 0),P([p(),K("design:type",Date)],Oe.prototype,"expiresAt",void 0),P([_(Object),p(),K("design:type",Object)],Oe.prototype,"conditions",void 0),P([c(()=>Ie,H,!1,void 0,"fk_resource_grants_created_by"),K("design:type",Object)],Oe.prototype,"createdBy",void 0),P([y(),K("design:type",Date)],Oe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Oe.prototype,"updatedAt",void 0),Oe=P([u("resource_grants"),U(),K("design:paramtypes",[Object])],Oe);let Ie=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ie.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_principals_tenant"),I(),K("design:type",Object)],Ie.prototype,"tenant",void 0),P([I(),_(String),j(q),p(),K("design:type",String)],Ie.prototype,"kind",void 0),P([I(),_(String),p(),K("design:type",String)],Ie.prototype,"subjectId",void 0),P([h(()=>Ae,H,!1),K("design:type",Array)],Ie.prototype,"roleAssignments",void 0),P([h(()=>Oe,H,!1),K("design:type",Array)],Ie.prototype,"resourceGrants",void 0),P([y(),K("design:type",Date)],Ie.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ie.prototype,"updatedAt",void 0),Ie=P([u("principals"),U(),K("design:paramtypes",[Object])],Ie);let _e=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],_e.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_protected_resources_tenant"),I(),K("design:type",Object)],_e.prototype,"tenant",void 0),P([c(()=>Ue,H,!1,void 0,"fk_protected_resources_org_unit"),I(),K("design:type",Object)],_e.prototype,"orgUnit",void 0),P([I(),_(String),p(),K("design:type",String)],_e.prototype,"resourceType",void 0),P([I(),_(String),p(),K("design:type",String)],_e.prototype,"resourceId",void 0),P([I(),_(String),j(Z),p(),K("design:type",String)],_e.prototype,"visibility",void 0),P([c(()=>Ie,X,!1,void 0,"fk_protected_resources_owner"),K("design:type",Object)],_e.prototype,"owner",void 0),P([_(String),p(),K("design:type",String)],_e.prototype,"sensitivity",void 0),P([_(Object),p(),K("design:type",Object)],_e.prototype,"metadata",void 0),P([h(()=>Oe,H,!1),K("design:type",Array)],_e.prototype,"grants",void 0),P([y(),K("design:type",Date)],_e.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],_e.prototype,"updatedAt",void 0),_e=P([u("protected_resources"),U(),K("design:paramtypes",[Object])],_e);let je=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],je.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_inheritance_blocks_tenant"),I(),K("design:type",Object)],je.prototype,"tenant",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_inheritance_blocks_org_unit"),I(),K("design:type",Object)],je.prototype,"orgUnit",void 0),P([c(()=>Ue,X,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),K("design:type",Object)],je.prototype,"blockedFromAncestor",void 0),P([I(),_(String),j(V),p(),K("design:type",String)],je.prototype,"permissionCategory",void 0),P([_(String),p(),K("design:type",String)],je.prototype,"reason",void 0),P([y(),K("design:type",Date)],je.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],je.prototype,"updatedAt",void 0),je=P([u("inheritance_blocks"),U(),K("design:paramtypes",[Object])],je);let Ue=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ue.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_org_units_tenant"),I(),K("design:type",Object)],Ue.prototype,"tenant",void 0),P([c(()=>Ue,H,!1,void 0,"fk_org_units_parent"),K("design:type",Object)],Ue.prototype,"parent",void 0),P([h(()=>Ue,H,!1),K("design:type",Array)],Ue.prototype,"children",void 0),P([I(),_(String),p(),K("design:type",String)],Ue.prototype,"name",void 0),P([I(),_(String),p(),K("design:type",String)],Ue.prototype,"path",void 0),P([_(Object),p(),K("design:type",Object)],Ue.prototype,"metadata",void 0),P([h(()=>fe,H,!1),K("design:type",Array)],Ue.prototype,"memberships",void 0),P([h(()=>_e,H,!1),K("design:type",Array)],Ue.prototype,"resources",void 0),P([h(()=>je,H,!1),K("design:type",Array)],Ue.prototype,"inheritanceBlocks",void 0),P([h(()=>ve,H,!1),K("design:type",Array)],Ue.prototype,"ancestorLinks",void 0),P([h(()=>ve,H,!1),K("design:type",Array)],Ue.prototype,"descendantLinks",void 0),P([y(),K("design:type",Date)],Ue.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ue.prototype,"updatedAt",void 0),Ue=P([u("org_units"),U(),K("design:paramtypes",[Object])],Ue);let Pe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Pe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_storage_bindings_tenant"),I(),K("design:type",Object)],Pe.prototype,"tenant",void 0),P([I(),_(String),j(Q),p(),K("design:type",String)],Pe.prototype,"storageKind",void 0),P([I(),_(String),j(J),p(),K("design:type",String)],Pe.prototype,"bindingKind",void 0),P([I(),_(String),p(),K("design:type",String)],Pe.prototype,"bindingKey",void 0),P([I(),_(String),p(),K("design:type",String)],Pe.prototype,"region",void 0),P([_(Object),p(),K("design:type",Object)],Pe.prototype,"config",void 0),P([y(),K("design:type",Date)],Pe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Pe.prototype,"updatedAt",void 0),Pe=P([u("storage_bindings"),U(),K("design:paramtypes",[Object])],Pe);let Ke=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ke.prototype,"id",void 0),P([g(),I(),_(String),p(),K("design:type",String)],Ke.prototype,"slug",void 0),P([I(),_(String),p(),K("design:type",String)],Ke.prototype,"name",void 0),P([I(),_(String),j(z),p(),K("design:type",String)],Ke.prototype,"isolationTier",void 0),P([h(()=>Ue,H,!1),K("design:type",Array)],Ke.prototype,"orgUnits",void 0),P([h(()=>he,H,!1),K("design:type",Array)],Ke.prototype,"memberships",void 0),P([h(()=>Ie,H,!1),K("design:type",Array)],Ke.prototype,"principals",void 0),P([h(()=>Pe,H,!1),K("design:type",Array)],Ke.prototype,"storageBindings",void 0),P([y(),K("design:type",Date)],Ke.