@decaf-ts/integrations 0.10.8 → 0.11.0

package/README.md

@@ -5,13 +5,12 @@
 ## Exports
 
 - `@decaf-ts/integrations`
-- `@decaf-ts/integrations/graph`
-- `@decaf-ts/integrations/graph/shared`
-- `@decaf-ts/integrations/nest/graph`
 - `@decaf-ts/integrations/keycloak`
 - `@decaf-ts/integrations/kibana`
 - `@decaf-ts/integrations/nest`
 - `@decaf-ts/integrations/namespaces`
+- `@decaf-ts/integrations/feature-flags`
+- `@decaf-ts/integrations/redis`
 - `@decaf-ts/integrations/loader`
 - `@decaf-ts/integrations/plugins`
 - `@decaf-ts/integrations/plugins/kibana`
@@ -19,14 +18,87 @@
 
 ## Included Modules
 
-- Graph engine, backend node catalogue, and run lifecycle (DECAF-50). The engine executes canonical `GraphWorkflowDocument`s only: the nine-stage validation gate resolves every node kind against the trusted backend catalogue, rejects inline client definitions (`node`/`definition`/`executor`/`execute`/`ports`/`component` fields), and rejects unsafe prototype keys (`__proto__`/`prototype`/`constructor`). Node executors implement the §4.9 request contract (`GraphNodeExecutionRequest` separates `parameters`/`credentials`/`metadata` from `inputs`); the legacy input-only executor adapter was removed at the P7 cutover. The Nest module exposes the catalogue API (`GET /graph/node-types*`), document persistence (`PUT|GET /graph/workflows/{id}`, `POST /graph/workflows/validate`), and the asynchronous run lifecycle (`POST /graph/runs` → `202` with `eventsUrl`/`resultUrl`, run-scoped authorized replayable SSE via `GET /graph/runs/{runId}/events`, `DELETE /graph/runs/{runId}` for cancellation). `POST /graph/execute` and the global `GET /graph/events` stream are deprecated (kept, not removed): the run lifecycle is the primary execution path. The `GRAPH_CANONICAL_DOCUMENT_ENABLED` rollout flag was removed at cutover — the canonical path is the sole default.
 - Keycloak provisioning helpers for realms, users, roles, identity providers, and client-scoped role wiring.
 - Kibana provisioning helpers for spaces, data views, dashboards, and realm-specific access control, including a fluent `KibanaIndexBuilder` (Builder Pattern) for constructing index pattern configurations with exact match, prefix/glob, and logger-generated matching modes.
 - Nest-style JWT helpers for extracting Keycloak roles, namespace scopes, and user context from access tokens, plus the `namespace(...)` model decorator for auth-scoped metadata.
 - Org-based authorization scaffolds for tenants, org units, principals, roles, permissions, grants, effective permissions, storage bindings, and authorization payload filters.
-- Dynamic object-loading helpers for models, adapters, repositories, services, controllers, environment objects, Angular components, and graph nodes.
+- Feature-flag models, readers, services, decorators, and environment helpers, including the engine-capability-derived `EngineCapabilityFeatureFlagService` (see [Feature flags](#feature-flags)).
+- Dynamic object-loading helpers for models, adapters, repositories, services, controllers, environment objects, and Angular components.
+- Redis (and Redis-compatible, e.g. DragonflyDB) persistence adapter: `RedisAdapter`, query statement/paginator, pub/sub event dispatch, and a `RedisContextLock` backing `@transactional()`.
 - BI dashboard embed plugins (Kibana + Superset) with a shared DOM-free `DashboardEmbedPlugin` contract. The Kibana plugin is generated source + installer; the Superset plugin is a patch-and-build strategy that modifies Superset's internal embedded frontend and SDK source. Both expose the exact same API and are org-agnostic (no space switching).
 
