@decaf-ts/integrations 0.11.0 → 0.12.0

package/dist/integrations.js

@@ -1,2 +1,2 @@
-import{exec as e}from"child_process";import{LogLevel as t,LoggedEnvironment as i}from"@decaf-ts/logging";import{InternalError as r,NotFoundError as n}from"@decaf-ts/db-decorators";import{Cascade as s,ModelService as o,pk as a,uuid as d,manyToOne as c,column as p,createdAt as y,updatedAt as l,table as u,unique as g,oneToMany as h,transactional as m,AuthorizationError as f,BaseModel as v,repository as w,service as b,Repository as S,Condition as A}from"@decaf-ts/core";export{AuthorizationError,transactional}from"@decaf-ts/core";import{Model as O,required as I,type as _,option as j,model as U}from"@decaf-ts/decorator-validation";import{__decorate as P,__metadata as K}from"tslib";import{Metadata as k,metadata as F,methodMetadata as R,propMetadata as T}from"@decaf-ts/decoration";async function x(i,n,s,o=t.info){return s.debug("Executing: "+i),new Promise((t,a)=>{const d=e(i,n),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),s[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),s.debug(e.trim())}),d.on("close",e=>{0===e?(s.silly("Command completed successfully"),t({stdout:c.join("\n"),stderr:p.join("\n")})):(s.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),a(new r(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{s.critical("Command execution error",e),a(e)})})}var B,D,C,E,G,N,$,L;(e=>{e.Pooled="pooled",e.Bridge="bridge",e.Silo="silo"})(B||(B={})),(e=>{e.Invited="invited",e.Active="active",e.Suspended="suspended",e.Removed="removed"})(D||(D={})),(e=>{e.User="user",e.Group="group",e.ServiceAccount="service_account",e.Agent="agent",e.ApiKey="api_key"})(C||(C={})),(e=>{e.Tenant="tenant",e.OrgUnit="org_unit",e.Resource="resource"})(E||(E={})),(e=>{e.Admin="admin",e.ContentRead="content_read",e.ContentWrite="content_write",e.Memory="memory",e.Graph="graph",e.Vector="vector",e.Export="export",e.Billing="billing",e.Audit="audit",e.Security="security",e.Data="data",e.Automation="automation"})(G||(G={})),(e=>{e.Private="private",e.ResourceAcl="resource_acl",e.OrgUnit="org_unit",e.OrgSubtree="org_subtree",e.Tenant="tenant"})(N||(N={})),(e=>{e.Postgres="postgres",e.Arango="arango",e.Qdrant="qdrant",e.ObjectStorage="object_storage"})($||($={})),(e=>{e.Shared="shared",e.Dedicated="dedicated"})(L||(L={}));const z=Object.values(B),M=Object.values(D),q=Object.values(C),W=Object.values(E),V=Object.values(G),Z=Object.values(N),Q=Object.values($),J=Object.values(L),H={update:s.NONE,delete:s.NONE,nullable:!1},X={update:s.NONE,delete:s.NONE,nullable:!0},Y={update:s.CASCADE,delete:s.CASCADE,nullable:!1},ee={update:s.CASCADE,delete:s.NONE,nullable:!1};function te(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function ie(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function re(e,t){return`${e}:${t}`}function ne(){return new Date}function se(e){return e??[]}function oe(e,t){return ue(e)===t}function ae(e,t){return!!t&&ue(e)===t}function de(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function ce(e,t,i){const r=e??new Date;return!(t&&t>r||i&&r>i)}function pe(e){const t={},i={};for(const r of e.permissions){const e=re(r.scopeKind,r.scopeId);t[e]=t[e]??[],t[e].push(r.permissionKey),r.scopeKind===E.OrgUnit&&(i[r.permissionKey]=i[r.permissionKey]??[],i[r.permissionKey].push(r.scopeId))}return{tenantId:e.tenantId,principalId:e.principalId,permissionsByScope:t,allowedOrgUnitIdsByPermission:i,resourceGrants:e.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class ye extends o{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...i){const r=await this.repo.read(e,...i);return this.repo.update(Object.assign(r,t),...i)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...i){return this.repo.findOneBy(e,t,...i)}async findManyBy(e,t,...i){return this.repo.select().where({[e]:t}).execute(...i)}async listAll(...e){return this.repo.select().execute(...e)}}function le(){return crypto.randomUUID()}function ue(e){return"string"==typeof e?e:e.id}class ge extends O{constructor(e){super(e)}}let he=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],he.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_tenant_memberships_tenant"),I(),K("design:type",Object)],he.prototype,"tenant",void 0),P([c(()=>me,Y,!1,void 0,"fk_tenant_memberships_user"),I(),K("design:type",Object)],he.prototype,"user",void 0),P([I(),_(String),j(M),p(),K("design:type",String)],he.prototype,"status",void 0),P([y(),K("design:type",Date)],he.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],he.prototype,"updatedAt",void 0),he=P([u("tenant_memberships"),U(),K("design:paramtypes",[Object])],he);let me=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],me.prototype,"id",void 0),P([g(),_(String),p(),K("design:type",String)],me.prototype,"email",void 0),P([g(),_(String),p(),K("design:type",String)],me.prototype,"phone",void 0),P([I(),_(String),p(),K("design:type",String)],me.prototype,"displayName",void 0),P([h(()=>he,H,!1),K("design:type",Array)],me.prototype,"tenantMemberships",void 0),P([h(()=>fe,H,!1),K("design:type",Array)],me.prototype,"orgUnitMemberships",void 0),P([y(),K("design:type",Date)],me.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],me.prototype,"updatedAt",void 0),me=P([u("users"),U(),K("design:paramtypes",[Object])],me);let fe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],fe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_org_memberships_tenant"),I(),K("design:type",Object)],fe.prototype,"tenant",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_memberships_org_unit"),I(),K("design:type",Object)],fe.prototype,"orgUnit",void 0),P([c(()=>me,H,!1,void 0,"fk_org_memberships_user"),I(),K("design:type",Object)],fe.prototype,"user",void 0),P([I(),_(String),j(M),p(),K("design:type",String)],fe.prototype,"status",void 0),P([y(),K("design:type",Date)],fe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],fe.prototype,"updatedAt",void 0),fe=P([u("org_unit_memberships"),U(),K("design:paramtypes",[Object])],fe);let ve=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],ve.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_org_closure_tenant"),I(),K("design:type",Object)],ve.prototype,"tenant",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_closure_ancestor"),I(),K("design:type",Object)],ve.prototype,"ancestor",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_closure_descendant"),I(),K("design:type",Object)],ve.prototype,"descendant",void 0),P([I(),_(Number),p(),K("design:type",Number)],ve.prototype,"depth",void 0),P([y(),K("design:type",Date)],ve.prototype,"createdAt",void 0),ve=P([u("org_unit_closure"),U(),K("design:paramtypes",[Object])],ve);let we=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],we.prototype,"id",void 0),P([g(),I(),_(String),p(),K("design:type",String)],we.prototype,"key",void 0),P([I(),_(String),j(V),p(),K("design:type",String)],we.prototype,"category",void 0),P([_(String),p(),K("design:type",String)],we.prototype,"description",void 0),P([h(()=>be,H,!1),K("design:type",Array)],we.prototype,"rolePermissions",void 0),we=P([u("permissions"),U(),K("design:paramtypes",[Object])],we);let be=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],be.prototype,"id",void 0),P([c(()=>Se,Y,!1,void 0,"fk_role_permissions_role"),I(),K("design:type",Object)],be.prototype,"role",void 0),P([c(()=>we,Y,!1,void 0,"fk_role_permissions_permission"),I(),K("design:type",Object)],be.prototype,"permission",void 0),P([y(),K("design:type",Date)],be.prototype,"createdAt",void 0),be=P([u("role_permissions"),U(),K("design:paramtypes",[Object])],be);let Se=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Se.prototype,"id",void 0),P([c(()=>Ke,X,!1,void 0,"fk_roles_tenant"),K("design:type",Object)],Se.prototype,"tenant",void 0),P([I(),_(String),p(),K("design:type",String)],Se.prototype,"key",void 0),P([I(),_(String),p(),K("design:type",String)],Se.prototype,"name",void 0),P([_(String),p(),K("design:type",String)],Se.prototype,"description",void 0),P([_(Object),p(),K("design:type",Object)],Se.prototype,"metadata",void 0),P([h(()=>be,H,!1),K("design:type",Array)],Se.prototype,"rolePermissions",void 0),P([h(()=>Ae,H,!1),K("design:type",Array)],Se.prototype,"assignments",void 0),P([y(),K("design:type",Date)],Se.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Se.prototype,"updatedAt",void 0),Se=P([u("roles"),U(),K("design:paramtypes",[Object])],Se);let Ae=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ae.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_role_assignments_tenant"),I(),K("design:type",Object)],Ae.prototype,"tenant",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_role_assignments_principal"),I(),K("design:type",Object)],Ae.prototype,"principal",void 0),P([c(()=>Se,H,!1,void 0,"fk_role_assignments_role"),I(),K("design:type",Object)],Ae.prototype,"role",void 0),P([I(),_(String),j(W),p(),K("design:type",String)],Ae.prototype,"scopeKind",void 0),P([I(),_(String),p(),K("design:type",String)],Ae.prototype,"scopeId",void 0),P([I(),_(Boolean),p(),K("design:type",Boolean)],Ae.prototype,"inheritDown",void 0),P([p(),K("design:type",Date)],Ae.prototype,"startsAt",void 0),P([p(),K("design:type",Date)],Ae.prototype,"expiresAt",void 0),P([_(Object),p(),K("design:type",Object)],Ae.prototype,"conditions",void 0),P([y(),K("design:type",Date)],Ae.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ae.prototype,"updatedAt",void 0),Ae=P([u("role_assignments"),U(),K("design:paramtypes",[Object])],Ae);let Oe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Oe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_resource_grants_tenant"),I(),K("design:type",Object)],Oe.prototype,"tenant",void 0),P([c(()=>_e,Y,!1,void 0,"fk_resource_grants_resource"),I(),K("design:type",Object)],Oe.prototype,"resource",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_resource_grants_principal"),I(),K("design:type",Object)],Oe.prototype,"principal",void 0),P([I(),_(String),p(),K("design:type",String)],Oe.prototype,"permissionKey",void 0),P([p(),K("design:type",Date)],Oe.prototype,"startsAt",void 0),P([p(),K("design:type",Date)],Oe.prototype,"expiresAt",void 0),P([_(Object),p(),K("design:type",Object)],Oe.prototype,"conditions",void 0),P([c(()=>Ie,H,!1,void 0,"fk_resource_grants_created_by"),K("design:type",Object)],Oe.prototype,"createdBy",void 0),P([y(),K("design:type",Date)],Oe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Oe.prototype,"updatedAt",void 0),Oe=P([u("resource_grants"),U(),K("design:paramtypes",[Object])],Oe);let Ie=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ie.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_principals_tenant"),I(),K("design:type",Object)],Ie.prototype,"tenant",void 0),P([I(),_(String),j(q),p(),K("design:type",String)],Ie.prototype,"kind",void 0),P([I(),_(String),p(),K("design:type",String)],Ie.prototype,"subjectId",void 0),P([h(()=>Ae,H,!1),K("design:type",Array)],Ie.prototype,"roleAssignments",void 0),P([h(()=>Oe,H,!1),K("design:type",Array)],Ie.prototype,"resourceGrants",void 0),P([y(),K("design:type",Date)],Ie.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ie.prototype,"updatedAt",void 0),Ie=P([u("principals"),U(),K("design:paramtypes",[Object])],Ie);let _e=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],_e.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_protected_resources_tenant"),I(),K("design:type",Object)],_e.prototype,"tenant",void 0),P([c(()=>Ue,H,!1,void 0,"fk_protected_resources_org_unit"),I(),K("design:type",Object)],_e.prototype,"orgUnit",void 0),P([I(),_(String),p(),K("design:type",String)],_e.prototype,"resourceType",void 0),P([I(),_(String),p(),K("design:type",String)],_e.prototype,"resourceId",void 0),P([I(),_(String),j(Z),p(),K("design:type",String)],_e.prototype,"visibility",void 0),P([c(()=>Ie,X,!1,void 0,"fk_protected_resources_owner"),K("design:type",Object)],_e.prototype,"owner",void 0),P([_(String),p(),K("design:type",String)],_e.prototype,"sensitivity",void 0),P([_(Object),p(),K("design:type",Object)],_e.prototype,"metadata",void 0),P([h(()=>Oe,H,!1),K("design:type",Array)],_e.prototype,"grants",void 0),P([y(),K("design:type",Date)],_e.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],_e.prototype,"updatedAt",void 0),_e=P([u("protected_resources"),U(),K("design:paramtypes",[Object])],_e);let je=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],je.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_inheritance_blocks_tenant"),I(),K("design:type",Object)],je.prototype,"tenant",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_inheritance_blocks_org_unit"),I(),K("design:type",Object)],je.prototype,"orgUnit",void 0),P([c(()=>Ue,X,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),K("design:type",Object)],je.prototype,"blockedFromAncestor",void 0),P([I(),_(String),j(V),p(),K("design:type",String)],je.prototype,"permissionCategory",void 0),P([_(String),p(),K("design:type",String)],je.prototype,"reason",void 0),P([y(),K("design:type",Date)],je.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],je.prototype,"updatedAt",void 0),je=P([u("inheritance_blocks"),U(),K("design:paramtypes",[Object])],je);let Ue=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ue.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_org_units_tenant"),I(),K("design:type",Object)],Ue.prototype,"tenant",void 0),P([c(()=>Ue,H,!1,void 0,"fk_org_units_parent"),K("design:type",Object)],Ue.prototype,"parent",void 0),P([h(()=>Ue,H,!1),K("design:type",Array)],Ue.prototype,"children",void 0),P([I(),_(String),p(),K("design:type",String)],Ue.prototype,"name",void 0),P([I(),_(String),p(),K("design:type",String)],Ue.prototype,"path",void 0),P([_(Object),p(),K("design:type",Object)],Ue.prototype,"metadata",void 0),P([h(()=>fe,H,!1),K("design:type",Array)],Ue.prototype,"memberships",void 0),P([h(()=>_e,H,!1),K("design:type",Array)],Ue.prototype,"resources",void 0),P([h(()=>je,H,!1),K("design:type",Array)],Ue.prototype,"inheritanceBlocks",void 0),P([h(()=>ve,H,!1),K("design:type",Array)],Ue.prototype,"ancestorLinks",void 0),P([h(()=>ve,H,!1),K("design:type",Array)],Ue.prototype,"descendantLinks",void 0),P([y(),K("design:type",Date)],Ue.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ue.prototype,"updatedAt",void 0),Ue=P([u("org_units"),U(),K("design:paramtypes",[Object])],Ue);let Pe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Pe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_storage_bindings_tenant"),I(),K("design:type",Object)],Pe.prototype,"tenant",void 0),P([I(),_(String),j(Q),p(),K("design:type",String)],Pe.prototype,"storageKind",void 0),P([I(),_(String),j(J),p(),K("design:type",String)],Pe.prototype,"bindingKind",void 0),P([I(),_(String),p(),K("design:type",String)],Pe.prototype,"bindingKey",void 0),P([I(),_(String),p(),K("design:type",String)],Pe.prototype,"region",void 0),P([_(Object),p(),K("design:type",Object)],Pe.prototype,"config",void 0),P([y(),K("design:type",Date)],Pe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Pe.prototype,"updatedAt",void 0),Pe=P([u("storage_bindings"),U(),K("design:paramtypes",[Object])],Pe);let Ke=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Ke.prototype,"id",void 0),P([g(),I(),_(String),p(),K("design:type",String)],Ke.prototype,"slug",void 0),P([I(),_(String),p(),K("design:type",String)],Ke.prototype,"name",void 0),P([I(),_(String),j(z),p(),K("design:type",String)],Ke.prototype,"isolationTier",void 0),P([h(()=>Ue,H,!1),K("design:type",Array)],Ke.prototype,"orgUnits",void 0),P([h(()=>he,H,!1),K("design:type",Array)],Ke.prototype,"memberships",void 0),P([h(()=>Ie,H,!1),K("design:type",Array)],Ke.prototype,"principals",void 0),P([h(()=>Pe,H,!1),K("design:type",Array)],Ke.prototype,"storageBindings",void 0),P([y(),K("design:type",Date)],Ke.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Ke.prototype,"updatedAt",void 0),Ke=P([u("tenants"),U(),K("design:paramtypes",[Object])],Ke);let ke=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],ke.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_tenant_profiles_tenant"),I(),K("design:type",Object)],ke.prototype,"tenant",void 0),P([I(),_(String),p(),K("design:type",String)],ke.prototype,"profileKey",void 0),P([_(Object),p(),K("design:type",Object)],ke.prototype,"metadata",void 0),P([y(),K("design:type",Date)],ke.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],ke.prototype,"updatedAt",void 0),ke=P([u("tenant_profiles"),U(),K("design:paramtypes",[Object])],ke);let Fe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Fe.prototype,"id",void 0),P([c(()=>Ue,Y,!1,void 0,"fk_org_unit_profiles_org_unit"),I(),K("design:type",Object)],Fe.prototype,"orgUnit",void 0),P([I(),_(String),p(),K("design:type",String)],Fe.prototype,"profileKey",void 0),P([_(Object),p(),K("design:type",Object)],Fe.prototype,"metadata",void 0),P([y(),K("design:type",Date)],Fe.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Fe.prototype,"updatedAt",void 0),Fe=P([u("org_unit_profiles"),U(),K("design:paramtypes",[Object])],Fe);let Re=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Re.