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ke.prototype,"updatedAt",void 0),Ke=P([u("tenants"),U(),K("design:paramtypes",[Object])],Ke);let ke=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],ke.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_tenant_profiles_tenant"),I(),K("design:type",Object)],ke.prototype,"tenant",void 0),P([I(),_(String),p(),K("design:type",String)],ke.prototype,"profileKey",void 0),P([_(Object),p(),K("design:type",Object)],ke.prototype,"metadata",void 0),P([y(),K("design:type",Date)],ke.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],ke.prototype,"updatedAt",void 0),ke=P([u("tenant_profiles"),U(),K("design:paramtypes",[Object])],ke);let Fe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Fe.prototype,"id",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_unit_profiles_org_unit"),I(),K("design:type",Object)],Fe.prototype,"orgUnit",void 0),P([I(),_(String),p(),K("design:type",String)],Fe.prototype,"profileKey",void 0),P([_(Object),p(),K("design:type",Object)],Fe.prototype,"metadata",void 0),P([y(),K("design:type",Date)],Fe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Fe.prototype,"updatedAt",void 0),Fe=P([u("org_unit_profiles"),U(),K("design:paramtypes",[Object])],Fe);let Re=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Re.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_group_memberships_tenant"),I(),K("design:type",Object)],Re.prototype,"tenant",void 0),P([c(()=>Te,Y,!1,void 0,"fk_group_memberships_group"),I(),K("design:type",Object)],Re.prototype,"group",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_group_memberships_principal"),I(),K("design:type",Object)],Re.prototype,"principal",void 0),P([_(Object),p(),K("design:type",Object)],Re.prototype,"metadata",void 0),P([y(),K("design:type",Date)],Re.prototype,"createdAt",void 0),Re=P([u("group_memberships"),U(),K("design:paramtypes",[Object])],Re);let Te=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Te.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_groups_tenant"),I(),K("design:type",Object)],Te.prototype,"tenant",void 0),P([c(()=>Ue,X,!1,void 0,"fk_groups_org_unit"),K("design:type",Object)],Te.prototype,"orgUnit",void 0),P([I(),_(String),p(),K("design:type",String)],Te.prototype,"name",void 0),P([_(Object),p(),K("design:type",Object)],Te.prototype,"metadata",void 0),P([h(()=>Re,H,!1),K("design:type",Array)],Te.prototype,"members",void 0),P([y(),K("design:type",Date)],Te.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Te.prototype,"updatedAt",void 0),Te=P([u("groups"),U(),K("design:paramtypes",[Object])],Te);let xe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],xe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_effective_permissions_tenant"),I(),K("design:type",Object)],xe.prototype,"tenant",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_effective_permissions_principal"),I(),K("design:type",Object)],xe.prototype,"principal",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"permissionKey",void 0),P([I(),_(String),j(W),p(),K("design:type",String)],xe.prototype,"scopeKind",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"scopeId",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"sourceKind",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"sourceId",void 0),P([p(),K("design:type",Date)],xe.prototype,"startsAt",void 0),P([p(),K("design:type",Date)],xe.prototype,"expiresAt",void 0),P([y(),K("design:type",Date)],xe.prototype,"createdAt",void 0),xe=P([u("effective_permissions"),U(),K("design:paramtypes",[Object])],xe);class Be extends ye{constructor(){super(ke)}async createProfile(e,t,i,...r){return this.create({tenant:e,profileKey:t,metadata:i},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async deleteForTenant(e,...t){for(const i of await this.listForTenant(e,...t))await this.deleteById(i.id,...t)}}class De extends ye{constructor(){super(Fe)}async createProfile(e,t,i,...r){return this.create({orgUnit:e,profileKey:t,metadata:i},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}}class Ce extends ye{constructor(){super(ve)}async listAncestors(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,i,...r){return(await this.listAncestors(e,i,...r)).some(e=>ae(e.ancestor,t))}async