+## Redis adapter
+
+The `./redis` export adds a Redis (and any Redis-compatible server, such as DragonflyDB) persistence adapter. Each model table is stored as a single Redis hash (`<prefix>:<table>`, default prefix `decaf:redis`) whose fields are record ids and whose values are serialized records. Because Redis hashes are not queryable, queries load the matching table and apply filtering, sorting, aggregation and pagination in JavaScript, mirroring the core RAM adapter.
+
+```ts
+import { RedisAdapter } from "@decaf-ts/integrations/redis";
+
+const adapter = new RedisAdapter({ url: "redis://localhost:6379", user: "johndoe" });
+await adapter.initialize();
+
+const repo = new (adapter.repository<User>())(User, adapter);
+await repo.create(new User({ name: "John" }));
+```
+
+`RedisConfig` accepts a full `url` connection string (it takes precedence) or the discrete `host`, `port`, `username`, `password`, and `database` fields, plus `prefix` (key namespace, defaults to `decaf:redis`) and `user` (identity stamped on created/updated records).
+
+### Local test setup
+
+`npm run prepare-it-tests` boots the DragonflyDB container from `docker/dragonfly-compose.yml` on `localhost:6379` (or run `docker compose -f docker/dragonfly-compose.yml up -d --wait` directly), then run the integration tests with `npm run test:integration`.
+
+### Behaviour and limitations
+
+- Queries are evaluated in JavaScript over loaded tables (RAM-adapter semantics); sorting and aggregation are not pushed down to the server.
+- `@transactional()` is backed by `RedisContextLock`, which buffers writes on a dedicated connection and commits them atomically with `WATCH`/`MULTI`/`EXEC` optimistic locking.
+- `createdBy`/`updatedBy` stamps require a user identity: pass `user` in the adapter config (or an explicit `UUID` flag), otherwise user identification throws `UnsupportedError`.
+- Observer events are broadcast on the `decaf:redis:events` pub/sub channel so every process sharing the database refreshes its observers.
+
+## Feature flags
+
+The `./feature-flags` export (also re-exported from the package root) provides feature-flag models, readers, a repository/environment-backed `FeatureFlagService`, access-control decorators, and the capability-derived `EngineCapabilityFeatureFlagService`.
+
+`EngineCapabilityFeatureFlagService` is a `FeatureFlagService` subclass whose flag values are derived exclusively from a served graph-engine capability manifest — the same shape the as-graph server serves at `GET /graph/engines` (per engine: `engineId` plus `capabilities: [{ feature, verdict }]`, and `defaultEngineId`). Flags are never read from the environment and never from the persistence repository: `syncFromEnvironment()` fails closed with an `InternalError` instead of reading the environment.
+
+Resolution is fail-closed:
+
+- An engine key (`engine<Pascal(engineId)>`) is enabled when the engine appears in the manifest.
+- A feature key (`engine<Pascal(engineId)><Pascal(feature)>`) is enabled **only** when the manifest declares that feature `SUPPORTED`. `NOT_SUPPORTED` and `EXTENSION_POINT` verdicts, and features absent from the manifest, resolve to disabled.
+- Build keys with the `engineCapabilityFlagKey(engineId, feature?)` helper rather than assembling them by hand, or derive a whole registry from a manifest with `engineCapabilityFlagRegistry(manifest)`.
+
+```ts
+import { EngineCapabilityFeatureFlagService } from "@decaf-ts/integrations/feature-flags";
+
+const flags = new EngineCapabilityFeatureFlagService();
+await flags.initialize({
+  manifest: {
+    engines: [
+      {
+        engineId: "local",
+        capabilities: [
+          { feature: "codeMode", verdict: "SUPPORTED" },
+          { feature: "workflowList", verdict: "SUPPORTED" },
+          { feature: "workflowLookup", verdict: "SUPPORTED" },
+        ],
+      },
+      {
+        engineId: "dagster",
+        capabilities: [{ feature: "suspendResume", verdict: "NOT_SUPPORTED" }],
+      },
+    ],
+    defaultEngineId: "local",
+  },
+});
+
+flags.isEngineEnabled("local");                        // true
+flags.isEngineFeatureEnabled("local", "codeMode");     // true
+flags.isEngineFeatureEnabled("dagster", "suspendResume"); // false (fail closed)
+flags.isEngineFeatureEnabled("mastra", "pinning");     // false (undeclared engine)
+flags.isEnabled("engineLocalWorkflowList");            // true
+```
+
+The manifest input is a structural subset of the as-graph manifest, so no import of the as-graph package is required and the dependency direction is preserved. All read paths (`isEnabled`, `resolveFeatureFlags`, `isEnabledForSubject`, `resolveFeatureFlagsForSubject`) resolve against the derived registry only, and `listEnabled()` returns the enabled flags as `FeatureFlag` models without touching a repository.
+
 ## Notes
 
 - Each subpath can be imported independently.