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_group_memberships_tenant"),I(),K("design:type",Object)],Re.prototype,"tenant",void 0),P([c(()=>Te,Y,!1,void 0,"fk_group_memberships_group"),I(),K("design:type",Object)],Re.prototype,"group",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_group_memberships_principal"),I(),K("design:type",Object)],Re.prototype,"principal",void 0),P([_(Object),p(),K("design:type",Object)],Re.prototype,"metadata",void 0),P([y(),K("design:type",Date)],Re.prototype,"createdAt",void 0),Re=P([u("group_memberships"),U(),K("design:paramtypes",[Object])],Re);let Te=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],Te.prototype,"id",void 0),P([c(()=>Ke,H,!1,void 0,"fk_groups_tenant"),I(),K("design:type",Object)],Te.prototype,"tenant",void 0),P([c(()=>Ue,X,!1,void 0,"fk_groups_org_unit"),K("design:type",Object)],Te.prototype,"orgUnit",void 0),P([I(),_(String),p(),K("design:type",String)],Te.prototype,"name",void 0),P([_(Object),p(),K("design:type",Object)],Te.prototype,"metadata",void 0),P([h(()=>Re,H,!1),K("design:type",Array)],Te.prototype,"members",void 0),P([y(),K("design:type",Date)],Te.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Te.prototype,"updatedAt",void 0),Te=P([u("groups"),U(),K("design:paramtypes",[Object])],Te);let xe=class extends ge{constructor(e){super(e)}};P([a({type:String}),d(),K("design:type",String)],xe.prototype,"id",void 0),P([c(()=>Ke,Y,!1,void 0,"fk_effective_permissions_tenant"),I(),K("design:type",Object)],xe.prototype,"tenant",void 0),P([c(()=>Ie,Y,!1,void 0,"fk_effective_permissions_principal"),I(),K("design:type",Object)],xe.prototype,"principal",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"permissionKey",void 0),P([I(),_(String),j(W),p(),K("design:type",String)],xe.prototype,"scopeKind",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"scopeId",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"sourceKind",void 0),P([I(),_(String),p(),K("design:type",String)],xe.prototype,"sourceId",void 0),P([p(),K("design:type",Date)],xe.prototype,"startsAt",void 0),P([p(),K("design:type",Date)],xe.prototype,"expiresAt",void 0),P([y(),K("design:type",Date)],xe.prototype,"createdAt",void 0),xe=P([u("effective_permissions"),U(),K("design:paramtypes",[Object])],xe);class Be extends ye{constructor(){super(ke)}async createProfile(e,t,i,...r){return this.create({tenant:e,profileKey:t,metadata:i},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async deleteForTenant(e,...t){for(const i of await this.listForTenant(e,...t))await this.deleteById(i.id,...t)}}class De extends ye{constructor(){super(Fe)}async createProfile(e,t,i,...r){return this.create({orgUnit:e,profileKey:t,metadata:i},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}}class Ce extends ye{constructor(){super(ve)}async listAncestors(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,i,...r){return(await this.listAncestors(e,i,...r)).some(e=>ae(e.ancestor,t))}async createSelfLink(e,t,...i){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...i)}async insertAncestorLinksForNewChild(e,t,i,...r){const n=await this.listAncestors(e,t,...r);for(const t of n)await this.create({tenant:e,ancestor:t.ancestor,descendant:i,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...i){const r=await this.listDescendants(e,t,...i),n=new Set([t,...r.map(e=>ue(e.descendant))]),s=new Set([t,...r.map(e=>ue(e.ancestor))]),o=(await this.listAll(...i)).filter(t=>oe(t.tenant,e)&&(n.has(ue(t.descendant))||s.has(ue(t.ancestor))));for(const e of o)await this.deleteById(e.id,...i)}}class Ee extends ye{constructor(){super(je)}async blockCategory(e,t,i,r,n,...s){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:i,reason:n},...s)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.orgUnit,t))}async categoryBlockedForAncestor(e,t,i,r,...n){return(await this.listForOrgUnit(e,t,...n)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||ae(e.blockedFromAncestor,i)))}}class Ge extends ye{constructor(){super(Ke)}async createTenant(e,...t){return this.create({slug:e.slug,name:e.name,isolationTier:e.isolationTier??B.Pooled},...t)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...i){return this.updateOne(e,{name:t},...i)}async changeSlug(e,t,...i){return this.updateOne(e,{slug:t},...i)}async setIsolationTier(e,t,...i){return this.updateOne(e,{isolationTier:t},...i)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function Ne(e,t,...i){for(const r of t)await e.deleteById(r.id,...i)}class $e extends ye{constructor(){super(Ue)}orgUnitPath(e,t){const i=de(t);return e?`${e.replace(/\/+$/,"")}/${i}`:"/"+i}async createProfileIfNeeded(e,t,i,...r){t&&await(new De).createProfile(e,t,i,...r)}async createRoot(e,t,i,r,n,...s){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:i},...s);return await this.createProfileIfNeeded(o.id,r,n,...s),await(new Ce).createSelfLink(e,o.id,...s),o}async createChild(e,...t){const i=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:i?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(i?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const n=new Ce;return await n.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await n.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async listDescendantOrgUnits(e,t,i=!1,...r){const n=await(new Ce).listDescendants(e,t,...r),s=new Set(n.map(e=>ue(e.descendant)));return i&&s.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>s.has(e.id))}async listAncestorOrgUnits(e,t,i=!1,...r){const n=await(new Ce).listAncestors(e,t,...r),s=new Set(n.map(e=>ue(e.ancestor)));return i&&s.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>s.has(e.id))}async renameOrgUnit(e,t,...i){const r=await this.getById(e,...i);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...i)}async moveOrgUnit(e,t,i,...r){const n=await this.getById(i,...r),s=await this.getById(t,...r),o=await this.updateOne(t,{parent:n.id,path:this.orgUnitPath(n.path,s.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const i=new Ce,r=await i.listAll(...t);await Ne(i,r.filter(t=>oe(t.tenant,e)),...t);const n=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of n)await i.createSelfLink(e,r.id,...t),r.parent&&await i.insertAncestorLinksForNewChild(e,ue(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...i){const r=new Ce,n=await this.listDescendantOrgUnits(e,t,!0,...i),s=new Set(n.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...i)).filter(e=>s.has(e.id));await Ne(this,o,...i),await r.deleteLinksForSubtree(e,t,...i)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object,String,Object,Object]),K("design:returntype",Promise)],$e.prototype,"createRoot",null),P([m(),K("design:type",Function),K("design:paramtypes",[Object,Object]),K("design:returntype",Promise)],$e.prototype,"createChild",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],$e.prototype,"moveOrgUnit",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,Object]),K("design:returntype",Promise)],$e.prototype,"rebuildTenantClosure",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object]),K("design:returntype",Promise)],$e.prototype,"deleteOrgUnitTree",null);class Le extends ye{constructor(){super(me)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...i){return this.updateOne(e,{displayName:t},...i)}async updateEmail(e,t,...i){return this.updateOne(e,{email:t},...i)}async updatePhone(e,t,...i){return this.updateOne(e,{phone:t},...i)}}class ze extends ye{constructor(){super(Ie)}async createPrincipal(e,t,i,...r){return this.create({tenant:e,kind:t,subjectId:i},...r)}async getForSubject(e,t,i,...r){return(await this.listAll(...r)).find(r=>oe(r.tenant,e)&&r.kind===t&&r.subjectId===i)}async getOrCreateForSubject(e,t,i,...r){return await this.getForSubject(e,t,i,...r)??await this.createPrincipal(e,t,i,...r)}async getUserPrincipal(e,t,...i){return this.getOrCreateForSubject(e,C.User,t,...i)}async getGroupPrincipal(e,t,...i){return this.getOrCreateForSubject(e,C.Group,t,...i)}}class Me extends ye{constructor(){super(he)}async addUserToTenant(e,t,i=D.Active,...r){return this.create({tenant:e,user:t,status:i},...r)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class qe extends ye{constructor(){super(fe)}async addUserToOrgUnit(e,t,i,r=D.Active,...n){return this.create({tenant:e,orgUnit:t,user:i,status:r},...n)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class We extends ye{constructor(){super(Te)}async createGroup(e,t,i,r,...n){return this.create({tenant:e,orgUnit:i,name:t,metadata:r},...n)}async renameGroup(e,t,...i){return this.updateOne(e,{name:t},...i)}async moveGroupToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}}class Ve extends ye{constructor(){super(Re)}async addPrincipalToGroup(e,t,i,r,...n){return this.create({tenant:e,group:t,principal:i,metadata:r},...n)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const i=new ze,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=ue(e.tenant),n=ue(e.group);return(await i.getGroupPrincipal(r,n,...t)).id}))}}class Ze extends ye{constructor(){super(we)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...i){return this.updateOne(e,{description:t},...i)}}class Qe extends ye{constructor(){super(Se)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const i=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!i)throw Error(`Role "${e}" not found`);return i}async getTenantRoleByKey(e,t,...i){const r=(await this.listAll(...i)).find(i=>oe(i.tenant,e)&&i.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...i){return this.updateOne(e,{name:t},...i)}async updateRoleMetadata(e,t,...i){return this.updateOne(e,{metadata:t},...i)}async listTenantRoles(e,t=!1,...i){return(await this.listAll(...i)).filter(i=>t&&!i.tenant||oe(i.tenant,e))}}class Je extends ye{constructor(){super(be)}async addPermissionToRole(e,t,...i){return this.create({role:e,permission:t},...i)}async addPermissionKeyToRole(e,t,...i){const r=await(new Ze).getByKey(t,...i);return this.addPermissionToRole(e,r.id,...i)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.permission,e))}async replaceRolePermissions(e,t,...i){const r=await this.listRolePermissions(e,...i);return await(async(e,t,...i)=>{for(const r of t)await e.deleteById(r.id,...i)})(this,r,...i),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...i)))}async createRoleWithPermissions(e,t,...i){const r=await(new Qe).createRole(e,...i);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...i);return r}}class He extends ye{constructor(){super(Ae)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}async updateAssignmentWindow(e,t,i,...r){return this.updateOne(e,{startsAt:t,expiresAt:i},...r)}}class Xe extends ye{constructor(){super(xe)}async listForPrincipal(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async listForScope(e,t,i,...r){return(await this.listAll(...r)).filter(r=>oe(r.tenant,e)&&r.scopeKind===t&&r.scopeId===i)}async hasPermission(e,t,i,r,n,s,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==i||e.scopeKind!==r||e.scopeId!==n||e.startsAt&&s&&e.startsAt>s||e.expiresAt&&s&&e.expiresAt<s))}async deleteForPrincipal(e,t,...i){for(const r of await this.listForPrincipal(e,t,...i))await this.deleteById(r.id,...i)}async deleteForTenant(e,...t){for(const i of(await this.listAll(...t)).filter(t=>oe(t.tenant,e)))await this.deleteById(i.id,...t)}async rebuildForPrincipal(e,t,...i){await this.deleteForPrincipal(e,t,...i);const r=new He,n=new Je,s=new Ze,o=new Ve,a=new ze,d=new Ce,c=new Ee,p=[],y=await r.listPrincipalAssignments(e,t,...i),l=await o.listPrincipalGroups(t,...i),u=[...y,...(await Promise.all(l.map(async t=>{const n=await a.getGroupPrincipal(ue(t.tenant),ue(t.group),...i);return r.listPrincipalAssignments(e,n.id,...i)}))).flat()];for(const r of u){const o=await n.listRolePermissions(ue(r.role),...i),a=await Promise.all(o.map(async e=>s.findOneBy("id",ue(e.permission),...i)));for(const n of a){if(!n)continue;const s=r.scopeKind,o=r.scopeId,a=[];if(s===E.Tenant)a.push({scopeKind:s,scopeId:e});else if(s===E.Resource)a.push({scopeKind:s,scopeId:o});else if(s!==E.OrgUnit||r.inheritDown){if(s===E.OrgUnit&&r.inheritDown){const t=await d.listDescendants(e,o,...i);a.push(...t.map(e=>({scopeKind:s,scopeId:ue(e.descendant)})))}}else a.push({scopeKind:s,scopeId:o});for(const d of a)s===E.OrgUnit&&r.inheritDown&&d.scopeId!==o&&await c.categoryBlockedForAncestor(e,d.scopeId,o,n.category,...i)||p.push({id:"",tenantId:e,principalId:t,permissionKey:n.key,scopeKind:d.scopeKind,scopeId:d.scopeId,sourceKind:"role_assignment",sourceId:r.id,startsAt:r.startsAt,expiresAt:r.expiresAt})}}return await Promise.all(p.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...i)))}async rebuildForTenant(e,...t){const i=(await(new ze).listAll(...t)).filter(t=>oe(t.tenant,e));for(const r of i)await this.rebuildForPrincipal(e,r.id,...t)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,Object]),K("design:returntype",Promise)],Xe.prototype,"rebuildForPrincipal",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,Object]),K("design:returntype",Promise)],Xe.prototype,"rebuildForTenant",null);class Ye extends ye{constructor(){super(_e)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,i,...r){return(await this.listAll(...r)).find(r=>oe(r.tenant,e)&&r.resourceType===t&&r.resourceId===i)}async moveResourceToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async setVisibility(e,t,...i){return this.updateOne(e,{visibility:t},...i)}async transferOwnership(e,t,...i){return this.updateOne(e,{owner:t},...i)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>oe(t.tenant,e))}}class et extends ye{constructor(){super(Oe)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>ae(t.resource,e))}async listPrincipalGrants(e,t,...i){return(await this.listAll(...i)).filter(i=>oe(i.tenant,e)&&ae(i.principal,t))}async hasGrant(e,t,i,r,n,...s){return(await this.listPrincipalGrants(e,t,...s)).some(e=>ae(e.resource,i)&&e.permissionKey===r&&(!e.startsAt||!n||e.startsAt<=n)&&(!e.expiresAt||!n||e.expiresAt>=n))}async deleteAllForResource(e,...t){for(const i of await this.listResourceGrants(e,...t))await this.deleteById(i.id,...t)}}class tt{async unregisterResource(e,...t){await(new et).deleteAllForResource(e,...t),await(new Ye).deleteById(e,...t)}async resolveResourceScope(e,...t){const i=await(new Ye).getById(e,...t);return{tenantId:ue(i.tenant),orgUnitId:ue(i.orgUnit),visibility:i.visibility,ownerPrincipalId:i.owner?ue(i.owner):void 0}}}class it extends ye{constructor(){super(Pe)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>ue(t.tenant)===e)}async getBinding(e,t,...i){return(await this.listTenantBindings(e,...i)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...i){return this.updateOne(e,{config:t},...i)}async promoteToDedicated(e,t,i,r,...n){return this.updateOne(e,{bindingKind:L.Dedicated,bindingKey:t,region:i,config:r},...n)}async setShared(e,t,i,r,...n){return this.updateOne(e,{bindingKind:L.Shared,bindingKey:t,region:i,config:r},...n)}}class rt{constructor(){this.tenantService=new Ge,this.tenantProfileService=new Be,this.orgUnitService=new $e,this.orgUnitProfileService=new De,this.userService=new Le,this.membershipService=new Me,this.principalService=new ze,this.permissionService=new Ze,this.roleService=new Qe,this.rolePermissionService=new Je,this.roleAssignmentService=new He,this.effectivePermissionService=new Xe}async bootstrapTenantFromTemplate(e,...t){const i=await this.tenantService.createTenant(e.tenant,...t);e.tenant.profileKey&&await this.tenantProfileService.createProfile(i.id,e.tenant.profileKey,e.tenant.profileMetadata,...t);const r=async(e,n)=>{const s=void 0===e?await this.orgUnitService.createRoot(i.id,n.name,n.metadata,n.profileKey,n.metadata,...t):await this.orgUnitService.createChild({tenantId:i.id,parentOrgUnitId:e,name:n.name,metadata:n.metadata,profileKey:n.profileKey,profileMetadata:n.metadata},...t);for(const e of n.children??[])await r(s.id,e);return s},n=await r(void 0,e.rootOrgUnit),s=await this.userService.createUser(e.ownerUser,...t);await this.membershipService.addUserToTenant(i.id,s.id,D.Active,...t);const o=await this.principalService.getUserPrincipal(i.id,s.id,...t);for(const i of e.permissions)await this.permissionService.createPermission(i,...t);for(const r of e.roles){const e=await this.roleService.createRole({tenantId:i.id,key:r.key,name:r.name,description:r.description},...t);for(const i of r.