createSelfLink(e,t,...i){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...i)}async insertAncestorLinksForNewChild(e,t,i,...r){const n=await this.listAncestors(e,t,...r);for(const t of n)await this.create({tenant:e,ancestor:t.ancestor,descendant:i,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...i){const r=await this.listDescendants(e,t,...i),n=new Set([t,...r.map(e=>ue(e.descendant))]),s=new Set([t,...r.map(e=>ue(e.ancestor))]),o=(await this.listAll(...i)).filter(t=>oe(t.tenant,e)&&(n.has(ue(t.descendant))||s.has(ue(t.ancestor))));for(const e of o)await this.deleteById(e.id,...i)}}class Ee extends ye{constructor(){super(je)}async blockCategory(e,t,i,r,n,...s){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:i,reason:n},...s)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.orgUnit,t))}async categoryBlockedForAncestor(e,t,i,r,...n){return(await this.listForOrgUnit(e,t,...n)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||ae(e.blockedFromAncestor,i)))}}class Ge extends ye{constructor(){super(Ke)}async createTenant(e,...t){return this.create({slug:e.slug,name:e.name,isolationTier:e.isolationTier??B.Pooled},...t)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...i){return this.updateOne(e,{name:t},...i)}async changeSlug(e,t,...i){return this.updateOne(e,{slug:t},...i)}async setIsolationTier(e,t,...i){return this.updateOne(e,{isolationTier:t},...i)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function Ne(e,t,...i){for(const r of t)await e.deleteById(r.id,...i)}class $e extends ye{constructor(){super(Ue)}orgUnitPath(e,t){const i=de(t);return e?`${e.replace(/\/+$/,"")}/${i}`:"/"+i}async createProfileIfNeeded(e,t,i,...r){t&&await(new De).createProfile(e,t,i,...r)}async createRoot(e,t,i,r,n,...s){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:i},...s);return await this.createProfileIfNeeded(o.id,r,n,...s),await(new Ce).createSelfLink(e,o.id,...s),o}async createChild(e,...t){const i=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:i?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(i?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const n=new Ce;return await n.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await n.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async listDescendantOrgUnits(e,t,i=!1,...r){const n=await(new Ce).listDescendants(e,t,...r),s=new Set(n.map(e=>ue(e.descendant)));return i&&s.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>s.has(e.id))}async listAncestorOrgUnits(e,t,i=!1,...r){const n=await(new Ce).listAncestors(e,t,...r),s=new Set(n.map(e=>ue(e.ancestor)));return i&&s.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>s.has(e.id))}async renameOrgUnit(e,t,...i){const r=await this.getById(e,...i);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...i)}async moveOrgUnit(e,t,i,...r){const n=await this.getById(i,...r),s=await this.getById(t,...r),o=await this.updateOne(t,{parent:n.id,path:this.orgUnitPath(n.path,s.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const i=new Ce,r=await i.listAll(...t);await Ne(i,r.filter(t=>oe(t.tenant,e)),...t);const n=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of n)await i.createSelfLink(e,r.id,...t),r.parent&&await i.insertAncestorLinksForNewChild(e,ue(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...i){const r=new Ce,n=await this.listDescendantOrgUnits(e,t,!0,...i),s=new Set(n.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...i)).filter(e=>s.has(e.id));await Ne(this,o,...i),await r.deleteLinksForSubtree(e,t,...i)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object,String,Object,Object]),K("design:returntype",Promise)],$e.prototype,"createRoot",null),P([m(),K("design:type",Function),K("design:paramtypes",[Object,Object]),K("design:returntype",Promise)],$e.prototype,"createChild",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],$e.prototype,"moveOrgUnit",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,Object]),K("design:returntype",Promise)],$e.prototype,"rebuildTenantClosure",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object]),K("design:returntype",Promise)],$e.prototype,"deleteOrgUnitTree",null);class Le extends ye{constructor(){super(me)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...i){return this.updateOne(e,{displayName:t},...i)}async updateEmail(e,t,...i){return this.updateOne(e,{email:t},...i)}async updatePhone(e,t,...i){return this.updateOne(e,{phone:t},...i)}}class ze extends ye{constructor(){super(Ie)}async createPrincipal(e,t,i,...r){return this.create({tenant:e,kind:t,subjectId:i},...r)}async getForSubject(e,t,i,...r){return(await this.listAll(...r)).find(r=>oe(r.tenant,e)&&r.kind===t&&r.subjectId===i)}async getOrCreateForSubject(e,t,i,...r){return await this.getForSubject(e,t,i,...r)??await this.createPrincipal(e,t,i,...r)}async getUserPrincipal(e,t,...i){return this.getOrCreateForSubject(e,C.User,t,...i)}async getGroupPrincipal(e,t,...i){return this.getOrCreateForSubject(e,C.Group,t,...i)}}class Me extends ye{constructor(){super(he)}async