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="9f5df0a",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.10.7-9f5df0a",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.10.7",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
+var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},F={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},P={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},T={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function R(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function U(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return x(e)===t}function k(e,t){return!!t&&x(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function E(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function C(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class M extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function x(e){return"string"==typeof e?e:e.id}class q extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,P,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,P,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,P,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,F,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,P,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,F,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,F,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,P,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,F,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends q{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends M{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends M{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends M{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>x(e.descendant))]),n=new Set([t,...a.map(e=>x(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(x(t.descendant))||n.has(x(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends M{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends M{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends M{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>x(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>x(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,x(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends M{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends M{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends M{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends M{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends M{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=x(e.tenant),i=x(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends M{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends M{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends M{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends M{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends M{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(x(e.tenant),x(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(x(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",x(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:x(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends M{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends M{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Fe=r.LoggedEnvironment.accumulate({[se]:{}});async function Pe(e=Fe){return me(e.featureFlag)}async function Te(e,t=Fe){return(await Pe(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Re{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Ue extends Re{async read(e={}){return Pe(e.source??{[se]:{}})}}var Ie;function je(e){const t=_e(e);return t?t.charAt(0).toUpperCase()+t.slice(1):t}function Ke(e,t){const r=je(e);return void 0===t?"engine"+r:`engine${r}${je(t)}`}function ke(e){const t={};for(const r of e.engines??[]){t[Ke(r.engineId)]=!0;for(const e of r.capabilities??[])t[Ke(r.engineId,e.feature)]="SUPPORTED"===e.verdict}return t}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Ue,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Ue;const r={...t.readerConfig??{},source:t.readerConfig?.source??Fe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Fe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Fe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Fe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService);class Be extends Re{constructor(e){super(),this.registry=e}async read(e){return{...this.registry}}}function Ee(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function Ce(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ee(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Me(e,t,r){return Oe(e,Ee(t,r))}e.EngineCapabilityFeatureFlagService=Ie=class extends e.FeatureFlagService{constructor(){const e=super();if(!(this instanceof Ie))return Object.assign(Object.create(Ie.prototype),e,{capabilityRegistry:{}});this.capabilityRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.capabilityRegistry=ke(t.manifest??{engines:[]});const r=new Be(this.capabilityRegistry);return{config:{...t,reader:r,readerConfig:{...t.readerConfig??{},source:{}}},client:r}}isEngineEnabled(e){return fe(this.capabilityRegistry,Ke(e))}isEngineFeatureEnabled(e,t){return fe(this.capabilityRegistry,Ke(e,t))}isEnabled(e){return fe(this.capabilityRegistry,e)}async resolveFeatureFlags(){return{...this.capabilityRegistry}}async resolveFeatureFlagsForSubject(e,...t){return{...this.capabilityRegistry}}async isEnabledForSubject(e,t,...r){return fe(this.capabilityRegistry,e)}async listEnabled(...t){return Object.entries(this.capabilityRegistry).filter(([,e])=>he(e)).map(([t])=>new e.FeatureFlag({key:t,enabled:!0,config:{enabled:!0}}))}async syncFromEnvironment(...e){throw new a.InternalError("Engine capability feature flags are derived from the served engine manifest and are never synced from the environment")}},e.EngineCapabilityFeatureFlagService=Ie=o.__decorate([i.service(),o.__metadata("design:paramtypes",[])],e.EngineCapabilityFeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=q,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&E(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&E(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&E(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&E(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return C({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return R({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return U({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=M,e.BootstrapService=ne,e.COMMIT="6c774f8",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Ue,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.10.8-6c774f8",e.FeatureFlagEnvironment=Fe,e.FeatureFlagReader=Re,e.GroupMembershipService=Z,e.GroupService=class extends M{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=P,e.REL_CASCADE_INSERT_UPDATE=T,e.REL_NULLIFY=F,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:x(r.tenant),orgUnitId:x(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?x(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends M{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>x(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.10.8",e.asArray=j,e.blockFeatureOperations=(...e)=>Ce(pe,e),e.buildAccessContext=C,e.buildArangoContext=R,e.buildQdrantFilter=U,e.engineCapabilityFlagKey=Ke,e.engineCapabilityFlagRegistry=ke,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>Ce(ce,e),e.featureFlags=(...e)=>Ce(de,e),e.getFeatureGateMetadata=Me,e.hasFeatureFlagInEnvironment=async(e,t=Fe)=>!!await Te(e,t),e.hideOnFeature=(...e)=>Ce(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=E,e.loadFeatureFlagsFromEnvironment=Pe,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=x,e.relationMatch=k,e.renderIfFeature=(...e)=>Ce(le,e),e.resolveFeatureFlagFromEnvironment=Te,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Me(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Me(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
 //# sourceMappingURL=integrations.cjs.map