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(e.id,i,...t)}const a=await this.roleService.getTenantRoleByKey(i.id,e.ownerRoleKey,...t);return await this.roleAssignmentService.assignRole({tenantId:i.id,principalId:o.id,roleId:a.id,scopeKind:E.OrgUnit,scopeId:n.id,inheritDown:!0},...t),await this.effectivePermissionService.rebuildForPrincipal(i.id,o.id,...t),{tenantId:i.id,rootOrgUnitId:n.id,ownerUserId:s.id,ownerPrincipalId:o.id}}}P([m(),K("design:type",Function),K("design:paramtypes",[Object,Object]),K("design:returntype",Promise)],rt.prototype,"bootstrapTenantFromTemplate",null);class nt{constructor(){this.membershipService=new Me,this.orgMembershipService=new qe,this.principalService=new ze,this.roleService=new Qe,this.roleAssignmentService=new He,this.effectivePermissionService=new Xe}async onboardUserToTenantAndOrgUnit(e,t,i,r,...n){await this.membershipService.addUserToTenant(e,t,D.Active,...n),await this.orgMembershipService.addUserToOrgUnit(e,i,t,D.Active,...n);const s=await this.principalService.getUserPrincipal(e,t,...n),o=await this.roleService.getTenantRoleByKey(e,r,...n);return await this.roleAssignmentService.assignRole({tenantId:e,principalId:s.id,roleId:o.id,scopeKind:E.OrgUnit,scopeId:i,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(e,s.id,...n),{principalId:s.id}}async changeUserOrgRole(e,t,i,r,n,...s){const o=await this.roleService.getTenantRoleByKey(e,r,...s),a=await this.roleAssignmentService.listPrincipalAssignments(e,t,...s);for(const e of a.filter(e=>e.scopeKind===E.OrgUnit&&e.scopeId===i))await this.roleAssignmentService.revokeAssignment(e.id,...s);await this.roleAssignmentService.assignRole({tenantId:e,principalId:t,roleId:o.id,scopeKind:E.OrgUnit,scopeId:i,inheritDown:n},...s),await this.effectivePermissionService.rebuildForPrincipal(e,t,...s)}async suspendUserInTenant(e,t,i,...r){await this.membershipService.setStatus(e,D.Suspended,...r),await this.effectivePermissionService.deleteForPrincipal(t,i,...r)}async reactivateUserInTenant(e,t,i,...r){await this.membershipService.setStatus(e,D.Active,...r),await this.effectivePermissionService.rebuildForPrincipal(t,i,...r)}}P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"onboardUserToTenantAndOrgUnit",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,String,Boolean,Object]),K("design:returntype",Promise)],nt.prototype,"changeUserOrgRole",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"suspendUserInTenant",null),P([m(),K("design:type",Function),K("design:paramtypes",[String,String,String,Object]),K("design:returntype",Promise)],nt.prototype,"reactivateUserInTenant",null);class st{constructor(e={}){this.dataSources=e}async canAccess(e,...t){const i=e.at??new Date;if(e.scopeKind&&e.scopeId)return se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,e.scopeKind,e.scopeId))).some(t=>t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt));if(!e.resourceProtectedId)return!1;const r=await(this.dataSources.loadResource?.(e.tenantId,e.resourceProtectedId));if(!r)return!1;if(r.tenantId!==e.tenantId)return!1;if(r.ownerPrincipalId===e.principalId)return!0;if(se(await(this.dataSources.listResourceGrants?.(e.tenantId,e.resourceProtectedId))).filter(t=>t.principalId===e.principalId&&t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt)).length>0)return!0;const n=r.visibility;return n!==N.Private&&n!==N.ResourceAcl&&(n===N.OrgUnit||n===N.OrgSubtree?se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,E.OrgUnit,r.orgUnitId))).some(t=>t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt)):n===N.Tenant&&se(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,E.Tenant,e.tenantId))).some(t=>t.permissionKey===e.permissionKey&&ce(i,t.startsAt,t.expiresAt)))}async requireAccess(e,...t){if(!await this.canAccess(e,...t))throw new f(`Access denied for ${e.permissionKey} on ${e.resourceProtectedId??(i=e.scopeKind??E.Resource,r=e.scopeId??"",`${i}:${r}`)}`);var i,r}async buildAccessContext(e,t,...i){return pe({tenantId:e,principalId:t,permissions:se(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:se(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,i,...r){const n=await this.buildAccessContext(e,t,...r),s=n.allowedOrgUnitIdsByPermission[i]??[],o=n.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId);return te({tenantId:e,principalId:t,permissionKey:i,allowedOrgUnitIds:s,allowedResourceIds:o})}async buildQdrantFilter(e,t,i,...r){const n=await this.buildAccessContext(e,t,...r);return ie({tenantId:e,principalId:t,allowedOrgUnitIds:n.allowedOrgUnitIdsByPermission[i]??[],allowedResourceIds:n.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId)})}}const ot="featureFlag",at="FEATURE_FLAG",dt="feature-flags:model",ct="feature-flags:auth",pt="feature-flags:block",yt="feature-flags:render-if",lt="feature-flags:hide-on";function ut(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const i=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===i.length)return t;const[r,...n]=i;return[r,...n.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function gt(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ht(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return gt(e);const t={};return Object.entries(e).forEach(([e,i])=>{const r=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[i,...r]=t;return[i.toLowerCase(),...r.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==i&&(t[r]=ht(i)??i)}),t}function mt(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,i])=>{const r=ut(t),n=ht(i);return void 0!==n&&(e[r]=n),e},{})}function ft(e){return!0===e||!!e&&"object"==typeof e}function vt(e,t){return ft(e?.[ut(t)])}function wt(e,t="any"){return{features:[...new Set(e.map(ut).filter(Boolean))],match:t}}function bt(e,t){if(!e||0===e.features.length)return!0;const i=e.features.filter(e=>vt(t,e));return"all"===e.match?i.length===e.features.length:i.length>0}function St(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>vt(t,e))}function At(e,t){return k.get(e,t)}function Ot(e){return e.trim().toLowerCase()}function It(e){return e.trim()}const _t=i.accumulate({[ot]:{}});async function jt(e=_t){return mt(e.featureFlag)}async function Ut(e,t=_t){return(await jt(t))[ut(e)]}async function Pt(e,t=_t){return!!await Ut(e,t)}let Kt=class extends v{constructor(e){super(e),this.enabled=!0}};P([a(),d(),K("design:type",String)],Kt.prototype,"id",void 0),P([g(),I(),p(),K("design:type",String)],Kt.prototype,"key",void 0),P([p(),K("design:type",Boolean)],Kt.prototype,"enabled",void 0),P([p(),K("design:type",String)],Kt.prototype,"description",void 0),P([p(),K("design:type",String)],Kt.prototype,"scope",void 0),P([p(),K("design:type",Object)],Kt.prototype,"metadata",void 0),P([p(),K("design:type",Object)],Kt.prototype,"config",void 0),P([p(),K("design:type",String)],Kt.prototype,"createdBy",void 0),P([p(),K("design:type",String)],Kt.prototype,"updatedBy",void 0),P([y(),K("design:type",Date)],Kt.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],Kt.prototype,"updatedAt",void 0),Kt=P([u("feature_flags"),U(),K("design:paramtypes",[Object])],Kt);let kt=class extends v{constructor(e){super(e),this.enabled=!0}};P([a(),d(),K("design:type",String)],kt.prototype,"id",void 0),P([I(),p(),K("design:type",String)],kt.prototype,"featureKey",void 0),P([I(),p(),K("design:type",String)],kt.prototype,"subjectType",void 0),P([I(),p(),K("design:type",String)],kt.prototype,"subjectKey",void 0),P([p(),K("design:type",Boolean)],kt.prototype,"enabled",void 0),P([p(),K("design:type",Object)],kt.prototype,"metadata",void 0),P([p(),K("design:type",String)],kt.prototype,"createdBy",void 0),P([p(),K("design:type",String)],kt.prototype,"updatedBy",void 0),P([y(),K("design:type",Date)],kt.prototype,"createdAt",void 0),P([l(),K("design:type",Date)],kt.prototype,"updatedAt",void 0),kt=P([u("feature_flag_access"),U(),K("design:paramtypes",[Object])],kt);class Ft{async readOne(e,t){return(await this.read(t))[ut(e)]}}class Rt extends Ft{async read(e={}){return jt(e.source??{[ot]:{}})}}let Tt=class extends o{constructor(){super(Kt),this.reader=new Rt,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Rt;const i={...t.readerConfig??{},source:t.readerConfig?.source??_t};return this.cachedRegistry=await this.refreshCachedRegistry(i,...e),{config:{...t,reader:this.reader,readerConfig:i},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,i])=>(e[t]=i&&"object"==typeof i&&!Array.isArray(i)?{...i}:i,e),{})}async refreshCachedRegistry(e={},...t){const i=await this.reader.read({...e,source:e.source??_t});let r=[];try{r=await this.repo.select().execute(...t)}catch{r=[]}const n=this.cloneRegistry(i);for(const e of r)n[e.key]=!!e.enabled&&(e.config??!0);return n}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??S.forModel(kt)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:ut(e.featureKey),subjectType:Ot(e.subjectType),subjectKey:It(e.subjectKey)}}buildAccessCondition(e){let t=A.attr("subjectType").eq(Ot(e.subjectType));return t=t.and(A.attr("subjectKey").eq(It(e.subjectKey))),void 0!==e.enabled&&(t=t.and(A.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(A.attr("featureKey").in(e.featureKeys.map(ut)))),t}async create(e,...t){e.key=ut(e.key),e.enabled??=!0;const i=await super.create(e,...t);return this.setCachedFlag(i),i}async update(e,...t){e.key=ut(e.key),e.enabled??=!0;const i=await super.update(e,...t);return this.setCachedFlag(i),i}async findOneBy(e,t,...i){const r="key"===e&&"string"==typeof t?ut(t):t;return this.repo.findOneBy(e,r,...i)}async readAll(e,...t){const i=await this.repo.readAll(e,...t);for(const e of i)this.setCachedFlag(e);return i}async listEnabled(...e){return this.repo.select().where(A.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(e,...t){const i=this.normalizeFeatureAccessInput(e),r=await this.findFeatureAccess(i,...t).catch(()=>{});return r?this.getAccessRepository().update(Object.assign(r,i),...t):this.getAccessRepository().create(new kt(i),...t)}async revokeFeatureAccess(e,...t){const i=await this.findFeatureAccess(e,...t).catch(()=>{});if(i)return this.getAccessRepository().delete(i.id,...t)}async findFeatureAccess(e,...t){const i=this.buildAccessCondition(e),r=(await this.getAccessRepository().select().where(i).execute(...t))[0];if(!r)throw new n(`Feature access for ${Ot(e.subjectType)}:${It(e.subjectKey)} not found`);return r}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const i=await this.listFeatureAccess({...e,enabled:!0},...t),r=[...new Set(i.map(e=>e.featureKey))];if(0===r.length)return{};const n=A.attr("enabled").eq(!0).and(A.attr("key").in(r.map(ut)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...i){return vt(await this.resolveFeatureFlagsForSubject(t,...i),e)}isEnabled(e){this.assertInitialized();const t=ut(e);return vt(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(e={},...t){this.assertInitialized();const i=await this.reader.read({...e,source:e.source??_t}),r=[];for(const[e,n]of Object.entries(i)){const i=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:s,...o}=i,a=ut(e),d=await this.findOneBy("key",a,...t).catch(()=>{}),c=d?Object.assign(d,{enabled:ft(n),description:o.description??d.description,scope:o.scope??d.scope,metadata:o.metadata??d.metadata,config:{...o,enabled:ft(n)}}):new Kt({key:a,enabled:ft(n),description:o.description,scope:o.scope,metadata:o.metadata,config:{...o,enabled:ft(n)}});r.push(d?await this.update(c,...t):await this.create(c,...t))}return this.cachedRegistry=await this.refreshCachedRegistry({...e,source:e.source??_t},...t),r}};var xt;function Bt(e){const t=ut(e);return t?t.charAt(0).toUpperCase()+t.slice(1):t}function Dt(e,t){const i=Bt(e);return void 0===t?"engine"+i:`engine${i}${Bt(t)}`}function Ct(e){const t={};for(const i of e.engines??[]){t[Dt(i.engineId)]=!0;for(const e of i.capabilities??[])t[Dt(i.engineId,e.feature)]="SUPPORTED"===e.verdict}return t}P([w(kt),K("design:type",Object)],Tt.prototype,"accessRepository",void 0),Tt=P([b(Kt),K("design:paramtypes",[])],Tt);class Et extends Ft{constructor(e){super(),this.registry=e}async read(e){return{...this.registry}}}let Gt=xt=class extends Tt{constructor(){const e=super();if(!(this instanceof xt))return Object.assign(Object.create(xt.prototype),e,{capabilityRegistry:{}});this.capabilityRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.capabilityRegistry=Ct(t.manifest??{engines:[]});const i=new Et(this.capabilityRegistry);return{config:{...t,reader:i,readerConfig:{...t.readerConfig??{},source:{}}},client:i}}isEngineEnabled(e){return vt(this.capabilityRegistry,Dt(e))}isEngineFeatureEnabled(e,t){return vt(this.capabilityRegistry,Dt(e,t))}isEnabled(e){return vt(this.capabilityRegistry,e)}async resolveFeatureFlags(){return{...this.capabilityRegistry}}async resolveFeatureFlagsForSubject(e,...t){return{...this.capabilityRegistry}}async isEnabledForSubject(e,t,...i){return vt(this.capabilityRegistry,e)}async listEnabled(...e){return Object.entries(this.capabilityRegistry).filter(([,e])=>ft(e)).map(([e])=>new Kt({key:e,enabled:!0,config:{enabled:!0}}))}async syncFromEnvironment(...e){throw new r("Engine capability feature flags are derived from the served engine manifest and are never synced from the environment")}};function Nt(e,t){return void 0===t?e:k.key(e,t.toString())}function $t(e,t,i="any"){const r=wt(t,i);return(t,i,n)=>{if(void 0===i)return F(e,r)(t);const s=Nt(e,i);return n?R(s,r)(t,i,n):T(s,r)(t,i)}}function Lt(...e){return $t(dt,e)}function zt(...e){return $t(ct,e)}function Mt(...e){return $t(pt,e)}function qt(...e){return $t(yt,e)}function Wt(...e){return $t(lt,e)}function Vt(e,t,i){return At(e,Nt(t,i))}function Zt(e,t,i,r){return bt(Vt(e,i,r),t)}function Qt(e,t,i,r){return St(Vt(e,i,r),t)}Gt=xt=P([b(),K("design:paramtypes",[])],Gt);const Jt="##VERSION##",Ht="##COMMIT##",Xt="##FULL_VERSION##",Yt="##PACKAGE##";export{ge as AuthorizationModel,st as AuthzService,ye as BaseModelService,rt as BootstrapService,Ht as COMMIT,xe as EffectivePermission,Xe as EffectivePermissionService,Gt as EngineCapabilityFeatureFlagService,Rt as EnvironmeFlagReader,ct as FEATURE_FLAG_AUTH_KEY,pt as FEATURE_FLAG_BLOCK_KEY,at as FEATURE_FLAG_ENV_PREFIX,ot as FEATURE_FLAG_ENV_ROOT,lt as FEATURE_FLAG_HIDE_KEY,dt as FEATURE_FLAG_MODEL_KEY,yt as FEATURE_FLAG_RENDER_KEY,Xt as FULL_VERSION,Kt as FeatureFlag,kt as FeatureFlagAccess,_t as FeatureFlagEnvironment,Ft as FeatureFlagReader,Tt as FeatureFlagService,Te as Group,Re as GroupMembership,Ve as GroupMembershipService,We as GroupService,je as InheritanceBlock,Ee as InheritanceBlockService,B as IsolationTier,z as IsolationTierOptions,D as MembershipStatus,M as MembershipStatusOptions,Ue as OrgUnit,ve as OrgUnitClosure,Ce as OrgUnitClosureService,fe as OrgUnitMembership,qe as OrgUnitMembershipService,Fe as OrgUnitProfile,De as OrgUnitProfileService,$e as OrgUnitService,Yt as PACKAGE_NAME,we as Permission,G as PermissionCategory,V as PermissionCategoryOptions,Ze as PermissionService,Ie as Principal,C as PrincipalKind,q as PrincipalKindOptions,ze as PrincipalService,_e as ProtectedResource,Ye as ProtectedResourceService,Y as REL_CASCADE_DEPENDENT,ee as REL_CASCADE_INSERT_UPDATE,X as REL_NULLIFY,H as REL_RESTRICT,Oe as ResourceGrant,et as ResourceGrantService,tt as ResourceLifecycleService,N as ResourceVisibility,Z as ResourceVisibilityOptions,Se as Role,Ae as RoleAssignment,He as RoleAssignmentService,be as RolePermission,Je as RolePermissionService,Qe as RoleService,E as ScopeKind,W as ScopeKindOptions,Pe as StorageBinding,L as StorageBindingKind,J as StorageBindingKindOptions,it as StorageBindingService,$ as StorageKind,Q as StorageKindOptions,nt as SystemManagementService,Ke as Tenant,he as TenantMembership,Me as TenantMembershipService,ke as TenantProfile,Be as TenantProfileService,Ge as TenantService,me as User,Le as UserService,Jt as VERSION,se as asArray,Mt as blockFeatureOperations,pe as buildAccessContext,te as buildArangoContext,ie as buildQdrantFilter,Dt as engineCapabilityFlagKey,Ct as engineCapabilityFlagRegistry,x as execWithLogging,zt as featureAuth,Lt as featureFlags,Vt as getFeatureGateMetadata,Pt as hasFeatureFlagInEnvironment,Wt as hideOnFeature,le as id,ft as isFeatureFlagEnabled,vt as isFeatureFlagEnabledByName,St as isFeatureRuleBlocked,bt as isFeatureRuleSatisfied,ce as isTimeValid,jt as loadFeatureFlagsFromEnvironment,de as lowerSlug,ht as normalizeFeatureConfig,ut as normalizeFeatureName,mt as normalizeFeatureRegistry,wt as normalizeFeatureRule,It as normalizeFeatureSubjectKey,Ot as normalizeFeatureSubjectType,ne as nowIso,gt as parseRuntimeValue,At as readMetadata,ue as relationId,ae as relationMatch,qt as renderIfFeature,Ut as resolveFeatureFlagFromEnvironment,oe as sameTenant,Zt as shouldExposeForFeatures,Qt as shouldHideForFeatures};