addUserToTenant(e,t,i=D.Active,...r){return this.create({tenant:e,user:t,status:i},...r)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class qe extends ye{constructor(){super(fe)}async addUserToOrgUnit(e,t,i,r=D.Active,...n){return this.create({tenant:e,orgUnit:t,user:i,status:r},...n)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class We extends ye{constructor(){super(Te)}async createGroup(e,t,i,r,...n){return this.create({tenant:e,orgUnit:i,name:t,metadata:r},...n)}async renameGroup(e,t,...i){return this.updateOne(e,{name:t},...i)}async moveGroupToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}}class Ve extends ye{constructor(){super(Re)}async addPrincipalToGroup(e,t,i,r,...n){return this.create({tenant:e,group:t,principal:i,metadata:r},...n)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const i=new ze,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=ue(e.tenant),n=ue(e.group);return(await i.getGroupPrincipal(r,n,...t)).id}))}}class Ze extends ye{constructor(){super(we)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...i){return this.updateOne(e,{description:t},...i)}}class Qe extends ye{constructor(){super(Se)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const i=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!i)throw Error(`Role "${e}" not found`);return i}async getTenantRoleByKey(e,t,...i){const r=(await this.listAll(...i)).find(i=>oe(i.tenant,e)&&i.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...i){return this.updateOne(e,{name:t},...i)}async updateRoleMetadata(e,t,...i){return this.updateOne(e,{metadata:t},...i)}async listTenantRoles(e,t=!1,...i){return(await this.listAll(...i)).filter(i=>t&&!i.tenant||oe(i.tenant,e))}}class Je extends ye{constructor(){super(be)}async addPermissionToRole(e,t,...i){return this.create({role:e,permission:t},...i)}async addPermissionKeyToRole(e,t,...i){const r=await(new Ze).getByKey(t,...i);return this.addPermissionToRole(e,r.id,...i)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.permission,e))}async replaceRolePermissions(e,t,...i){const r=await this.listRolePermissions(e,...i);return await(async(e,t,...i)=>{for(const r of t)await e.deleteById(r.id,...i)})(this,r,...i),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...i)))}async createRoleWithPermissions(e,t,...i){const r=await(new Qe).createRole(e,...i);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...i);return r}}class He extends ye{constructor(){super(Ae)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async updateAssignmentWindow(e,t,i,...r){return this.updateOne(e,{startsAt:t,expiresAt:i},...r)}}class Xe extends ye{constructor(){super(xe)}async listForPrincipal(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async listForScope(e,t,i,...r){return(await this.listAll(...r)).filter(r=>oe(r.tenant,e)&&r.scopeKind===t&&r.scopeId===i)}async hasPermission(e,t,i,r,n,s,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==i||e.scopeKind!==r||e.scopeId!==n||e.startsAt&&s&&e.startsAt>s||e.expiresAt&&s&&e.expiresAt<s))}async deleteForPrincipal(e,t,...i){for(const r of await this.listForPrincipal(e,t,...i))await this.deleteById(r.id,...i)}async deleteForTenant(e,...t){for(const i of(await this.listAll(...t)).filter(t=>oe(t.tenant,e)))await this.deleteById(i.id,...t)}async rebuildForPrincipal(e,t,...i){await this.deleteForPrincipal(e,t,...i);const r=new He,n=new Je,s=new Ze,o=new Ve,a=new ze,d=new Ce,c=new Ee,p=[],y=await r.listPrincipalAssignments(e,t,...i),l=await o.listPrincipalGroups(t,...i),u=[...y,...(await Promise.all(l.map(async t=>{const n=await a.getGroupPrincipal(ue(t.tenant),ue(t.group),...i);return r.listPrincipalAssignments(e,n.id,...i)}))).flat()];for(const r of u){const o=await n.listRolePermissions(ue(r.role),...i),a=await Promise.all(o.map(async e=>s.findOneBy("id",ue(e.permission),...i)));for(const n of a){if(!n)continue;const s=r.scopeKind,o=r.scopeId,a=[];if(s===E.Tenant)a.push({scopeKind:s,scopeId:e});else if(s===E.Resource)a.push({scopeKind:s,scopeId:o});else if(s!==E.OrgUnit||r.inheritDown){if(s===E.OrgUnit&&r.inheritDown){const t=await d.listDescendants(e,o,...i);a.push(...t.map(e=>({scopeKind:s,scopeId:ue(e.descendant)})))}}else a.push({scopeKind:s,scopeId:o});for(const d of a)s===E.OrgUnit&&r.inheritDown&&d.scopeId!==o&&await c.categoryBlockedForAncestor(e,d.scopeId,o,n.category,...i)||p.push({id:"",tenantId:e,principalId:t,permissionKey:n.key,scopeKind:d.scopeKind,scopeId:d.scopeId,sourceKind:"role_assignment",sourceId:r.id,startsAt:r.startsAt,expiresAt:r.expiresAt})}}return await Promise.all(p.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...i)))}async rebuildForTenant(e,...t){const i=(await(new ze).listAll(...t)).filter(t=>oe(t.tenant,e));for(const r of i)await this.rebuildForPrincipal(e,r.id,...t)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object]),K("design:returntype",Promise)],Xe.prototype,"rebuildForPrincipal",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,Object]),K("design:returntype",Promise)],Xe.prototype,"rebuildForTenant",null);class Ye extends ye{constructor(){super(_e)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,i,...r){return(await this.listAll(...r)).find(r=>oe(r.tenant,e)&&r.resourceType===t&&r.resourceId===i)}async moveResourceToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async setVisibility(e,t,...i){return this.updateOne(e,{visibility:t},...i)}async transferOwnership(e,t,...i){return this.updateOne(e,{owner:t},...i)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}}class et extends ye{constructor(){super(Oe)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.resource,e))}async listPrincipalGrants(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async hasGrant(e,t,i,r,n,...s){return(await this.listPrincipalGrants(e,t,...s)).some(e=>ae(e.resource,i)&&e.permissionKey===r&&(!e.startsAt||!n||e.startsAt<=n)&&(!e.expiresAt||!n||e.expiresAt>=n))}async deleteAllForResource(e,...t){for(const i of await this.listResourceGrants(e,...t))await this.deleteById(i.id,...t)}}class tt{async unregisterResource(e,...t){await(new et).deleteAllForResource(e,...t),await(new Ye).deleteById(e,...t)}async resolveResourceScope(e,...t){const i=await(new Ye).getById(e,...t);return{tenantId:ue(i.tenant),orgUnitId:ue(i.orgUnit),visibility:i.visibility,ownerPrincipalId:i.owner?ue(i.owner):void 0}}}class it extends ye{constructor(){super(Pe)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>ue(t.tenant)===e)}async getBinding(e,t,...i){return(await this.listTenantBindings(e,...i)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...i){return this.updateOne(e,{config:t},...i)}async promoteToDedicated(e,t,i,r,...n){return this.updateOne(e,{bindingKind:L.Dedicated,bindingKey:t,region:i,config:r},...n)}async setShared(e,t,i,r,...n){return this.updateOne(e,{bindingKind:L.Shared,bindingKey:t,region:i,config:r},...n)}}class rt{constructor(){this.tenantService=new Ge,this.tenantProfileService=new Be,this.orgUnitService=new $e,this.orgUnitProfileService=new De,this.userService=new Le,this.membershipService=new Me,this.principalService=new ze,this.permissionService=new Ze,this.roleService=new Qe,this.rolePermissionService=new Je,this.roleAssignmentService=new He,this.effectivePermissionService=new Xe}async bootstrapTenantFromTemplate(e,...t){const i=await this.tenantService.createTenant(e.tenant,...t);e.tenant.profileKey&&await this.tenantProfileService.createProfile(i.id,e.tenant.profileKey,e.tenant.profileMetadata,...t);const r=async(e,n)=>{const s=void 0===e?await this.orgUnitService.createRoot(i.id,n.name,n.metadata,n.profileKey,n.metadata,...t):await this.orgUnitService.createChild({tenantId:i.id,parentOrgUnitId:e,name:n.name,metadata:n.metadata,profileKey:n.profileKey,profileMetadata:n.metadata},...t);for(const e of n.children??[])await r(s.id,e);return s},n=await r(void 0,e.rootOrgUnit),s=await this.userService.createUser(e.ownerUser,...t);await this.membershipService.addUserToTenant(i.id,s.id,D.Active,...t);const o=await this.principalService.getUserPrincipal(i.id,s.id,...t);for(const i of e.permissions)await this.permissionService.createPermission(i,...t);for(const r of e.roles){const e=await this.roleService.createRole({tenantId:i.id,key:r.key,name:r.name,description:r.description},...t);for(const i of r.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(e.id,i,...t)}const a=await this.roleService.getTenantRoleByKey(i.id,e.ownerRoleKey,...t);return await this.roleAssignmentService.assignRole({tenantId:i.id,principalId:o.id,roleId:a.id,scopeKind:E.OrgUnit,scopeId:n.id,inheritDown:!0},...t),await this.effectivePermissionService.rebuildForPrincipal(i.id,o.id,...t),{tenantId:i.id,rootOrgUnitId:n.id,ownerUserId:s.id,ownerPrincipalId:o.id}}}P([m(),K("design:type",Function),K("design:paramtypes",[Object,Object]),K("design:returntype",Promise)],rt.prototype,"bootstrapTenantFromTemplate",null);class nt{constructor(){this.membershipService=new Me,this.orgMembershipService=new qe,this.principalService=new ze,this.roleService=new Qe,this.roleAssignmentService=new He,this.effectivePermissionService=new Xe}async onboardUserToTenantAndOrgUnit(e,t,i,r,...n){await this.membershipService.addUserToTenant(e,t,D.Active,...n),await this.orgMembershipService.addUserToOrgUnit(e,i,t,D.Active,...n);const s=await this.principalService.getUserPrincipal(e,t,...n),o=await this.roleService.getTenantRoleByKey(e,r,...n);return await this.roleAssignmentService.assignRole({tenantId:e,principalId:s.id,roleId:o.id,scopeKind:E.OrgUnit,scopeId:i,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(e,s.id,...n),{principalId:s.id}}async changeUserOrgRole(e,t,i,r,n,...s){const o=await this.roleService.getTenantRoleByKey(e,r,...s),a=await this.roleAssignmentService.listPrincipalAssignments(e,t,...s);for(const e of a.filter(e=>e.scopeKind===E.OrgUnit&&e.scopeId===i))await this.roleAssignmentService.revokeAssignment(e.id,...s);await