+import{exec as e}from"child_process";import{LogLevel as t,LoggedEnvironment as n}from"@decaf-ts/logging";import{InternalError as i,ValidationError as r,NotFoundError as s}from"@decaf-ts/db-decorators";import{Cascade as a,ModelService as o,pk as p,uuid as d,manyToOne as c,column as l,createdAt as u,updatedAt as _,table as g,unique as y,oneToMany as m,transactional as h,AuthorizationError as f,BaseModel as S,ClientBasedService as v,Repository as w,Condition as A,OrderDirection as E,resolveTransactionLock as b,repository as R,service as O}from"@decaf-ts/core";export{AuthorizationError,transactional}from"@decaf-ts/core";import{Model as I,required as T,type as N,option as U,model as C}from"@decaf-ts/decorator-validation";import{__decorate as L,__metadata as F}from"tslib";import{description as P,Metadata as D,metadata as $,methodMetadata as j,propMetadata as x}from"@decaf-ts/decoration";import{randomUUID as k}from"node:crypto";import{CryptoService as B}from"@decaf-ts/crypto/integration/services/crypto";async function K(n,r,s,a=t.info){return s.debug("Executing: "+n),new Promise((t,o)=>{const p=e(n,r),d=[],c=[];p.stdout?.on("data",e=>{d.push(e),s[a](e.trim())}),p.stderr?.on("data",e=>{c.push(e),s.debug(e.trim())}),p.on("close",e=>{0===e?(s.silly("Command completed successfully"),t({stdout:d.join("\n"),stderr:c.join("\n")})):(s.critical(`Command failed with code ${e}:\n ${c.join("\n")}`),o(new i(`Command failed with code ${e}: ${c.join("\n")}`)))}),p.on("error",e=>{s.critical("Command execution error",e),o(e)})})}var G,q,M,Y,z,W,H,V,X;(e=>{e.Pooled="pooled",e.Bridge="bridge",e.Silo="silo"})(G||(G={})),(e=>{e.Invited="invited",e.Active="active",e.Suspended="suspended",e.Removed="removed"})(q||(q={})),(e=>{e.User="user",e.Group="group",e.ServiceAccount="service_account",e.Agent="agent",e.ApiKey="api_key"})(M||(M={})),(e=>{e.Tenant="tenant",e.OrgUnit="org_unit",e.Resource="resource"})(Y||(Y={})),(e=>{e.Admin="admin",e.ContentRead="content_read",e.ContentWrite="content_write",e.Memory="memory",e.Graph="graph",e.Vector="vector",e.Export="export",e.Billing="billing",e.Audit="audit",e.Security="security",e.Data="data",e.Automation="automation"})(z||(z={})),(e=>{e.Private="private",e.ResourceAcl="resource_acl",e.OrgUnit="org_unit",e.OrgSubtree="org_subtree",e.Tenant="tenant"})(W||(W={})),(e=>{e.Postgres="postgres",e.Arango="arango",e.Qdrant="qdrant",e.ObjectStorage="object_storage"})(H||(H={})),(e=>{e.Shared="shared",e.Dedicated="dedicated"})(V||(V={})),(e=>{e.Model="model",e.Filesystem="filesystem"})(X||(X={}));const J=Object.values(G),Z=Object.values(q),Q=Object.values(M),ee=Object.values(Y),te=Object.values(z),ne=Object.values(W),ie=Object.values(H),re=Object.values(V),se=Object.values(X),ae={update:a.NONE,delete:a.NONE,nullable:!1},oe={update:a.NONE,delete:a.NONE,nullable:!0},pe={update:a.CASCADE,delete:a.CASCADE,nullable:!1},de={update:a.CASCADE,delete:a.NONE,nullable:!1};function ce(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function le(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function ue(e,t){return`${e}:${t}`}function _e(){return new Date}function ge(e){return e??[]}function ye(e,t){return Ae(e)===t}function me(e,t){return!!t&&Ae(e)===t}function he(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function fe(e,t,n){const i=e??new Date;return!(t&&t>i||n&&i>n)}function Se(e){const t={},n={};for(const i of e.permissions){const e=ue(i.scopeKind,i.scopeId);t[e]=t[e]??[],t[e].push(i.permissionKey),i.scopeKind===Y.OrgUnit&&(n[i.permissionKey]=n[i.permissionKey]??[],n[i.permissionKey].push(i.scopeId))}return{tenantId:e.tenantId,principalId:e.principalId,permissionsByScope:t,allowedOrgUnitIdsByPermission:n,resourceGrants:e.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class ve extends o{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...n){const i=await this.repo.read(e,...n);return this.repo.update(Object.assign(i,t),...n)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...n){return this.repo.findOneBy(e,t,...n)}async findManyBy(e,t,...n){return this.repo.select().where({[e]:t}).execute(...n)}async listAll(...e){return this.repo.select().execute(...e)}}function we(){return crypto.randomUUID()}function Ae(e){return"string"==typeof e?e:e.id}class Ee extends I{constructor(e){super(e)}}let be=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],be.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_tenant_memberships_tenant"),T(),F("design:type",Object)],be.prototype,"tenant",void 0),L([c(()=>Re,pe,!1,void 0,"fk_tenant_memberships_user"),T(),F("design:type",Object)],be.prototype,"user",void 0),L([T(),N(String),U(Z),l(),F("design:type",String)],be.prototype,"status",void 0),L([u(),F("design:type",Date)],be.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],be.prototype,"updatedAt",void 0),be=L([P("Membership linking a user to a tenant"),g("tenant_memberships"),C(),F("design:paramtypes",[Object])],be);let Re=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Re.prototype,"id",void 0),L([y(),N(String),l(),F("design:type",String)],Re.prototype,"email",void 0),L([y(),N(String),l(),F("design:type",String)],Re.prototype,"phone",void 0),L([T(),N(String),l(),F("design:type",String)],Re.prototype,"displayName",void 0),L([m(()=>be,ae,!1),F("design:type",Array)],Re.prototype,"tenantMemberships",void 0),L([m(()=>Oe,ae,!1),F("design:type",Array)],Re.prototype,"orgUnitMemberships",void 0),L([u(),F("design:type",Date)],Re.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Re.prototype,"updatedAt",void 0),Re=L([P("User identity within the authorization namespace"),g("users"),C(),F("design:paramtypes",[Object])],Re);let Oe=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Oe.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_org_memberships_tenant"),T(),F("design:type",Object)],Oe.prototype,"tenant",void 0),L([c(()=>$e,pe,!1,void 0,"fk_org_memberships_org_unit"),T(),F("design:type",Object)],Oe.prototype,"orgUnit",void 0),L([c(()=>Re,ae,!1,void 0,"fk_org_memberships_user"),T(),F("design:type",Object)],Oe.prototype,"user",void 0),L([T(),N(String),U(Z),l(),F("design:type",String)],Oe.prototype,"status",void 0),L([u(),F("design:type",Date)],Oe.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Oe.prototype,"updatedAt",void 0),Oe=L([P("Membership linking a user to an organizational unit"),g("org_unit_memberships"),C(),F("design:paramtypes",[Object])],Oe);let Ie=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Ie.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_org_closure_tenant"),T(),F("design:type",Object)],Ie.prototype,"tenant",void 0),L([c(()=>$e,pe,!1,void 0,"fk_org_closure_ancestor"),T(),F("design:type",Object)],Ie.prototype,"ancestor",void 0),L([c(()=>$e,pe,!1,void 0,"fk_org_closure_descendant"),T(),F("design:type",Object)],Ie.prototype,"descendant",void 0),L([T(),N(Number),l(),F("design:type",Number)],Ie.prototype,"depth",void 0),L([u(),F("design:type",Date)],Ie.prototype,"createdAt",void 0),Ie=L([P("Ancestor/descendant closure entry for the organizational hierarchy"),g("org_unit_closure"),C(),F("design:paramtypes",[Object])],Ie);let Te=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Te.prototype,"id",void 0),L([y(),T(),N(String),l(),F("design:type",String)],Te.prototype,"key",void 0),L([T(),N(String),U(te),l(),F("design:type",String)],Te.prototype,"category",void 0),L([N(String),l(),F("design:type",String)],Te.prototype,"description",void 0),L([m(()=>Ne,ae,!1),F("design:type",Array)],Te.prototype,"rolePermissions",void 0),Te=L([P("Named authorization permission with a category"),g("permissions"),C(),F("design:paramtypes",[Object])],Te);let Ne=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Ne.prototype,"id",void 0),L([c(()=>Ue,pe,!1,void 0,"fk_role_permissions_role"),T(),F("design:type",Object)],Ne.prototype,"role",void 0),L([c(()=>Te,pe,!1,void 0,"fk_role_permissions_permission"),T(),F("design:type",Object)],Ne.prototype,"permission",void 0),L([u(),F("design:type",Date)],Ne.prototype,"createdAt",void 0),Ne=L([P("Link between a role and a permission"),g("role_permissions"),C(),F("design:paramtypes",[Object])],Ne);let Ue=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Ue.prototype,"id",void 0),L([c(()=>xe,oe,!1,void 0,"fk_roles_tenant"),F("design:type",Object)],Ue.prototype,"tenant",void 0),L([T(),N(String),l(),F("design:type",String)],Ue.prototype,"key",void 0),L([T(),N(String),l(),F("design:type",String)],Ue.prototype,"name",void 0),L([N(String),l(),F("design:type",String)],Ue.prototype,"description",void 0),L([N(Object),l(),F("design:type",Object)],Ue.prototype,"metadata",void 0),L([m(()=>Ne,ae,!1),F("design:type",Array)],Ue.prototype,"rolePermissions",void 0),L([m(()=>Ce,ae,!1),F("design:type",Array)],Ue.prototype,"assignments",void 0),L([u(),F("design:type",Date)],Ue.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Ue.prototype,"updatedAt",void 0),Ue=L([P("Named role grouping permissions"),g("roles"),C(),F("design:paramtypes",[Object])],Ue);let Ce=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Ce.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_role_assignments_tenant"),T(),F("design:type",Object)],Ce.prototype,"tenant",void 0),L([c(()=>Fe,pe,!1,void 0,"fk_role_assignments_principal"),T(),F("design:type",Object)],Ce.prototype,"principal",void 0),L([c(()=>Ue,ae,!1,void 0,"fk_role_assignments_role"),T(),F("design:type",Object)],Ce.prototype,"role",void 0),L([T(),N(String),U(ee),l(),F("design:type",String)],Ce.prototype,"scopeKind",void 0),L([T(),N(String),l(),F("design:type",String)],Ce.prototype,"scopeId",void 0),L([T(),N(Boolean),l(),F("design:type",Boolean)],Ce.prototype,"inheritDown",void 0),L([l(),F("design:type",Date)],Ce.prototype,"startsAt",void 0),L([l(),F("design:type",Date)],Ce.prototype,"expiresAt",void 0),L([N(Object),l(),F("design:type",Object)],Ce.prototype,"conditions",void 0),L([u(),F("design:type",Date)],Ce.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Ce.prototype,"updatedAt",void 0),Ce=L([P("Role assigned to a principal within a scope"),g("role_assignments"),C(),F("design:paramtypes",[Object])],Ce);let Le=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Le.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_resource_grants_tenant"),T(),F("design:type",Object)],Le.prototype,"tenant",void 0),L([c(()=>Pe,pe,!1,void 0,"fk_resource_grants_resource"),T(),F("design:type",Object)],Le.prototype,"resource",void 0),L([c(()=>Fe,pe,!1,void 0,"fk_resource_grants_principal"),T(),F("design:type",Object)],Le.prototype,"principal",void 0),L([T(),N(String),l(),F("design:type",String)],Le.prototype,"permissionKey",void 0),L([l(),F("design:type",Date)],Le.prototype,"startsAt",void 0),L([l(),F("design:type",Date)],Le.prototype,"expiresAt",void 0),L([N(Object),l(),F("design:type",Object)],Le.prototype,"conditions",void 0),L([c(()=>Fe,ae,!1,void 0,"fk_resource_grants_created_by"),F("design:type",Object)],Le.prototype,"createdBy",void 0),L([u(),F("design:type",Date)],Le.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Le.prototype,"updatedAt",void 0),Le=L([P("Permission grant on a protected resource for a principal"),g("resource_grants"),C(),F("design:paramtypes",[Object])],Le);let Fe=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Fe.prototype,"id",void 0),L([c(()=>xe,ae,!1,void 0,"fk_principals_tenant"),T(),F("design:type",Object)],Fe.prototype,"tenant",void 0),L([T(),N(String),U(Q),l(),F("design:type",String)],Fe.prototype,"kind",void 0),L([T(),N(String),l(),F("design:type",String)],Fe.prototype,"subjectId",void 0),L([m(()=>Ce,ae,!1),F("design:type",Array)],Fe.prototype,"roleAssignments",void 0),L([m(()=>Le,ae,!1),F("design:type",Array)],Fe.prototype,"resourceGrants",void 0),L([u(),F("design:type",Date)],Fe.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Fe.prototype,"updatedAt",void 0),Fe=L([P("Authorization subject representing a user, group, service account, agent, or API key"),g("principals"),C(),F("design:paramtypes",[Object])],Fe);let Pe=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Pe.prototype,"id",void 0),L([c(()=>xe,ae,!1,void 0,"fk_protected_resources_tenant"),T(),F("design:type",Object)],Pe.prototype,"tenant",void 0),L([c(()=>$e,ae,!1,void 0,"fk_protected_resources_org_unit"),T(),F("design:type",Object)],Pe.prototype,"orgUnit",void 0),L([T(),N(String),l(),F("design:type",String)],Pe.prototype,"resourceType",void 0),L([T(),N(String),l(),F("design:type",String)],Pe.prototype,"resourceId",void 0),L([T(),N(String),U(ne),l(),F("design:type",String)],Pe.prototype,"visibility",void 0),L([c(()=>Fe,oe,!1,void 0,"fk_protected_resources_owner"),F("design:type",Object)],Pe.prototype,"owner",void 0),L([N(String),l(),F("design:type",String)],Pe.prototype,"sensitivity",void 0),L([N(Object),l(),F("design:type",Object)],Pe.prototype,"metadata",void 0),L([m(()=>Le,ae,!1),F("design:type",Array)],Pe.prototype,"grants",void 0),L([u(),F("design:type",Date)],Pe.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Pe.prototype,"updatedAt",void 0),Pe=L([P("Resource registered for authorization and visibility decisions"),g("protected_resources"),C(),F("design:paramtypes",[Object])],Pe);let De=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],De.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_inheritance_blocks_tenant"),T(),F("design:type",Object)],De.prototype,"tenant",void 0),L([c(()=>$e,pe,!1,void 0,"fk_inheritance_blocks_org_unit"),T(),F("design:type",Object)],De.prototype,"orgUnit",void 0),L([c(()=>$e,oe,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),F("design:type",Object)],De.prototype,"blockedFromAncestor",void 0),L([T(),N(String),U(te),l(),F("design:type",String)],De.prototype,"permissionCategory",void 0),L([N(String),l(),F("design:type",String)],De.prototype,"reason",void 0),L([u(),F("design:type",Date)],De.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],De.prototype,"updatedAt",void 0),De=L([P("Block preventing permission inheritance from an ancestor organizational unit"),g("inheritance_blocks"),C(),F("design:paramtypes",[Object])],De);let $e=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],$e.prototype,"id",void 0),L([c(()=>xe,ae,!1,void 0,"fk_org_units_tenant"),T(),F("design:type",Object)],$e.prototype,"tenant",void 0),L([c(()=>$e,ae,!1,void 0,"fk_org_units_parent"),F("design:type",Object)],$e.prototype,"parent",void 0),L([m(()=>$e,ae,!1),F("design:type",Array)],$e.prototype,"children",void 0),L([T(),N(String),l(),F("design:type",String)],$e.prototype,"name",void 0),L([T(),N(String),l(),F("design:type",String)],$e.prototype,"path",void 0),L([N(Object),l(),F("design:type",Object)],$e.prototype,"metadata",void 0),L([m(()=>Oe,ae,!1),F("design:type",Array)],$e.prototype,"memberships",void 0),L([m(()=>Pe,ae,!1),F("design:type",Array)],$e.prototype,"resources",void 0),L([m(()=>De,ae,!1),F("design:type",Array)],$e.prototype,"inheritanceBlocks",void 0),L([m(()=>Ie,ae,!1),F("design:type",Array)],$e.prototype,"ancestorLinks",void 0),L([m(()=>Ie,ae,!1),F("design:type",Array)],$e.prototype,"descendantLinks",void 0),L([u(),F("design:type",Date)],$e.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],$e.prototype,"updatedAt",void 0),$e=L([P("Organizational unit node in a tenant hierarchy (department, project, or team)"),g("org_units"),C(),F("design:paramtypes",[Object])],$e);let je=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],je.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_storage_bindings_tenant"),T(),F("design:type",Object)],je.prototype,"tenant",void 0),L([T(),N(String),U(ie),l(),F("design:type",String)],je.prototype,"storageKind",void 0),L([T(),N(String),U(re),l(),F("design:type",String)],je.prototype,"bindingKind",void 0),L([T(),N(String),l(),F("design:type",String)],je.prototype,"bindingKey",void 0),L([T(),N(String),l(),F("design:type",String)],je.prototype,"region",void 0),L([N(Object),l(),F("design:type",Object)],je.prototype,"config",void 0),L([u(),F("design:type",Date)],je.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],je.prototype,"updatedAt",void 0),je=L([P("Storage backend binding configured for a tenant"),g("storage_bindings"),C(),F("design:paramtypes",[Object])],je);let xe=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],xe.prototype,"id",void 0),L([y(),T(),N(String),l(),F("design:type",String)],xe.prototype,"slug",void 0),L([T(),N(String),l(),F("design:type",String)],xe.prototype,"name",void 0),L([T(),N(String),U(J),l(),F("design:type",String)],xe.prototype,"isolationTier",void 0),L([m(()=>$e,ae,!1),F("design:type",Array)],xe.prototype,"orgUnits",void 0),L([m(()=>be,ae,!1),F("design:type",Array)],xe.prototype,"memberships",void 0),L([m(()=>Fe,ae,!1),F("design:type",Array)],xe.prototype,"principals",void 0),L([m(()=>je,ae,!1),F("design:type",Array)],xe.prototype,"storageBindings",void 0),L([u(),F("design:type",Date)],xe.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],xe.prototype,"updatedAt",void 0),xe=L([P("Top-level tenant (organization) namespace"),g("tenants"),C(),F("design:paramtypes",[Object])],xe);let ke=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],ke.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_tenant_profiles_tenant"),T(),F("design:type",Object)],ke.prototype,"tenant",void 0),L([T(),N(String),l(),F("design:type",String)],ke.prototype,"profileKey",void 0),L([N(Object),l(),F("design:type",Object)],ke.prototype,"metadata",void 0),L([u(),F("design:type",Date)],ke.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],ke.prototype,"updatedAt",void 0),ke=L([P("Profile metadata attached to a tenant"),g("tenant_profiles"),C(),F("design:paramtypes",[Object])],ke);let Be=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Be.prototype,"id",void 0),L([c(()=>$e,pe,!1,void 0,"fk_org_unit_profiles_org_unit"),T(),F("design:type",Object)],Be.prototype,"orgUnit",void 0),L([T(),N(String),l(),F("design:type",String)],Be.prototype,"profileKey",void 0),L([N(Object),l(),F("design:type",Object)],Be.prototype,"metadata",void 0),L([u(),F("design:type",Date)],Be.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Be.prototype,"updatedAt",void 0),Be=L([P("Profile metadata attached to an organizational unit"),g("org_unit_profiles"),C(),F("design:paramtypes",[Object])],Be);let Ke=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Ke.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_group_memberships_tenant"),T(),F("design:type",Object)],Ke.prototype,"tenant",void 0),L([c(()=>Ge,pe,!1,void 0,"fk_group_memberships_group"),T(),F("design:type",Object)],Ke.prototype,"group",void 0),L([c(()=>Fe,pe,!1,void 0,"fk_group_memberships_principal"),T(),F("design:type",Object)],Ke.prototype,"principal",void 0),L([N(Object),l(),F("design:type",Object)],Ke.prototype,"metadata",void 0),L([u(),F("design:type",Date)],Ke.prototype,"createdAt",void 0),Ke=L([P("Membership linking a principal to a group"),g("group_memberships"),C(),F("design:paramtypes",[Object])],Ke);let Ge=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],Ge.prototype,"id",void 0),L([c(()=>xe,ae,!1,void 0,"fk_groups_tenant"),T(),F("design:type",Object)],Ge.prototype,"tenant",void 0),L([c(()=>$e,oe,!1,void 0,"fk_groups_org_unit"),F("design:type",Object)],Ge.prototype,"orgUnit",void 0),L([T(),N(String),l(),F("design:type",String)],Ge.prototype,"name",void 0),L([N(Object),l(),F("design:type",Object)],Ge.prototype,"metadata",void 0),L([m(()=>Ke,ae,!1),F("design:type",Array)],Ge.prototype,"members",void 0),L([u(),F("design:type",Date)],Ge.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Ge.prototype,"updatedAt",void 0),Ge=L([P("Named group of principals within a tenant and organizational unit"),g("groups"),C(),F("design:paramtypes",[Object])],Ge);let qe=class extends Ee{constructor(e){super(e)}};L([p({type:String}),d(),F("design:type",String)],qe.prototype,"id",void 0),L([c(()=>xe,pe,!1,void 0,"fk_effective_permissions_tenant"),T(),F("design:type",Object)],qe.prototype,"tenant",void 0),L([c(()=>Fe,pe,!1,void 0,"fk_effective_permissions_principal"),T(),F("design:type",Object)],qe.prototype,"principal",void 0),L([T(),N(String),l(),F("design:type",String)],qe.prototype,"permissionKey",void 0),L([T(),N(String),U(ee),l(),F("design:type",String)],qe.prototype,"scopeKind",void 0),L([T(),N(String),l(),F("design:type",String)],qe.prototype,"scopeId",void 0),L([T(),N(String),l(),F("design:type",String)],qe.prototype,"sourceKind",void 0),L([T(),N(String),l(),F("design:type",String)],qe.prototype,"sourceId",void 0),L([l(),F("design:type",Date)],qe.prototype,"startsAt",void 0),L([l(),F("design:type",Date)],qe.prototype,"expiresAt",void 0),L([u(),F("design:type",Date)],qe.prototype,"createdAt",void 0),qe=L([P("Materialized effective permission granted to a principal within a scope"),g("effective_permissions"),C(),F("design:paramtypes",[Object])],qe);let Me=class extends Ee{constructor(e){super(e),this.enabled=!0}};L([p({type:String}),d(),F("design:type",String)],Me.prototype,"id",void 0),L([c(()=>xe,ae,!1,void 0,"fk_credentials_tenant"),T(),F("design:type",Object)],Me.prototype,"tenant",void 0),L([c(()=>$e,oe,!1,void 0,"fk_credentials_org_unit"),F("design:type",Object)],Me.prototype,"orgUnit",void 0),L([c(()=>Fe,oe,!1,void 0,"fk_credentials_owner"),F("design:type",Object)],Me.prototype,"owner",void 0),L([T(),N(String),l(),F("design:type",String)],Me.prototype,"name",void 0),L([T(),N(String),l(),F("design:type",String)],Me.prototype,"credentialType",void 0),L([T(),N(String),l(),F("design:type",String)],Me.prototype,"secretName",void 0),L([T(),N(String),U(se),l(),F("design:type",String)],Me.prototype,"provider",void 0),L([N(String),l(),F("design:type",String)],Me.prototype,"description",void 0),L([N(Boolean),l(),F("design:type",Boolean)],Me.prototype,"enabled",void 0),L([N(Object),l(),F("design:type",Object)],Me.prototype,"metadata",void 0),L([l(),F("design:type",Date)],Me.prototype,"expiresAt",void 0),L([l(),F("design:type",Date)],Me.prototype,"lastUsedAt",void 0),L([u(),F("design:type",Date)],Me.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],Me.prototype,"updatedAt",void 0),Me=L([g("credentials"),C(),P("Namespaced credential metadata record referencing an encrypted secret value"),F("design:paramtypes",[Object])],Me);class Ye extends ve{constructor(){super(ke)}async createProfile(e,t,n,...i){return this.create({tenant:e,profileKey:t,metadata:n},...i)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>ye(t.tenant,e))}async deleteForTenant(e,...t){for(const n of await this.listForTenant(e,...t))await this.deleteById(n.id,...t)}}class ze extends ve{constructor(){super(Be)}async createProfile(e,t,n,...i){return this.create({orgUnit:e,profileKey:t,metadata:n},...i)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>me(t.orgUnit,e))}}class We extends ve{constructor(){super(Ie)}async listAncestors(e,t,...n){return(await this.listAll(...n)).filter(n=>ye(n.tenant,e)&&me(n.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...n){return(await this.listAll(...n)).filter(n=>ye(n.tenant,e)&&me(n.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,n,...i){return(await this.listAncestors(e,n,...i)).some(e=>me(e.ancestor,t))}async createSelfLink(e,t,...n){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...n)}async insertAncestorLinksForNewChild(e,t,n,...i){const r=await this.listAncestors(e,t,...i);for(const t of r)await this.create({tenant:e,ancestor:t.ancestor,descendant:n,depth:t.depth+1},...i)}async deleteLinksForSubtree(e,t,...n){const i=await this.listDescendants(e,t,...n),r=new Set([t,...i.map(e=>Ae(e.descendant))]),s=new Set([t,...i.map(e=>Ae(e.ancestor))]),a=(await this.listAll(...n)).filter(t=>ye(t.tenant,e)&&(r.has(Ae(t.descendant))||s.has(Ae(t.ancestor))));for(const e of a)await this.deleteById(e.id,...n)}}class He extends ve{constructor(){super(De)}async blockCategory(e,t,n,i,r,...s){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:i,permissionCategory:n,reason:r},...s)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...n){return(await this.listAll(...n)).filter(n=>ye(n.tenant,e)&&me(n.orgUnit,t))}async categoryBlockedForAncestor(e,t,n,i,...r){return(await this.listForOrgUnit(e,t,...r)).some(e=>e.permissionCategory===i&&(!e.blockedFromAncestor||me(e.blockedFromAncestor,n)))}}class Ve extends ve{constructor(){super(xe)}async createTenant(e,...t){return this.create({slug:e.slug,name:e.name,isolationTier:e.isolationTier??G.Pooled},...t)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...n){return this.updateOne(e,{name:t},...n)}async changeSlug(e,t,...n){return this.updateOne(e,{slug:t},...n)}async setIsolationTier(e,t,...n){return this.updateOne(e,{isolationTier:t},...n)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function Xe(e,t,...n){for(const i of t)await e.deleteById(i.id,...n)}class Je extends ve{constructor(){super($e)}orgUnitPath(e,t){const n=he(t);return e?`${e.replace(/\/+$/,"")}/${n}`:"/"+n}async createProfileIfNeeded(e,t,n,...i){t&&await(new ze).createProfile(e,t,n,...i)}async createRoot(e,t,n,i,r,...s){const a=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:n},...s);return await this.createProfileIfNeeded(a.id,i,r,...s),await(new We).createSelfLink(e,a.id,...s),a}async createChild(e,...t){const n=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,i=await this.create({tenant:e.tenantId,parent:n?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(n?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(i.id,e.profileKey,e.profileMetadata,...t);const r=new We;return await r.createSelfLink(e.tenantId,i.id,...t),e.parentOrgUnitId&&await r.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,i.id,...t),i}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>me(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>ye(t.tenant,e))}async listDescendantOrgUnits(e,t,n=!1,...i){const r=await(new We).listDescendants(e,t,...i),s=new Set(r.map(e=>Ae(e.descendant)));return n&&s.add(t),(await this.listTenantOrgUnits(e,...i)).filter(e=>s.has(e.id))}async listAncestorOrgUnits(e,t,n=!1,...i){const r=await(new We).listAncestors(e,t,...i),s=new Set(r.map(e=>Ae(e.ancestor)));return n&&s.add(t),(await this.listTenantOrgUnits(e,...i)).filter(e=>s.has(e.id))}async renameOrgUnit(e,t,...n){const i=await this.getById(e,...n);return this.updateOne(e,{name:t,path:this.orgUnitPath(i.path.includes("/")?i.path.replace(/\/[^/]+$/,""):void 0,t)},...n)}async moveOrgUnit(e,t,n,...i){const r=await this.getById(n,...i),s=await this.getById(t,...i),a=await this.updateOne(t,{parent:r.id,path:this.orgUnitPath(r.path,s.name)},...i);return await this.rebuildTenantClosure(e,...i),a}async rebuildTenantClosure(e,...t){const n=new We,i=await n.listAll(...t);await Xe(n,i.filter(t=>ye(t.tenant,e)),...t);const r=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const i of r)await n.createSelfLink(e,i.id,...t),i.parent&&await n.insertAncestorLinksForNewChild(e,Ae(i.parent),i.id,...t)}async deleteOrgUnitTree(e,t,...n){const i=new We,r=await this.listDescendantOrgUnits(e,t,!0,...n),s=new Set(r.map(e=>e.id)),a=(await this.listTenantOrgUnits(e,...n)).filter(e=>s.has(e.id));await Xe(this,a,...n),await i.deleteLinksForSubtree(e,t,...n)}}L([h(),F("design:type",Function),F("design:paramtypes",[String,String,Object,String,Object,Object]),F("design:returntype",Promise)],Je.prototype,"createRoot",null),L([h(),F("design:type",Function),F("design:paramtypes",[Object,Object]),F("design:returntype",Promise)],Je.prototype,"createChild",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,String,String,Object]),F("design:returntype",Promise)],Je.prototype,"moveOrgUnit",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,Object]),F("design:returntype",Promise)],Je.prototype,"rebuildTenantClosure",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,String,Object]),F("design:returntype",Promise)],Je.prototype,"deleteOrgUnitTree",null);class Ze extends ve{constructor(){super(Re)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...n){return this.updateOne(e,{displayName:t},...n)}async updateEmail(e,t,...n){return this.updateOne(e,{email:t},...n)}async updatePhone(e,t,...n){return this.updateOne(e,{phone:t},...n)}}class Qe extends ve{constructor(){super(Fe)}async createPrincipal(e,t,n,...i){return this.create({tenant:e,kind:t,subjectId:n},...i)}async getForSubject(e,t,n,...i){return(await this.listAll(...i)).find(i=>ye(i.tenant,e)&&i.kind===t&&i.subjectId===n)}async getOrCreateForSubject(e,t,n,...i){return await this.getForSubject(e,t,n,...i)??await this.createPrincipal(e,t,n,...i)}async getUserPrincipal(e,t,...n){return this.getOrCreateForSubject(e,M.User,t,...n)}async getGroupPrincipal(e,t,...n){return this.getOrCreateForSubject(e,M.Group,t,...n)}}class et extends ve{constructor(){super(be)}async addUserToTenant(e,t,n=q.Active,...i){return this.create({tenant:e,user:t,status:n},...i)}async setStatus(e,t,...n){return this.updateOne(e,{status:t},...n)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>me(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>ye(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class tt extends ve{constructor(){super(Oe)}async addUserToOrgUnit(e,t,n,i=q.Active,...r){return this.create({tenant:e,orgUnit:t,user:n,status:i},...r)}async setStatus(e,t,...n){return this.updateOne(e,{status:t},...n)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>me(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>me(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class nt extends ve{constructor(){super(Ge)}async createGroup(e,t,n,i,...r){return this.create({tenant:e,orgUnit:n,name:t,metadata:i},...r)}async renameGroup(e,t,...n){return this.updateOne(e,{name:t},...n)}async moveGroupToOrgUnit(e,t,...n){return this.updateOne(e,{orgUnit:t},...n)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>ye(t.tenant,e))}}class it extends ve{constructor(){super(Ke)}async addPrincipalToGroup(e,t,n,i,...r){return this.create({tenant:e,group:t,principal:n,metadata:i},...r)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>me(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>me(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const n=new Qe,i=await this.listPrincipalGroups(e,...t);return await Promise.all(i.map(async e=>{const i=Ae(e.tenant),r=Ae(e.group);return(await n.getGroupPrincipal(i,r,...t)).id}))}}class rt extends ve{constructor(){super(Te)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...n){return this.updateOne(e,{description:t},...n)}}class st extends ve{constructor(){super(Ue)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const n=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!n)throw Error(`Role "${e}" not found`);return n}async getTenantRoleByKey(e,t,...n){const i=(await this.listAll(...n)).find(n=>ye(n.tenant,e)&&n.key===t);if(!i)throw Error(`Role "${t}" not found for tenant ${e}`);return i}async renameRole(e,t,...n){return this.updateOne(e,{name:t},...n)}async updateRoleMetadata(e,t,...n){return this.updateOne(e,{metadata:t},...n)}async listTenantRoles(e,t=!1,...n){return(await this.listAll(...n)).filter(n=>t&&!n.tenant||ye(n.tenant,e))}}class at extends ve{constructor(){super(Ne)}async addPermissionToRole(e,t,...n){return this.create({role:e,permission:t},...n)}async addPermissionKeyToRole(e,t,...n){const i=await(new rt).getByKey(t,...n);return this.addPermissionToRole(e,i.id,...n)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>me(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>me(t.permission,e))}async replaceRolePermissions(e,t,...n){const i=await this.listRolePermissions(e,...n);return await(async(e,t,...n)=>{for(const i of t)await e.deleteById(i.id,...n)})(this,i,...n),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...n)))}async createRoleWithPermissions(e,t,...n){const i=await(new st).createRole(e,...n);for(const e of t)await this.addPermissionKeyToRole(i.id,e,...n);return i}}class ot extends ve{constructor(){super(Ce)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...n){return(await this.listAll(...n)).filter(n=>ye(n.tenant,e)&&me(n.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>me(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>ye(t.tenant,e))}async updateAssignmentWindow(e,t,n,...i){return this.updateOne(e,{startsAt:t,expiresAt:n},...i)}}class pt extends ve{constructor(){super(qe)}async listForPrincipal(e,t,...n){return(await this.listAll(...n)).filter(n=>ye(n.tenant,e)&&me(n.principal,t))}async listForScope(e,t,n,...i){return(await this.listAll(...i)).filter(i=>ye(i.tenant,e)&&i.scopeKind===t&&i.scopeId===n)}async hasPermission(e,t,n,i,r,s,...a){return(await this.listForPrincipal(e,t,...a)).some(e=>!(e.permissionKey!==n||e.scopeKind!==i||e.scopeId!==r||e.startsAt&&s&&e.startsAt>s||e.expiresAt&&s&&e.expiresAt<s))}async deleteForPrincipal(e,t,...n){for(const i of await this.listForPrincipal(e,t,...n))await this.deleteById(i.id,...n)}async deleteForTenant(e,...t){for(const n of(await this.listAll(...t)).filter(t=>ye(t.tenant,e)))await this.deleteById(n.id,...t)}async rebuildForPrincipal(e,t,...n){await this.deleteForPrincipal(e,t,...n);const i=new ot,r=new at,s=new rt,a=new it,o=new Qe,p=new We,d=new He,c=[],l=await i.listPrincipalAssignments(e,t,...n),u=await a.listPrincipalGroups(t,...n),_=[...l,...(await Promise.all(u.map(async t=>{const r=await o.getGroupPrincipal(Ae(t.tenant),Ae(t.group),...n);return i.listPrincipalAssignments(e,r.id,...n)}))).flat()];for(const i of _){const a=await r.listRolePermissions(Ae(i.role),...n),o=await Promise.all(a.map(async e=>s.findOneBy("id",Ae(e.permission),...n)));for(const r of o){if(!r)continue;const s=i.scopeKind,a=i.scopeId,o=[];if(s===Y.Tenant)o.push({scopeKind:s,scopeId:e});else if(s===Y.Resource)o.push({scopeKind:s,scopeId:a});else if(s!==Y.OrgUnit||i.inheritDown){if(s===Y.OrgUnit&&i.inheritDown){const t=await p.listDescendants(e,a,...n);o.push(...t.map(e=>({scopeKind:s,scopeId:Ae(e.descendant)})))}}else o.push({scopeKind:s,scopeId:a});for(const p of o)s===Y.OrgUnit&&i.inheritDown&&p.scopeId!==a&&await d.categoryBlockedForAncestor(e,p.scopeId,a,r.category,...n)||c.push({id:"",tenantId:e,principalId:t,permissionKey:r.key,scopeKind:p.scopeKind,scopeId:p.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(c.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...n)))}async rebuildForTenant(e,...t){const n=(await(new Qe).listAll(...t)).filter(t=>ye(t.tenant,e));for(const i of n)await this.rebuildForPrincipal(e,i.id,...t)}}L([h(),F("design:type",Function),F("design:paramtypes",[String,String,Object]),F("design:returntype",Promise)],pt.prototype,"rebuildForPrincipal",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,Object]),F("design:returntype",Promise)],pt.prototype,"rebuildForTenant",null);class dt extends ve{constructor(){super(Pe)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,n,...i){return(await this.listAll(...i)).find(i=>ye(i.tenant,e)&&i.resourceType===t&&i.resourceId===n)}async moveResourceToOrgUnit(e,t,...n){return this.updateOne(e,{orgUnit:t},...n)}async setVisibility(e,t,...n){return this.updateOne(e,{visibility:t},...n)}async transferOwnership(e,t,...n){return this.updateOne(e,{owner:t},...n)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>me(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>ye(t.tenant,e))}}class ct extends ve{constructor(){super(Le)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>me(t.resource,e))}async listPrincipalGrants(e,t,...n){return(await this.listAll(...n)).filter(n=>ye(n.tenant,e)&&me(n.principal,t))}async hasGrant(e,t,n,i,r,...s){return(await this.listPrincipalGrants(e,t,...s)).some(e=>me(e.resource,n)&&e.permissionKey===i&&(!e.startsAt||!r||e.startsAt<=r)&&(!e.expiresAt||!r||e.expiresAt>=r))}async deleteAllForResource(e,...t){for(const n of await this.listResourceGrants(e,...t))await this.deleteById(n.id,...t)}}class lt{async unregisterResource(e,...t){await(new ct).deleteAllForResource(e,...t),await(new dt).deleteById(e,...t)}async resolveResourceScope(e,...t){const n=await(new dt).getById(e,...t);return{tenantId:Ae(n.tenant),orgUnitId:Ae(n.orgUnit),visibility:n.visibility,ownerPrincipalId:n.owner?Ae(n.owner):void 0}}}class ut extends ve{constructor(){super(je)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>Ae(t.tenant)===e)}async getBinding(e,t,...n){return(await this.listTenantBindings(e,...n)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...n){return this.updateOne(e,{config:t},...n)}async promoteToDedicated(e,t,n,i,...r){return this.updateOne(e,{bindingKind:V.Dedicated,bindingKey:t,region:n,config:i},...r)}async setShared(e,t,n,i,...r){return this.updateOne(e,{bindingKind:V.Shared,bindingKey:t,region:n,config:i},...r)}}class _t{constructor(){this.tenantService=new Ve,this.tenantProfileService=new Ye,this.orgUnitService=new Je,this.orgUnitProfileService=new ze,this.userService=new Ze,this.membershipService=new et,this.principalService=new Qe,this.permissionService=new rt,this.roleService=new st,this.rolePermissionService=new at,this.roleAssignmentService=new ot,this.effectivePermissionService=new pt}async bootstrapTenantFromTemplate(e,...t){const n=await this.tenantService.createTenant(e.tenant,...t);e.tenant.profileKey&&await this.tenantProfileService.createProfile(n.id,e.tenant.profileKey,e.tenant.profileMetadata,...t);const i=async(e,r)=>{const s=void 0===e?await this.orgUnitService.createRoot(n.id,r.name,r.metadata,r.profileKey,r.metadata,...t):await this.orgUnitService.createChild({tenantId:n.id,parentOrgUnitId:e,name:r.name,metadata:r.metadata,profileKey:r.profileKey,profileMetadata:r.metadata},...t);for(const e of r.children??