this.roleAssignmentService.assignRole({tenantId:e,principalId:t,roleId:o.id,scopeKind:E.OrgUnit,scopeId:i,inheritDown:n},...s),await this.effectivePermissionService.rebuildForPrincipal(e,t,...s)}async suspendUserInTenant(e,t,i,...r){await this.membershipService.setStatus(e,D.Suspended,...r),await this.effectivePermissionService.deleteForPrincipal(t,i,...r)}async reactivateUserInTenant(e,t,i,...r){await this.membershipService.setStatus(e,D.Active,...r),await this.effectivePermissionService.rebuildForPrincipal(t,i,...r)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"onboardUserToTenantAndOrgUnit",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,String,Boolean,Object]),K("design:returntype",Promise)],nt.prototype,"changeUserOrgRole",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"suspendUserInTenant",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"reactivateUserInTenant",null);class st{constructor(e={}){this.dataSources=e}async canAccess(e,...t){const i=e.at??new Date;if(e.scopeKind&&e.scopeId)return se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,e.scopeKind,e.scopeId))).some(t=>t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt));if(!e.resourceProtectedId)return!1;const r=await(this.dataSources.loadResource?.(e.tenantId,e.resourceProtectedId));if(!r)return!1;if(r.tenantId!==e.tenantId)return!1;if(r.ownerPrincipalId===e.principalId)return!0;if(se(await(this.dataSources.listResourceGrants?.(e.tenantId,e.resourceProtectedId))).filter(t=>t.principalId===e.principalId&&t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt)).length>0)return!0;const n=r.visibility;return n!==N.Private&&n!==N.ResourceAcl&&(n===N.OrgUnit||n===N.OrgSubtree?se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,E.OrgUnit,r.orgUnitId))).some(t=>t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt)):n===N.Tenant&&se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,E.Tenant,e.tenantId))).some(t=>t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt)))}async requireAccess(e,...t){if(!await this.canAccess(e,...t))throw new f(`Access denied for ${e.permissionKey} on ${e.resourceProtectedId??(i=e.scopeKind??E.Resource,r=e.scopeId??"",`${i}:${r}`)}`);var i,r}async buildAccessContext(e,t,...i){return pe({tenantId:e,principalId:t,permissions:se(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:se(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,i,...r){const n=await this.buildAccessContext(e,t,...r),s=n.allowedOrgUnitIdsByPermission[i]??[],o=n.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId);return te({tenantId:e,principalId:t,permissionKey:i,allowedOrgUnitIds:s,allowedResourceIds:o})}async buildQdrantFilter(e,t,i,...r){const n=await this.buildAccessContext(e,t,...r);return ie({tenantId:e,principalId:t,allowedOrgUnitIds:n.allowedOrgUnitIdsByPermission[i]??[],allowedResourceIds:n.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId)})}}const ot="featureFlag",at="FEATURE_FLAG",dt="feature-flags:model",ct="feature-flags:auth",pt="feature-flags:block",yt="feature-flags:render-if",lt="feature-flags:hide-on";function ut(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const i=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===i.length)return t;const[r,...n]=i;return[r,...n.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function gt(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ht(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return gt(e);const t={};return Object.entries(e).forEach(([e,i])=>{const r=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[i,...r]=t;return[i.toLowerCase(),...r.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==i&&(t[r]=ht(i)??i)}),t}function mt(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,i])=>{const r=ut(t),n=ht(i);return void 0!==n&&(e[r]=n),e},{})}function ft(e){return!0===e||!!e&&"object"==typeof e}function vt(e,t){return ft(e?.[ut(t)])}function wt(e,t="any"){return{features:[...new Set(e.map(ut).filter(Boolean))],match:t}}function bt(e,t){if(!e||0===e.features.length)return!0;const i=e.features.filter(e=>vt(t,e));return"all"===e.match?i.length===e.features.length:i.length>0}function St(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>vt(t,e))}function At(e,t){return k.get(e,t)}function Ot(e){return e.trim().toLowerCase()}function It(e){return e.trim()}const _t=i.accumulate({[ot]:{}});async function jt(e=_t){return mt(e.featureFlag)}async function Ut(e,t=_t){return(await jt(t))[ut(e)]}async function Pt(e,t=_t){return!!await Ut(e,t)}let Kt=class extends v{constructor(e){super(e),this.enabled=!0}};P([a(),d(),K("design:type",String)],Kt.prototype,"id",void 0),P([g(),I(),p(),K("design:type",String)],Kt.prototype,"key",void 0),P([p(),K("design:type",Boolean)],Kt.prototype,"enabled",void 0),P([p(),K("design:type",String)],Kt.prototype,"description",void 0),P([p(),K("design:type",String)],Kt.prototype,"scope",void 0),P([p(),K("design:type",Object)],Kt.prototype,"metadata",void 0),P([p(),K("design:type",Object)],Kt.prototype,"config",void 0),P([p(),K("design:type",String)],Kt.prototype,"createdBy",void 0),P([p(),K("design:type",String)],Kt.prototype,"updatedBy",void 0),P([y(),K("design:type",Date)],Kt.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Kt.prototype,"updatedAt",void 0),Kt=P([u("feature_flags"),U(),K("design:paramtypes",[Object])],Kt);let kt=class extends v{constructor(e){super(e),this.enabled=!0}};P([a(),d(),K("design:type",String)],kt.prototype,"id",void 0),P([I(),p(),K("design:type",String)],kt.prototype,"featureKey",void 0),P([I(),p(),K("design:type",String)],kt.prototype,"subjectType",void 0),P([I(),p(),K("design:type",String)],kt.prototype,"subjectKey",void 0),P([p(),K("design:type",Boolean)],kt.prototype,"enabled",void 0),P([p(),K("design:type",Object)],kt.prototype,"metadata",void 0),P([p(),K("design:type",String)],kt.prototype,"createdBy",void 0),P([p(),K("design:type",String)],kt.prototype,"updatedBy",void 0),P([y(),K("design:type",Date)],kt.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],kt.prototype,"updatedAt",void 0),kt=P([u("feature_flag_access"),U(),K("design:paramtypes",[Object])],kt);class Ft{async readOne(e,t){return(await this.read(t))[ut(e)]}}class Rt extends Ft{async read(e={}){return jt(e.source??{[ot]:{}})}}let Tt=class extends o{constructor(){super(Kt),this.reader=new Rt,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Rt;const i={...t.readerConfig??{},source:t.readerConfig?.source??_t};return this.cachedRegistry=await this.refreshCachedRegistry(i,...e),{config:{...t,reader:this.reader,readerConfig:i},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,i])=>(e[t]=i&&"object"==typeof i&&!Array.isArray(i)?{...i}:i,e),{})}async refreshCachedRegistry(e={},...t){const i=await this.reader.read({...e,source:e.source??_t});let r=[];try{r=await this.repo.select().execute(...t)}catch{r=[]}const n=this.cloneRegistry(i);for(const e of r)n[e.key]=!!e.enabled&&(e.config??!0);return n}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??S.forModel(kt)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:ut(e.featureKey),subjectType:Ot(e.subjectType),subjectKey:It(e.subjectKey)}}buildAccessCondition(e){let t=A.attr("subjectType").eq(Ot(e.subjectType));return t=t.and(A.attr("subjectKey").eq(It(e.subjectKey))),void 0!==e.enabled&&(t=t.and(A.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(A.attr("featureKey").in(e.featureKeys.map(ut)))),t}async create(e,...t){e.key=ut(e.key),e.enabled??=!0;const i=await super.create(e,...t);return this.setCachedFlag(i),i}async update(e,...t){e.key=ut(e.key),e.enabled??=!0;const i=await super.update(e,...t);return this.setCachedFlag(i),i}async findOneBy(e,t,...i){const r="key"===e&&"string"==typeof t?ut(t):t;return this.repo.findOneBy(e,r,...i)}async readAll(e,...t){const i=await this.repo.readAll(e,...t);for(const e of i)this.setCachedFlag(e);return i}async listEnabled(...e){return this.repo.select().where(A.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(e,...t){const i=this.normalizeFeatureAccessInput(e),r=await this.findFeatureAccess(i,...t).catch(()=>{});return r?this.getAccessRepository().update(Object.assign(r,i),...t):this.getAccessRepository().create(new kt(i),...t)}async revokeFeatureAccess(e,...t){const i=await this.findFeatureAccess(e,...t).catch(()=>{});if(i)return this.getAccessRepository().delete(i.id,...t)}async findFeatureAccess(e,...t){const i=this.buildAccessCondition(e),r=(await this.getAccessRepository().select().where(i).execute(...t))[0];if(!r)throw new n(`Feature access for ${Ot(e.subjectType)}:${It(e.subjectKey)} not found`);return r}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const i=await this.listFeatureAccess({...e,enabled:!0},...t),r=[...new Set(i.map(e=>e.featureKey))];if(0===r.length)return{};const n=A.attr("enabled").eq(!0).and(A.attr("key").in(r.map(ut)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...i){return vt(await this.resolveFeatureFlagsForSubject(t,...i),e)}isEnabled(e){this.assertInitialized();const t=ut(e);return vt(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(e={},...t){this.assertInitialized();const i=await this.reader.read({...e,source:e.source??_t}),r=[];for(const[e,n]of Object.entries(i)){const i=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:s,...o}=i,a=ut(e),d=await this.findOneBy("key",a,...t).catch(()=>{}),c=d?Object.assign(d,{enabled:ft(n),description:o.description??d.description,scope:o.scope??d.scope,metadata:o.metadata??d.metadata,config:{...o,enabled:ft(n)}}):new Kt({key:a,enabled:ft(n),description:o.description,scope:o.scope,metadata:o.metadata,config:{...o,enabled:ft(n)}});r.push(d?await this.update(c,...t):await this.create(c,...t))}return this.cachedRegistry=await this.refreshCachedRegistry({...e,source:e.source??_t},...t),r}};var xt;function Bt(e){const t=ut(e);return t?t.charAt(0).toUpperCase()+t.slice(1):t}function Dt(e,t){const i=Bt(e);return void 0===t?"engine"+i:`engine${i}${Bt(t)}`}function Ct(e){const t={};for(const i of e.engines??[]){t[Dt(i.engineId)]=!0;for(const e of i.capabilities??