[])await i(s.id,e);return s},r=await i(void 0,e.rootOrgUnit),s=await this.userService.createUser(e.ownerUser,...t);await this.membershipService.addUserToTenant(n.id,s.id,q.Active,...t);const a=await this.principalService.getUserPrincipal(n.id,s.id,...t);for(const n of e.permissions)await this.permissionService.createPermission(n,...t);for(const i of e.roles){const e=await this.roleService.createRole({tenantId:n.id,key:i.key,name:i.name,description:i.description},...t);for(const n of i.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(e.id,n,...t)}const o=await this.roleService.getTenantRoleByKey(n.id,e.ownerRoleKey,...t);return await this.roleAssignmentService.assignRole({tenantId:n.id,principalId:a.id,roleId:o.id,scopeKind:Y.OrgUnit,scopeId:r.id,inheritDown:!0},...t),await this.effectivePermissionService.rebuildForPrincipal(n.id,a.id,...t),{tenantId:n.id,rootOrgUnitId:r.id,ownerUserId:s.id,ownerPrincipalId:a.id}}}L([h(),F("design:type",Function),F("design:paramtypes",[Object,Object]),F("design:returntype",Promise)],_t.prototype,"bootstrapTenantFromTemplate",null);class gt{constructor(){this.membershipService=new et,this.orgMembershipService=new tt,this.principalService=new Qe,this.roleService=new st,this.roleAssignmentService=new ot,this.effectivePermissionService=new pt}async onboardUserToTenantAndOrgUnit(e,t,n,i,...r){await this.membershipService.addUserToTenant(e,t,q.Active,...r),await this.orgMembershipService.addUserToOrgUnit(e,n,t,q.Active,...r);const s=await this.principalService.getUserPrincipal(e,t,...r),a=await this.roleService.getTenantRoleByKey(e,i,...r);return await this.roleAssignmentService.assignRole({tenantId:e,principalId:s.id,roleId:a.id,scopeKind:Y.OrgUnit,scopeId:n,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(e,s.id,...r),{principalId:s.id}}async changeUserOrgRole(e,t,n,i,r,...s){const a=await this.roleService.getTenantRoleByKey(e,i,...s),o=await this.roleAssignmentService.listPrincipalAssignments(e,t,...s);for(const e of o.filter(e=>e.scopeKind===Y.OrgUnit&&e.scopeId===n))await this.roleAssignmentService.revokeAssignment(e.id,...s);await this.roleAssignmentService.assignRole({tenantId:e,principalId:t,roleId:a.id,scopeKind:Y.OrgUnit,scopeId:n,inheritDown:r},...s),await this.effectivePermissionService.rebuildForPrincipal(e,t,...s)}async suspendUserInTenant(e,t,n,...i){await this.membershipService.setStatus(e,q.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(t,n,...i)}async reactivateUserInTenant(e,t,n,...i){await this.membershipService.setStatus(e,q.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(t,n,...i)}}L([h(),F("design:type",Function),F("design:paramtypes",[String,String,String,String,Object]),F("design:returntype",Promise)],gt.prototype,"onboardUserToTenantAndOrgUnit",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,String,String,String,Boolean,Object]),F("design:returntype",Promise)],gt.prototype,"changeUserOrgRole",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,String,String,Object]),F("design:returntype",Promise)],gt.prototype,"suspendUserInTenant",null),L([h(),F("design:type",Function),F("design:paramtypes",[String,String,String,Object]),F("design:returntype",Promise)],gt.prototype,"reactivateUserInTenant",null);class yt{constructor(e={}){this.dataSources=e}async canAccess(e,...t){const n=e.at??new Date;if(e.scopeKind&&e.scopeId)return ge(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,e.scopeKind,e.scopeId))).some(t=>t.permissionKey===e.permissionKey&&fe(n,t.startsAt,t.expiresAt));if(!e.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(e.tenantId,e.resourceProtectedId));if(!i)return!1;if(i.tenantId!==e.tenantId)return!1;if(i.ownerPrincipalId===e.principalId)return!0;if(ge(await(this.dataSources.listResourceGrants?.(e.tenantId,e.resourceProtectedId))).filter(t=>t.principalId===e.principalId&&t.permissionKey===e.permissionKey&&fe(n,t.startsAt,t.expiresAt)).length>0)return!0;const r=i.visibility;return r!==W.Private&&r!==W.ResourceAcl&&(r===W.OrgUnit||r===W.OrgSubtree?ge(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,Y.OrgUnit,i.orgUnitId))).some(t=>t.permissionKey===e.permissionKey&&fe(n,t.startsAt,t.expiresAt)):r===W.Tenant&&ge(await(this.dataSources.listEffectivePermissionsForScope?.(e.tenantId,Y.Tenant,e.tenantId))).some(t=>t.permissionKey===e.permissionKey&&fe(n,t.startsAt,t.expiresAt)))}async requireAccess(e,...t){if(!await this.canAccess(e,...t))throw new f(`Access denied for ${e.permissionKey} on ${e.resourceProtectedId??(n=e.scopeKind??Y.Resource,i=e.scopeId??"",`${n}:${i}`)}`);var n,i}async buildAccessContext(e,t,...n){return Se({tenantId:e,principalId:t,permissions:ge(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:ge(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,n,...i){const r=await this.buildAccessContext(e,t,...i),s=r.allowedOrgUnitIdsByPermission[n]??[],a=r.resourceGrants.filter(e=>e.permissionKey===n).map(e=>e.resourceId);return ce({tenantId:e,principalId:t,permissionKey:n,allowedOrgUnitIds:s,allowedResourceIds:a})}async buildQdrantFilter(e,t,n,...i){const r=await this.buildAccessContext(e,t,...i);return le({tenantId:e,principalId:t,allowedOrgUnitIds:r.allowedOrgUnitIdsByPermission[n]??[],allowedResourceIds:r.resourceGrants.filter(e=>e.permissionKey===n).map(e=>e.resourceId)})}}let mt=class extends S{constructor(e){super(e),this.enabled=!0}};L([p({type:String}),d(),F("design:type",String)],mt.prototype,"id",void 0),L([T(),N(String),l(),F("design:type",String)],mt.prototype,"name",void 0),L([T(),N(String),l(),F("design:type",String)],mt.prototype,"provider",void 0),L([T(),N(String),l(),F("design:type",String)],mt.prototype,"encryptedPayload",void 0),L([T(),N(Object),l(),F("design:type",Object)],mt.prototype,"encryption",void 0),L([N(String),l(),F("design:type",String)],mt.prototype,"contentType",void 0),L([N(Object),l(),F("design:type",Object)],mt.prototype,"tags",void 0),L([N(Boolean),l(),F("design:type",Boolean)],mt.prototype,"enabled",void 0),L([N(String),l(),F("design:type",String)],mt.prototype,"version",void 0),L([N(String),l(),F("design:type",String)],mt.prototype,"externalId",void 0),L([N(String),l(),F("design:type",String)],mt.prototype,"uri",void 0),L([N(String),l("tenant_id"),F("design:type",String)],mt.prototype,"tenantId",void 0),L([N(String),l("org_unit_id"),F("design:type",String)],mt.prototype,"orgUnitId",void 0),L([N(String),l("owner_principal_id"),F("design:type",String)],mt.prototype,"ownerPrincipalId",void 0),mt=L([g("secrets"),C(),P("Encrypted secret record stored through the model-backed secret service"),F("design:paramtypes",[Object])],mt);const ht=n.accumulate({secrets:{provider:""}}).accumulate({secrets:{model:{keySecret:"",keyId:""}}});class ft extends i{constructor(e,t,n){super(t),this.secretCode=e,this.name="SecretError",n&&(this.cause=n)}}function St(e){if("string"==typeof e)return{encoding:"utf8",value:e};if(e instanceof Uint8Array)return{encoding:"base64",value:Buffer.from(e).toString("base64")};if("object"==typeof e&&null!==e)try{return{encoding:"json",value:JSON.stringify(e)}}catch(e){throw new ft("SECRET_SERIALIZATION_FAILED","Failed to serialize payload as JSON: "+e.message,e)}throw new ft("SECRET_INVALID_PAYLOAD","Invalid payload type: "+typeof e)}const vt=/^[a-zA-Z0-9_-]+$/;function wt(e){if(!e||"string"!=typeof e)return!1;const t=e.trim();return!(0===t.length||t.length>255||(e=>{for(const t of e){const e=t.charCodeAt(0);if(31>=e||127===e)return!0}return!1})(t)||t.includes("..")||t.includes("   ")||!vt.test(t))}function At(e){if(!wt(e))throw new ft("SECRET_INVALID_NAME","Invalid secret name: "+e);return e.trim()}class Et extends v{getConfigFromArgs(...e){const t=e[0];if(t&&"object"==typeof t)return t;const n=this.configFromEnvironment();if(n)return n;throw new r("Secret service config must be the first initialize argument, or resolvable from environment")}}function bt(e){return"string"==typeof e&&e.length>0?e:void 0}const Rt="default-key";class Ot extends Et{constructor(){super(),this.provider="model"}configFromEnvironment(){const e=ht.secrets.model,t=bt(e?.keySecret);if(t)return{provider:"model",keySecret:t,keyId:bt(e.keyId)}}async initialize(...e){const t=this.getConfigFromArgs(...e),n=e[1]||w.forModel(mt);return this.cryptoService=new B,await this.cryptoService.boot({}),{config:t,client:n}}async store(e,t,n={},...i){const{log:r,ctxArgs:s}=(await this.logCtx(i,"store",!0)).for(this.store);r.verbose("Storing secret "+e);try{wt(e)}catch(e){throw this.parseError(e)}const a=At(e),o=St(t),p=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret),d=this.cryptoService.extractKeyFromDerivedKey(p),{encryptedData:c,metadata:l}=await this.cryptoService.encryptPayload(JSON.stringify(o),this.config.keyId||Rt,d.key),u=new Date,_=new mt({name:a,provider:this.provider,encryptedPayload:c,encryption:{keyId:l.keyId,iv:l.iv,salt:d.salt},contentType:n.contentType,tags:n.tags,enabled:!0,version:n.version,tenantId:n.tenantId,orgUnitId:n.orgUnitId,ownerPrincipalId:n.ownerPrincipalId}),g=n.version??"";if((await this.client.select().where(A.attr("name").eq(a)).execute(...s)).some(e=>(e.version??"")===g))throw new ft("SECRET_ALREADY_EXISTS",`Secret ${JSON.stringify(a)}${g?" version "+JSON.stringify(g):""} already exists`);try{await this.client.create(_,...s)}catch(e){throw this.parseError(e)}return{provider:this.provider,name:a,version:n.version,metadata:{createdAt:u.toISOString()}}}async retrieve(e,t={},...n){const{log:r,ctx:a,ctxArgs:o}=(await this.logCtx(n,"retrieve",!0)).for(this.retrieve),p="string"==typeof e?e:e.name;let d,c;r.verbose("Retrieving secret "+p),"string"==typeof e?(d=e,c=t.version):(d=e.name,c=e.version);try{wt(d)}catch(e){throw this.parseError(e)}const l=At(d);let u=A.attr("name").eq(l);c&&(u=u.and(A.attr("version").eq(c))),u=u.and(A.attr("enabled").eq(!0));const _=(await this.withinPrincipalTransaction(a,e=>this.client.override({transactionLock:e}).select().where(u).orderBy(["updatedAt",E.DSC]).execute(...o)))[0];if(!_)throw new s(`Secret "${l}" not found`);const g=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret,_.encryption?.salt);let y,m;try{y=await this.cryptoService.decryptPayload(_.encryptedPayload,this.cryptoService.extractKeyFromDerivedKey(g).key)}catch(e){throw new i(`Failed to decrypt secret "${l}": ${e.message}`)}try{m=JSON.parse(y)}catch(e){throw new i(`Failed to deserialize secret "${l}": ${e.message}`)}return(e=>{switch(e.encoding){case"utf8":return e.value;case"json":try{return JSON.parse(e.value)}catch(e){throw new ft("SECRET_DESERIALIZATION_FAILED","Failed to deserialize JSON payload: "+e.message,e)}case"base64":return Buffer.from(e.value,"base64");default:throw new ft("SECRET_DESERIALIZATION_FAILED","Unknown encoding: "+e.encoding)}})(m)}async withinPrincipalTransaction(e,t){const n=e.getOrUndefined("transactionLock"),r=n??b(this.client);let s;r.depth++,n||(await r.begin(e),e.cache.put("transactionLock",r));try{s=await t(r)}catch(t){const n=0===r.depth;if(r.depth=0,!n)try{await r.rollback(t,e)}catch(e){}throw t}if(r.depth--,0===r.depth)try{await r.commit(e)}catch(e){throw new i("Failed to commit transaction: "+e)}return s}async delete(e,t={},...n){const{log:i,ctxArgs:r}=(await this.logCtx(n,"delete",!0)).for(this.delete),s="string"==typeof e?e:e.name;let a;i.verbose("Deleting secret "+s),a="string"==typeof e?e:e.name;try{wt(a)}catch(e){throw this.parseError(e)}const o=At(a);let p=A.attr("name").eq(o);const d=t.version;d&&(p=p.and(A.attr("version").eq(d)));const c=(await this.client.select().where(p).orderBy(["updatedAt",E.DSC]).execute(...r))[0];c&&(t.force?await this.client.delete(c.id,...r):(c.enabled=!1,c.updatedAt=new Date,await this.client.update(c,...r)))}async exists(e,t={},...n){const{log:i,ctxArgs:r}=(await this.logCtx(n,"exists",!0)).for(this.exists),s="string"==typeof e?e:e.name;let a;i.verbose(`Checking if secret ${s} exists`),a="string"==typeof e?e:e.name;try{wt(a)}catch(e){throw this.parseError(e)}const o=At(a);let p=A.attr("name").eq(o);p=p.and(A.attr("enabled").eq(!0));const d=t.version??("object"==typeof e?e.version:void 0);return d&&(p=p.and(A.attr("version").eq(d))),await this.client.count().where(p).execute(...r)>0}async list(e={},...t){const{log:n,ctxArgs:i}=(await this.logCtx(t,"list",!0)).for(this.list);n.verbose("Listing secrets");let r=null;return void 0!==e.enabled&&(r=A.attr("enabled").eq(e.enabled)),(await this.client.select().where(r||A.attr("name").dif(null)).execute(...i)).map(e=>({provider:e.provider,name:e.name,version:e.version,createdAt:e.createdAt,updatedAt:e.updatedAt,enabled:e.enabled,contentType:e.contentType,tags:e.tags}))}async metadata(e,t={},...n){const{log:i,ctxArgs:r}=(await this.logCtx(n,"metadata",!0)).for(this.metadata),s="string"==typeof e?e:e.name;let a;i.verbose("Getting metadata for secret "+s),a="string"==typeof e?e:e.name;try{wt(a)}catch(e){throw this.parseError(e)}const o=At(a);let p=A.attr("name").eq(o);const d=t.version??("object"==typeof e?e.version:void 0);d&&(p=p.and(A.attr("version").eq(d)));const c=(await this.client.select().where(p).orderBy(["updatedAt",E.DSC]).execute(...r))[0];if(!c)return;const l={provider:c.provider,name:c.name,version:c.version,createdAt:c.createdAt,updatedAt:c.updatedAt,enabled:c.enabled,contentType:c.contentType};return t.includeTags&&(l.tags=c.tags),l}async rotate(e,t,n={},...i){const{log:r,ctxArgs:a}=(await this.logCtx(i,"rotate",!0)).for(this.rotate),o="string"==typeof e?e:e.name;r.verbose("Rotating secret "+o);const p=At(o);let d=A.attr("name").eq(p);d=d.and(A.attr("enabled").eq(!0));const c=n.oldVersion??("object"==typeof e?e.version:void 0);c&&(d=d.and(A.attr("version").eq(c)));const l=(await this.client.select().where(d).orderBy(["updatedAt",E.DSC]).execute(...a))[0];if(!l)throw new s(`Secret "${p}" not found`);const u=n.newVersion??l.version,_=u??"";if(_!==(l.version??"")&&(await this.client.select().where(A.attr("name").eq(p)).execute(...a)).some(e=>e.id!==l.id&&(e.version??"")===_))throw new ft("SECRET_ALREADY_EXISTS",`Secret ${JSON.stringify(p)}${_?" version "+JSON.stringify(_):""} already exists`);const g=St(t),y=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret),m=this.cryptoService.extractKeyFromDerivedKey(y),{encryptedData:h,metadata:f}=await this.cryptoService.encryptPayload(JSON.stringify(g),n.keyId||this.config.keyId||Rt,m.key);l.encryptedPayload=h,l.encryption={keyId:f.keyId,iv:f.iv,salt:m.salt},l.version=u,l.updatedAt=new Date;try{await this.client.update(l,...a)}catch(e){throw this.parseError(e)}return{provider:this.provider,name:p,version:l.version}}parseError(e){const t=e,n=t.message||t.name||"Unknown error",i=n.toLowerCase();return i.includes("not found")||i.includes("404")?new ft("SECRET_NOT_FOUND","Secret not found: "+n,t):i.includes("already exists")||i.includes("conflict")||i.includes("409")||i.includes("duplicate key")||i.includes("unique constraint")||"23505"===t.code?new ft("SECRET_ALREADY_EXISTS","Secret already exists: "+n,t):i.includes("decryption")||i.includes("decrypt")?new ft("SECRET_DECRYPTION_FAILED","Decryption failed: "+n,t):new ft("SECRET_PROVIDER_CONFLICT","Provider error: "+n,t)}}class It extends ve{constructor(e={}){super(Me),this.secretServiceInstance=e.secretService,e.repository&&(this._repository=e.repository)}async secretService(){let e=this.secretServiceInstance;if(!e){const t=new Ot;await t.boot(),this.secretServiceInstance=t,e=t}if("model"!==e.provider)throw new r("CredentialService stores user/runtime credentials in the model-backed secret service");return e}async createCredential(e,...t){const{log:n,ctxArgs:i}=(await this.logCtx(t,"createCredential",!0)).for(this.createCredential),s=e.name?.trim();if(!s||s.length>255||!