[])t[Dt(i.engineId,e.feature)]="SUPPORTED"===e.verdict}return t}P([w(kt),K("design:type",Object)],Tt.prototype,"accessRepository",void 0),Tt=P([b(Kt),K("design:paramtypes",[])],Tt);class Et extends Ft{constructor(e){super(),this.registry=e}async read(e){return{...this.registry}}}let Gt=xt=class extends Tt{constructor(){const e=super();if(!(this instanceof xt))return Object.assign(Object.create(xt.prototype),e,{capabilityRegistry:{}});this.capabilityRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.capabilityRegistry=Ct(t.manifest??{engines:[]});const i=new Et(this.capabilityRegistry);return{config:{...t,reader:i,readerConfig:{...t.readerConfig??{},source:{}}},client:i}}isEngineEnabled(e){return vt(this.capabilityRegistry,Dt(e))}isEngineFeatureEnabled(e,t){return vt(this.capabilityRegistry,Dt(e,t))}isEnabled(e){return vt(this.capabilityRegistry,e)}async resolveFeatureFlags(){return{...this.capabilityRegistry}}async resolveFeatureFlagsForSubject(e,...t){return{...this.capabilityRegistry}}async isEnabledForSubject(e,t,...i){return vt(this.capabilityRegistry,e)}async listEnabled(...e){return Object.entries(this.capabilityRegistry).filter(([,e])=>ft(e)).map(([e])=>new Kt({key:e,enabled:!0,config:{enabled:!0}}))}async syncFromEnvironment(...e){throw new r("Engine capability feature flags are derived from the served engine manifest and are never synced from the environment")}};function Nt(e,t){return void 0===t?e:k.key(e,t.toString())}function $t(e,t,i="any"){const r=wt(t,i);return(t,i,n)=>{if(void 0===i)return F(e,r)(t);const s=Nt(e,i);return n?R(s,r)(t,i,n):T(s,r)(t,i)}}function Lt(...e){return $t(dt,e)}function zt(...e){return $t(ct,e)}function Mt(...e){return $t(pt,e)}function qt(...e){return $t(yt,e)}function Wt(...e){return $t(lt,e)}function Vt(e,t,i){return At(e,Nt(t,i))}function Zt(e,t,i,r){return bt(Vt(e,i,r),t)}function Qt(e,t,i,r){return St(Vt(e,i,r),t)}Gt=xt=P([b(),K("design:paramtypes",[])],Gt);const Jt="##VERSION##",Ht="##COMMIT##",Xt="##FULL_VERSION##",Yt="##PACKAGE##";export{ge as AuthorizationModel,st as AuthzService,ye as BaseModelService,rt as BootstrapService,Ht as COMMIT,xe as EffectivePermission,Xe as EffectivePermissionService,Gt as EngineCapabilityFeatureFlagService,Rt as EnvironmeFlagReader,ct as FEATURE_FLAG_AUTH_KEY,pt as FEATURE_FLAG_BLOCK_KEY,at as FEATURE_FLAG_ENV_PREFIX,ot as FEATURE_FLAG_ENV_ROOT,lt as FEATURE_FLAG_HIDE_KEY,dt as FEATURE_FLAG_MODEL_KEY,yt as FEATURE_FLAG_RENDER_KEY,Xt as FULL_VERSION,Kt as FeatureFlag,kt as FeatureFlagAccess,_t as FeatureFlagEnvironment,Ft as FeatureFlagReader,Tt as FeatureFlagService,Te as Group,Re as GroupMembership,Ve as GroupMembershipService,We as GroupService,je as InheritanceBlock,Ee as InheritanceBlockService,B as IsolationTier,z as IsolationTierOptions,D as MembershipStatus,M as MembershipStatusOptions,Ue as OrgUnit,ve as OrgUnitClosure,Ce as OrgUnitClosureService,fe as OrgUnitMembership,qe as OrgUnitMembershipService,Fe as OrgUnitProfile,De as OrgUnitProfileService,$e as OrgUnitService,Yt as PACKAGE_NAME,we as Permission,G as PermissionCategory,V as PermissionCategoryOptions,Ze as PermissionService,Ie as Principal,C as PrincipalKind,q as PrincipalKindOptions,ze as PrincipalService,_e as ProtectedResource,Ye as ProtectedResourceService,Y as REL_CASCADE_DEPENDENT,ee as REL_CASCADE_INSERT_UPDATE,X as REL_NULLIFY,H as REL_RESTRICT,Oe as ResourceGrant,et as ResourceGrantService,tt as ResourceLifecycleService,N as ResourceVisibility,Z as ResourceVisibilityOptions,Se as Role,Ae as RoleAssignment,He as RoleAssignmentService,be as RolePermission,Je as RolePermissionService,Qe as RoleService,E as ScopeKind,W as ScopeKindOptions,Pe as StorageBinding,L as StorageBindingKind,J as StorageBindingKindOptions,it as StorageBindingService,$ as StorageKind,Q as StorageKindOptions,nt as SystemManagementService,Ke as Tenant,he as TenantMembership,Me as TenantMembershipService,ke as TenantProfile,Be as TenantProfileService,Ge as TenantService,me as User,Le as UserService,Jt as VERSION,se as asArray,Mt as blockFeatureOperations,pe as buildAccessContext,te as buildArangoContext,ie as buildQdrantFilter,Dt as engineCapabilityFlagKey,Ct as engineCapabilityFlagRegistry,x as execWithLogging,zt as featureAuth,Lt as featureFlags,Vt as getFeatureGateMetadata,Pt as hasFeatureFlagInEnvironment,Wt as hideOnFeature,le as id,ft as isFeatureFlagEnabled,vt as isFeatureFlagEnabledByName,St as isFeatureRuleBlocked,bt as isFeatureRuleSatisfied,ce as isTimeValid,jt as loadFeatureFlagsFromEnvironment,de as lowerSlug,ht as normalizeFeatureConfig,ut as normalizeFeatureName,mt as normalizeFeatureRegistry,wt as normalizeFeatureRule,It as normalizeFeatureSubjectKey,Ot as normalizeFeatureSubjectType,ne as nowIso,gt as parseRuntimeValue,At as readMetadata,ue as relationId,ae as relationMatch,qt as renderIfFeature,Ut as resolveFeatureFlagFromEnvironment,oe as sameTenant,Zt as shouldExposeForFeatures,Qt as shouldHideForFeatures};
 //# sourceMappingURL=integrations.js.map