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(s))throw new r("Invalid credential name: "+JSON.stringify(e.name));n.verbose("Creating credential "+s);const a=await this.secretService(),o=At("credential-"+k()),p=await a.store(o,e.secret,{tenantId:e.tenantId,orgUnitId:e.orgUnitId,ownerPrincipalId:e.ownerPrincipalId},...i);try{return await this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,owner:e.ownerPrincipalId,name:s,credentialType:e.credentialType,secretName:p.name,provider:X.Model,description:e.description,metadata:e.metadata,expiresAt:e.expiresAt,enabled:!0},...i)}catch(e){throw await a.delete(o,{force:!0},...i).catch(()=>{}),e}}async rotateCredential(e,...t){const{log:n,ctxArgs:i}=(await this.logCtx(t,"rotateCredential",!0)).for(this.rotateCredential);n.verbose("Rotating credential "+e.credentialId);const r=await this.repo.read(e.credentialId,...i),s=await this.secretService();return s.rotate?await s.rotate(r.secretName,e.secret,{newVersion:e.version},...i):await s.store(r.secretName,e.secret,{version:e.version,tenantId:Ae(r.tenant),orgUnitId:r.orgUnit?Ae(r.orgUnit):void 0,ownerPrincipalId:r.owner?Ae(r.owner):void 0},...i),r.updatedAt=new Date,this.repo.update(r,...i)}async getCredential(e,...t){const{log:n,ctx:i,ctxArgs:r}=(await this.logCtx(t,"getCredential",!0)).for(this.getCredential);return n.verbose("Reading credential "+e),this.withinTransaction(i,()=>this.repo.read(e,...r))}async listCredentials(...e){const{log:t,ctxArgs:n}=(await this.logCtx(e,"listCredentials",!0)).for(this.listCredentials);return t.verbose("Listing credentials"),(await this.repo.select().execute(...n)).map(e=>this.toSummary(e))}async markCredentialUsed(e,...t){const{log:n,ctx:i,ctxArgs:r}=(await this.logCtx(t,"markCredentialUsed",!0)).for(this.markCredentialUsed);return n.verbose(`Marking credential ${e} as used`),this.withinTransaction(i,async()=>{const t=await this.repo.read(e,...r);return t.lastUsedAt=new Date,this.repo.update(t,...r)})}async deleteCredential(e,...t){const{log:n,ctxArgs:i}=(await this.logCtx(t,"deleteCredential",!0)).for(this.deleteCredential);n.verbose("Deleting credential "+e);const r=await this.repo.read(e,...i);await this.repo.delete(e,...i);const s=await this.secretService();await s.delete(r.secretName,{force:!0},...i)}async withinTransaction(e,t){const n=this.repo?.adapter;if(!n||"function"!=typeof n.transactionLock)return t();const r=e??await this.context("credentialTransaction",{}),s=r.getOrUndefined("transactionLock"),a=s??b(this.repo);let o;a.depth++,s||(await a.begin(r),r.cache.put("transactionLock",a));try{o=await t()}catch(e){const t=0===a.depth;if(a.depth=0,!t)try{await a.rollback(e,r)}catch(e){}throw e}if(a.depth--,0===a.depth)try{await a.commit(r)}catch(e){throw new i("Failed to commit transaction: "+e)}return o}toSummary(e){return{id:e.id,tenantId:Ae(e.tenant),orgUnitId:e.orgUnit?Ae(e.orgUnit):void 0,ownerPrincipalId:e.owner?Ae(e.owner):void 0,name:e.name,credentialType:e.credentialType,provider:e.provider,description:e.description,enabled:e.enabled,metadata:e.metadata,expiresAt:e.expiresAt,lastUsedAt:e.lastUsedAt,createdAt:e.createdAt,updatedAt:e.updatedAt}}}const Tt={Read:"namespace.read",Write:"namespace.write",Admin:"namespace.admin"},Nt={Principal:"app.principal_id",Tenant:"app.tenant_id"},Ut={Reader:"namespace-reader",Writer:"namespace-writer",Admin:"namespace-admin"},Ct="SELECT current_user AS rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user",Lt=["tenants","org_units","org_unit_closure","users","groups","principals","tenant_memberships","org_unit_memberships","group_memberships","permissions","roles","role_permissions","role_assignments","inheritance_blocks","protected_resources","resource_grants","effective_permissions","storage_bindings","tenant_profiles","org_unit_profiles","credentials","secrets"],Ft="SET search_path = public, pg_temp",Pt=[`CREATE OR REPLACE FUNCTION app_rls_principal_id()\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nAS $fn$\n  SELECT NULLIF(current_setting('${Nt.Principal}', true), '')::uuid\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_subject_id()\nRETURNS text\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT p.subject_id\n  FROM principals p\n  WHERE p.id = app_rls_principal_id()\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_principal_for_subject(\n  p_subject text,\n  p_tenant uuid DEFAULT NULL\n)\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT CASE WHEN COUNT(*) = 1 THEN (MIN(p.id::text))::uuid ELSE NULL END\n  FROM principals p\n  WHERE p.subject_id = NULLIF(p_subject, '')\n    AND (p_tenant IS NULL OR p.tenant_id = p_tenant)\n$fn$;`,"REVOKE ALL ON FUNCTION app_rls_principal_for_subject(text, uuid) FROM PUBLIC;",`CREATE OR REPLACE FUNCTION app_rls_org_unit_tenant(p_org_unit uuid)\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT ou.tenant_id\n  FROM org_units ou\n  WHERE ou.id = p_org_unit\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_has_permission(\n  p_tenant uuid,\n  p_permission text,\n  p_scope_kind text,\n  p_scope_id text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM effective_permissions ep\n    WHERE ep.tenant_id = p_tenant\n      AND ep.principal_id = app_rls_principal_id()\n      AND ep.permission_key = p_permission\n      AND ep.scope_kind = p_scope_kind\n      AND ep.scope_id = p_scope_id\n      AND (ep.starts_at IS NULL OR ep.starts_at <= now())\n      AND (ep.expires_at IS NULL OR ep.expires_at >= now())\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_tenant_permission(\n  p_tenant uuid,\n  p_permission text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_has_permission(\n    p_tenant,\n    p_permission,\n    'tenant',\n    p_tenant::text\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_org_unit_permission(\n  p_tenant uuid,\n  p_org_unit uuid,\n  p_permission text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_has_permission(\n    p_tenant,\n    p_permission,\n    'tenant',\n    p_tenant::text\n  )\n  OR (\n    p_org_unit IS NOT NULL\n    AND app_rls_has_permission(\n      p_tenant,\n      p_permission,\n      'org_unit',\n      p_org_unit::text\n    )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_tenant_member(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM tenant_memberships tm\n    WHERE tm.tenant_id = p_tenant\n      AND tm.status = 'active'\n      AND tm.user_id::text = app_rls_subject_id()\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_org_unit_member(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM org_unit_memberships m\n    WHERE m.tenant_id = p_tenant\n      AND m.org_unit_id = p_org_unit\n      AND m.status = 'active'\n      AND m.user_id::text = app_rls_subject_id()\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_tenant(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.write')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.read')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_tenant(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.write')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_org_unit(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_can_read_tenant(p_tenant)\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.write')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.read')\n  OR app_rls_is_org_unit_member(p_tenant, p_org_unit)\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_org_unit(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_can_write_tenant(p_tenant)\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.write')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_admin()\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM effective_permissions ep\n    WHERE ep.principal_id = app_rls_principal_id()\n      AND ep.permission_key = 'namespace.admin'\n      AND (ep.starts_at IS NULL OR ep.starts_at <= now())\n      AND (ep.expires_at IS NULL OR ep.expires_at >= now())\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_tenant_admin(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_org_unit_admin(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT app_rls_is_tenant_admin(p_tenant)\n  OR (\n    p_org_unit IS NOT NULL\n    AND app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_scope_admin(\n  p_tenant uuid,\n  p_scope_kind text,\n  p_scope_id text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT CASE\n    WHEN p_scope_kind = 'tenant' THEN app_rls_is_tenant_admin(p_tenant)\n    WHEN p_scope_kind = 'org_unit' THEN app_rls_is_org_unit_admin(\n      p_tenant,\n      p_scope_id::uuid\n    )\n    WHEN p_scope_kind = 'resource' THEN EXISTS (\n      SELECT 1\n      FROM protected_resources r\n      WHERE r.id = p_scope_id::uuid\n        AND r.tenant_id = p_tenant\n        AND app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n    )\n    ELSE false\n  END\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_admin_user(p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM tenant_memberships tm\n    WHERE tm.user_id = p_user_id\n      AND app_rls_is_tenant_admin(tm.tenant_id)\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_group(\n  p_tenant uuid,\n  p_group uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM groups g\n    WHERE g.id = p_group\n      AND g.tenant_id = p_tenant\n      AND (\n        (g.org_unit_id IS NULL AND app_rls_can_read_tenant(p_tenant))\n        OR (\n          g.org_unit_id IS NOT NULL\n          AND app_rls_can_read_org_unit(p_tenant, g.org_unit_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_group(\n  p_tenant uuid,\n  p_group uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM groups g\n    WHERE g.id = p_group\n      AND g.tenant_id = p_tenant\n      AND (\n        (g.org_unit_id IS NULL AND app_rls_can_write_tenant(p_tenant))\n        OR (\n          g.org_unit_id IS NOT NULL\n          AND app_rls_can_write_org_unit(p_tenant, g.org_unit_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_resource(\n  p_tenant uuid,\n  p_resource uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM protected_resources r\n    WHERE r.id = p_resource\n      AND r.tenant_id = p_tenant\n      AND (\n        r.owner_principal_id = app_rls_principal_id()\n        OR app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n        OR (\n          r.visibility = 'tenant'\n          AND app_rls_can_read_tenant(p_tenant)\n        )\n        OR (\n          r.visibility IN ('org_unit', 'org_subtree')\n          AND app_rls_can_read_org_unit(p_tenant, r.org_unit_id)\n        )\n        OR EXISTS (\n          SELECT 1\n          FROM resource_grants g\n          WHERE g.resource_id = r.id\n            AND g.principal_id = app_rls_principal_id()\n            AND g.permission_key IN (\n              'resource.read',\n              'namespace.read',\n              'namespace.write',\n              'namespace.admin'\n            )\n            AND (g.starts_at IS NULL OR g.starts_at <= now())\n            AND (g.expires_at IS NULL OR g.expires_at >= now())\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_resource(\n  p_tenant uuid,\n  p_resource uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM protected_resources r\n    WHERE r.id = p_resource\n      AND r.tenant_id = p_tenant\n      AND (\n        app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n        OR app_rls_can_write_org_unit(p_tenant, r.org_unit_id)\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_role_admin(p_role uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM roles r\n    WHERE r.id = p_role\n      AND (\n        (r.tenant_id IS NULL AND app_rls_is_admin())\n        OR (\n          r.tenant_id IS NOT NULL\n          AND app_rls_is_tenant_admin(r.tenant_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_credential_scope(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT CASE\n    WHEN p_org_unit IS NULL THEN app_rls_can_read_tenant(p_tenant)\n    ELSE app_rls_can_read_org_unit(p_tenant, p_org_unit)\n  END\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_credential_scope(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Ft}\nAS $fn$\n  SELECT CASE\n    WHEN p_org_unit IS NULL THEN app_rls_can_write_tenant(p_tenant)\n    ELSE app_rls_can_write_org_unit(p_tenant, p_org_unit)\n  END\n$fn$;`],Dt="app_rls_is_admin()",$t="app_rls_is_tenant_admin(tenant_id)",jt="app_rls_can_write_org_unit(tenant_id, org_unit_id)",xt="app_rls_can_read_credential_scope(tenant_id, org_unit_id)",kt="app_rls_can_write_credential_scope(tenant_id, org_unit_id)",Bt=[{table:"tenants",select:"app_rls_is_tenant_member(id) OR app_rls_can_read_tenant(id)",insert:Dt,update:"app_rls_is_tenant_admin(id)",delete:"app_rls_is_tenant_admin(id)"},{table:"org_units",select:"app_rls_can_read_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",insert:"app_rls_can_write_tenant(tenant_id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",update:"app_rls_can_write_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",delete:"app_rls_can_write_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))"},{table:"org_unit_closure",select:"app_rls_can_read_org_unit(tenant_id, descendant_org_unit_id)",insert:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)",update:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)",delete:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)"},{table:"users",select:"id::text = app_rls_subject_id() OR app_rls_can_admin_user(id)",insert:Dt,update:"id::text = app_rls_subject_id() OR app_rls_can_admin_user(id)",delete:"app_rls_can_admin_user(id)"},{table:"groups",select:"app_rls_can_read_group(tenant_id, id)",insert:"app_rls_can_write_tenant(tenant_id) OR (org_unit_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, org_unit_id))",update:"app_rls_can_write_group(tenant_id, id)",delete:"app_rls_can_write_group(tenant_id, id)"},{table:"principals",select:"id = app_rls_principal_id() OR (kind = 'user' AND subject_id = app_rls_subject_id()) OR app_rls_is_tenant_admin(tenant_id)",insert:$t,update:$t,delete:$t},{table:"tenant_memberships",select:"user_id::text = app_rls_subject_id() OR app_rls_can_read_tenant(tenant_id)",insert:$t,update:$t,delete:$t},{table:"org_unit_memberships",select:"user_id::text = app_rls_subject_id() OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.admin') OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.write') OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.read')",insert:jt,update:jt,delete:jt},{table:"group_memberships",select:"app_rls_can_read_group(tenant_id, group_id)",insert:"app_rls_can_write_group(tenant_id, group_id)",update:"app_rls_can_write_group(tenant_id, group_id)",delete:"app_rls_can_write_group(tenant_id, group_id)"},{table:"permissions",select:Dt,insert:Dt,update:Dt,delete:Dt},{table:"roles",select:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",insert:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",update:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",delete:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())"},{table:"role_permissions",select:"app_rls_is_role_admin(role_id)",insert:"app_rls_is_role_admin(role_id)",update:"app_rls_is_role_admin(role_id)",delete:"app_rls_is_role_admin(role_id)"},{table:"role_assignments",select:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",insert:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",update:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",delete:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)"},{table:"inheritance_blocks",select:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",insert:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",update:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",delete:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)"},{table:"protected_resources",select:"app_rls_can_read_resource(tenant_id, id)",insert:"app_rls_can_write_tenant(tenant_id) OR (org_unit_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, org_unit_id))",update:"app_rls_can_write_resource(tenant_id, id)",delete:"app_rls_can_write_resource(tenant_id, id)"},{table:"resource_grants",select:"principal_id = app_rls_principal_id() OR app_rls_can_read_resource(tenant_id, resource_id)",insert:"app_rls_can_write_resource(tenant_id, resource_id)",update:"app_rls_can_write_resource(tenant_id, resource_id)",delete:"app_rls_can_write_resource(tenant_id, resource_id)"},{table:"effective_permissions",select:"principal_id = app_rls_principal_id() OR app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",insert:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",update:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",delete:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)"},{table:"storage_bindings",select:$t,insert:$t,update:$t,delete:$t},{table:"tenant_profiles",select:"app_rls_is_tenant_member(tenant_id) OR app_rls_can_read_tenant(tenant_id)",insert:$t,update:$t,delete:$t},{table:"org_unit_profiles",select:"app_rls_can_read_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",insert:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",update:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",delete:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)"},{table:"credentials",select:"owner_principal_id = app_rls_principal_id() OR "+xt,insert:kt,update:kt,delete:kt},{table:"secrets",select:"owner_principal_id = app_rls_principal_id() OR "+xt+" OR (tenant_id IS NULL AND app_rls_is_admin())",insert:kt+" OR (tenant_id IS NULL AND app_rls_is_admin())",update:kt+" OR (tenant_id IS NULL AND app_rls_is_admin())",delete:kt+" OR (tenant_id IS NULL AND app_rls_is_admin())"}];function Kt(e=Bt){const t=[];for(const n of e){!1!==n.enable&&t.push(`ALTER TABLE ${n.table} ENABLE ROW LEVEL SECURITY;`,`ALTER TABLE ${n.table} FORCE ROW LEVEL SECURITY;`);const e=n.table.replace(/[^A-Za-z0-9_]/g,"_"),i=[["select",n.select,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR SELECT USING (${t});`],["insert",n.insert,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR INSERT WITH CHECK (${t});`],["update",n.update,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR UPDATE USING (${t}) WITH CHECK (${t});`],["delete",n.delete,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR DELETE USING (${t});`]];for(const[r,s,a]of i){if(!s)continue;const i=`${e}_${r}_policy`;t.push(`DROP POLICY IF EXISTS ${i} ON ${n.table};`,a(i,s))}}return t}function Gt(){return[...Pt,...Kt()]}function qt(e=Bt){return e.map(e=>e.table)}function Mt(e=Bt){const t=new Set(qt(e)),n=Lt.filter(e=>!t.has(e));if(n.length)throw new i("RLS template is missing tables: "+n.join(", "))}const Yt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;class zt extends i{constructor(e){super(e),this.name="RlsFunctionOwnerError"}}function Wt(e,t){if(t&&void 0!==t.local&&!0!==t.local)throw new r(e+" only supports transaction-local binding: session-wide binding is not allowed")}function Ht(e){if(!e||!Yt.test(e))throw new r("Invalid RLS principal id")}class Vt extends v{constructor(){super()}async initialize(...e){const t=e[0];if(!t||"function"!=typeof t.query)throw new r("RlsBootstrapService requires a query executor as its first argument");return{config:e[1]??{},client:t}}async apply(...e){const{log:t}=(await this.logCtx(e,"apply",!0)).for(this.apply),n=this.statements();if(!n.length)throw new i("No RLS statements to apply");await this.assertFunctionOwnerPrivileges(...e),t.verbose(`Applying ${n.length} RLS statements`);for(const e of n)await this.client.query(e);return t.info(`Applied namespace RLS template (${n.length} statements)`),{applied:n.length}}async assertFunctionOwnerPrivileges(...e){const{log:t}=(await this.logCtx(e,"assertFunctionOwnerPrivileges",!0)).for(this.assertFunctionOwnerPrivileges),n=await this.client.query(Ct),i=n.rows?.[0]??void 0,r=i?.rolname?JSON.stringify(i.rolname):"current_user";if("boolean"!=typeof i?.rolsuper||"boolean"!=typeof i?.rolbypassrls)throw new zt(`Cannot apply the namespace RLS template: could not determine the privileges of ${r}. The SECURITY DEFINER helper functions require a SUPERUSER or BYPASSRLS owner; refusing to apply policies that would recurse under FORCE ROW LEVEL SECURITY.`);if(!i.rolsuper&&!i.rolbypassrls)throw new zt(`Cannot apply the namespace RLS template as ${r}: the executor role is neither SUPERUSER nor BYPASSRLS. The SECURITY DEFINER helper functions must be owned by a role that bypasses RLS, otherwise every policy evaluation recurses under FORCE ROW LEVEL SECURITY and fails. Connect as the database owner/BYPASSRLS migration role, or create the helper functions with a dedicated BYPASSRLS owner.`);t.verbose("Verified RLS function owner privileges for "+r)}statements(){const e=this._config??{};return e.statements?[...e.statements]:e.policies?[...Pt,...Kt(e.policies)]:Gt()}async setPrincipal(e,t={},...n){const{log:i}=(await this.logCtx(n,"setPrincipal",!0)).for(this.setPrincipal);Ht(e),Wt("setPrincipal",t),await this.client.query("SELECT set_config($1, $2, true)",[Nt.Principal,e]),i.verbose("Bound RLS principal (transaction-local)")}async setTenant(e,t={},...n){const{log:i}=(await this.logCtx(n,"setTenant",!0)).for(this.setTenant);Ht(e),Wt("setTenant",t),await this.client.query("SELECT set_config($1, $2, true)",[Nt.Tenant,e]),i.verbose("Bound RLS tenant (transaction-local)")}async clearPrincipal(e={},...t){const{log:n}=(await this.logCtx(t,"clearPrincipal",!0)).for(this.clearPrincipal);Wt("clearPrincipal",e),await this.client.query("SELECT set_config($1, $2, true)",[Nt.Principal,""]),n.verbose("Cleared RLS principal (transaction-local)")}async currentPrincipal(...e){const{log:t}=(await this.logCtx(e,"currentPrincipal",!0)).for(this.currentPrincipal);t.verbose("Reading current RLS principal");const n=await this.client.query("SELECT app_rls_principal_id() AS principal_id");return(n.rows?.[0]??{}).principal_id??null}}async function Xt(e,t,n,i={}){Ht(t),await e.query("BEGIN");try{await e.query("SELECT set_config($1, $2, true)",[Nt.Principal,t]);const r=await n(e);return await e.query(i.commit?"COMMIT":"ROLLBACK"),r}catch(t){try{await e.query("ROLLBACK")}catch{}throw t}}const Jt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;async function Zt(e,t,n){if(!e||"function"!=typeof e.query)throw new r("resolvePrincipalForSubject requires a privileged auth-prime/service-role client, not the application session");const i="string"==typeof t?t.trim():"";if(!i)return;if(null!=n&&("string"!=typeof n||!Jt.test(n)))throw new r("resolvePrincipalForSubject tenantId must be a UUID when provided");const s=await e.query("SELECT app_rls_principal_for_subject($1, $2) AS principal_id",[i,n??null]),a=Array.isArray(s)?s:s?.rows,o=Array.isArray(a)?a[0]?.principal_id:void 0;if("string"!=typeof o)return;const p=o.trim();return Jt.test(p)?p:void 0}function Qt(e,t){try{return e.getOrUndefined(t)}catch{return}}function en(e={}){const t=e.principalContextKey??"principalId",n=e.authenticatedContextKey??"user",i=e.warn??(e=>{});return e=>{if(!e)return;const r=Qt(e,t),s="string"==typeof r?r.trim():"";if(s&&Jt.test(s))return{[Nt.Principal]:s};Qt(e,n)&&i(`Authenticated context has no resolvable namespace principal; ${Nt.Principal} will not be bound and RLS will deny`)}}function tn(e={}){return{sessionBinding:en(e)}}const nn="featureFlag",rn="FEATURE_FLAG",sn="feature-flags:model",an="feature-flags:auth",on="feature-flags:block",pn="feature-flags:render-if",dn="feature-flags:hide-on";function cn(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const n=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===n.length)return t;const[i,...r]=n;return[i,...r.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ln(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function un(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ln(e);const t={};return Object.entries(e).forEach(([e,n])=>{const i=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[n,...i]=t;return[n.toLowerCase(),...i.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==n&&(t[i]=un(n)??n)}),t}function _n(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,n])=>{const i=cn(t),r=un(n);return void 0!==r&&(e[i]=r),e},{})}function gn(e){return!0===e||!!e&&"object"==typeof e}function yn(e,t){return gn(e?.[cn(t)])}function mn(e,t="any"){return{features:[...new Set(e.map(cn).filter(Boolean))],match:t}}function hn(e,t){if(!e||0===e.features.length)return!0;const n=e.features.filter(e=>yn(t,e));return"all"===e.match?n.length===e.features.length:n.length>0}function fn(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>yn(t,e))}function Sn(e,t){return D.get(e,t)}function vn(e){return e.trim().toLowerCase()}function wn(e){return e.trim()}const An=n.accumulate({[nn]:{}});async function En(e=An){return _n(e.featureFlag)}async function bn(e,t=An){return(await En(t))[cn(e)]}async function Rn(e,t=An){return!!await bn(e,t)}let On=class extends S{constructor(e){super(e),this.enabled=!0}};L([p(),d(),F("design:type",String)],On.prototype,"id",void 0),L([y(),T(),l(),F("design:type",String)],On.prototype,"key",void 0),L([l(),F("design:type",Boolean)],On.prototype,"enabled",void 0),L([l(),F("design:type",String)],On.prototype,"description",void 0),L([l(),F("design:type",String)],On.prototype,"scope",void 0),L([l(),F("design:type",Object)],On.prototype,"metadata",void 0),L([l(),F("design:type",Object)],On.prototype,"config",void 0),L([l(),F("design:type",String)],On.prototype,"createdBy",void 0),L([l(),F("design:type",String)],On.prototype,"updatedBy",void 0),L([u(),F("design:type",Date)],On.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],On.prototype,"updatedAt",void 0),On=L([P("Persisted feature flag definition used for runtime evaluation"),g("feature_flags"),C(),F("design:paramtypes",[Object])],On);let In=class extends S{constructor(e){super(e),this.enabled=!0}};L([p(),d(),F("design:type",String)],In.prototype,"id",void 0),L([T(),l(),F("design:type",String)],In.prototype,"featureKey",void 0),L([T(),l(),F("design:type",String)],In.prototype,"subjectType",void 0),L([T(),l(),F("design:type",String)],In.prototype,"subjectKey",void 0),L([l(),F("design:type",Boolean)],In.prototype,"enabled",void 0),L([l(),F("design:type",Object)],In.prototype,"metadata",void 0),L([l(),F("design:type",String)],In.prototype,"createdBy",void 0),L([l(),F("design:type",String)],In.prototype,"updatedBy",void 0),L([u(),F("design:type",Date)],In.prototype,"createdAt",void 0),L([_(),F("design:type",Date)],In.prototype,"updatedAt",void 0),In=L([P("Persisted feature flag access rule for a subject"),g("feature_flag_access"),C(),F("design:paramtypes",[Object])],In);class Tn{async readOne(e,t){return(await this.read(t))[cn(e)]}}class Nn extends Tn{async read(e={}){return En(e.source??{[nn]:{}})}}let Un=class extends o{constructor(){super(On),this.reader=new Nn,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Nn;const n={...t.readerConfig??{},source:t.readerConfig?.source??An};return this.cachedRegistry=await this.refreshCachedRegistry(n,...e),{config:{...t,reader:this.reader,readerConfig:n},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,n])=>(e[t]=n&&"object"==typeof n&&!Array.isArray(n)?{...n}:n,e),{})}async refreshCachedRegistry(e={},...t){const n=await this.reader.read({...e,source:e.source??An});let i=[];try{i=await this.repo.select().execute(...t)}catch{i=[]}const r=this.cloneRegistry(n);for(const e of i)r[e.key]=!!e.enabled&&(e.config??!0);return r}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??w.forModel(In)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:cn(e.featureKey),subjectType:vn(e.subjectType),subjectKey:wn(e.subjectKey)}}buildAccessCondition(e){let t=A.attr("subjectType").eq(vn(e.subjectType));return t=t.and(A.attr("subjectKey").eq(wn(e.subjectKey))),void 0!==e.enabled&&(t=t.and(A.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(A.attr("featureKey").in(e.featureKeys.map(cn)))),t}async create(e,...t){e.key=cn(e.key),e.enabled??=!0;const n=await super.create(e,...t);return this.setCachedFlag(n),n}async update(e,...t){e.key=cn(e.key),e.enabled??=!0;const n=await super.update(e,...t);return this.setCachedFlag(n),n}async findOneBy(e,t,...n){const i="key"===e&&"string"==typeof t?cn(t):t;return this.repo.findOneBy(e,i,...n)}async readAll(e,...t){const n=await this.repo.readAll(e,...t);for(const e of n)this.setCachedFlag(e);return n}async listEnabled(...e){return this.repo.select().where(A.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(e,...t){const n=this.normalizeFeatureAccessInput(e),i=await this.findFeatureAccess(n,...t).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,n),...t):this.getAccessRepository().create(new In(n),...t)}async revokeFeatureAccess(e,...t){const n=await this.findFeatureAccess(e,...t).catch(()=>{});if(n)return this.getAccessRepository().delete(n.id,...t)}async findFeatureAccess(e,...t){const n=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(n).execute(...t))[0];if(!i)throw new s(`Feature access for ${vn(e.subjectType)}:${wn(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const n=await this.listFeatureAccess({...e,enabled:!0},...t),i=[...new Set(n.map(e=>e.featureKey))];if(0===i.length)return{};const r=A.attr("enabled").eq(!0).and(A.attr("key").in(i.map(cn)));return(await this.repo.select().where(r).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...n){return yn(await this.resolveFeatureFlagsForSubject(t,...n),e)}isEnabled(e){this.assertInitialized();const t=cn(e);return yn(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(e={},...t){this.assertInitialized();const n=await this.reader.read({...e,source:e.source??An}),i=[];for(const[e,r]of Object.entries(n)){const n=r&&"object"==typeof r&&!Array.isArray(r)?r:{enabled:!!r},{enabled:s,...a}=n,o=cn(e),p=await this.findOneBy("key",o,...t).catch(()=>{}),d=p?Object.assign(p,{enabled:gn(r),description:a.description??p.description,scope:a.scope??p.scope,metadata:a.metadata??p.metadata,config:{...a,enabled:gn(r)}}):new On({key:o,enabled:gn(r),description:a.description,scope:a.scope,metadata:a.metadata,config:{...a,enabled:gn(r)}});i.push(p?await this.update(d,...t):await this.create(d,...t))}return this.cachedRegistry=await this.refreshCachedRegistry({...e,source:e.source??An},...t),i}};var Cn;function Ln(e){const t=cn(e);return t?t.charAt(0).toUpperCase()+t.slice(1):t}function Fn(e,t){const n=Ln(e);return void 0===t?"engine"+n:`engine${n}${Ln(t)}`}function Pn(e){const t={};for(const n of e.engines??[]){t[Fn(n.engineId)]=!0;for(const e of n.capabilities??[])t[Fn(n.engineId,e.feature)]="SUPPORTED"===e.verdict}return t}L([R(In),F("design:type",Object)],Un.prototype,"accessRepository",void 0),Un=L([O(On),F("design:paramtypes",[])],Un);class Dn extends Tn{constructor(e){super(),this.registry=e}async read(e){return{...this.registry}}}let $n=Cn=class extends Un{constructor(){const e=super();if(!(this instanceof Cn))return Object.assign(Object.create(Cn.prototype),e,{capabilityRegistry:{}});this.capabilityRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.capabilityRegistry=Pn(t.manifest??{engines:[]});const n=new Dn(this.capabilityRegistry);return{config:{...t,reader:n,readerConfig:{...t.readerConfig??{},source:{}}},client:n}}isEngineEnabled(e){return yn(this.capabilityRegistry,Fn(e))}isEngineFeatureEnabled(e,t){return yn(this.capabilityRegistry,Fn(e,t))}isEnabled(e){return yn(this.capabilityRegistry,e)}async resolveFeatureFlags(){return{...this.capabilityRegistry}}async resolveFeatureFlagsForSubject(e,...t){return{...this.capabilityRegistry}}async isEnabledForSubject(e,t,...n){return yn(this.capabilityRegistry,e)}async listEnabled(...e){return Object.entries(this.capabilityRegistry).filter(([,e])=>gn(e)).map(([e])=>new On({key:e,enabled:!0,config:{enabled:!0}}))}async syncFromEnvironment(...e){throw new i("Engine capability feature flags are derived from the served engine manifest and are never synced from the environment")}};function jn(e,t){return void 0===t?e:D.key(e,t.toString())}function xn(e,t,n="any"){const i=mn(t,n);return(t,n,r)=>{if(void 0===n)return $(e,i)(t);const s=jn(e,n);return r?j(s,i)(t,n,r):x(s,i)(t,n)}}function kn(...e){return xn(sn,e)}function Bn(...e){return xn(an,e)}function Kn(...e){return xn(on,e)}function Gn(...e){return xn(pn,e)}function qn(...e){return xn(dn,e)}function Mn(e,t,n){return Sn(e,jn(t,n))}function Yn(e,t,n,i){return hn(Mn(e,n,i),t)}function zn(e,t,n,i){return fn(Mn(e,n,i),t)}$n=Cn=L([O(),F("design:paramtypes",[])],$n);const Wn="##VERSION##",Hn="##COMMIT##",Vn="##FULL_VERSION##",Xn="##PACKAGE##";export{Ee as AuthorizationModel,yt as AuthzService,ve as BaseModelService,_t as BootstrapService,Hn as COMMIT,Me as Credential,X as CredentialProvider,se as CredentialProviderOptions,It as CredentialService,qe as EffectivePermission,pt as EffectivePermissionService,$n as EngineCapabilityFeatureFlagService,Nn as EnvironmeFlagReader,an as FEATURE_FLAG_AUTH_KEY,on as FEATURE_FLAG_BLOCK_KEY,rn as FEATURE_FLAG_ENV_PREFIX,nn as FEATURE_FLAG_ENV_ROOT,dn as FEATURE_FLAG_HIDE_KEY,sn as FEATURE_FLAG_MODEL_KEY,pn as FEATURE_FLAG_RENDER_KEY,Vn as FULL_VERSION,On as FeatureFlag,In as FeatureFlagAccess,An as FeatureFlagEnvironment,Tn as FeatureFlagReader,Un as FeatureFlagService,Ge as Group,Ke as GroupMembership,it as GroupMembershipService,nt as GroupService,De as InheritanceBlock,He as InheritanceBlockService,G as IsolationTier,J as IsolationTierOptions,q as MembershipStatus,Z as MembershipStatusOptions,Bt as NAMESPACE_RLS_POLICY_SETS,$e as OrgUnit,Ie as OrgUnitClosure,We as OrgUnitClosureService,Oe as OrgUnitMembership,tt as OrgUnitMembershipService,Be as OrgUnitProfile,ze as OrgUnitProfileService,Je as OrgUnitService,Xn as PACKAGE_NAME,Jt as PRINCIPAL_UUID_PATTERN,Te as Permission,z as PermissionCategory,te as PermissionCategoryOptions,rt as PermissionService,Fe as Principal,M as PrincipalKind,Q as PrincipalKindOptions,Qe as PrincipalService,Pe as ProtectedResource,dt as ProtectedResourceService,pe as REL_CASCADE_DEPENDENT,de as REL_CASCADE_INSERT_UPDATE,oe as REL_NULLIFY,ae as REL_RESTRICT,Ct as RLS_FUNCTION_OWNER_QUERY,Pt as RLS_FUNCTION_STATEMENTS,Tt as RLS_PERMISSION_KEYS,Lt as RLS_PROTECTED_TABLES,Ut as RLS_ROLE_KEYS,Nt as RLS_SETTINGS,Le as ResourceGrant,ct as ResourceGrantService,lt as ResourceLifecycleService,W as ResourceVisibility,ne as ResourceVisibilityOptions,Vt as RlsBootstrapService,zt as RlsFunctionOwnerError,Ue as Role,Ce as RoleAssignment,ot as RoleAssignmentService,Ne as RolePermission,at as RolePermissionService,st as RoleService,Y as ScopeKind,ee as ScopeKindOptions,je as StorageBinding,V as StorageBindingKind,re as StorageBindingKindOptions,ut as StorageBindingService,H as StorageKind,ie as StorageKindOptions,gt as SystemManagementService,xe as Tenant,be as TenantMembership,et as TenantMembershipService,ke as TenantProfile,Ye as TenantProfileService,Ve as TenantService,Re as User,Ze as UserService,Wn as VERSION,ge as asArray,Ht as assertPrincipalId,Mt as assertRlsTableCoverage,Kn as blockFeatureOperations,Se as buildAccessContext,ce as buildArangoContext,le as buildQdrantFilter,Fn as engineCapabilityFlagKey,Pn as engineCapabilityFlagRegistry,K as execWithLogging,Bn as featureAuth,kn as featureFlags,Mn as getFeatureGateMetadata,Rn as hasFeatureFlagInEnvironment,qn as hideOnFeature,we as id,gn as isFeatureFlagEnabled,yn as isFeatureFlagEnabledByName,fn as isFeatureRuleBlocked,hn as isFeatureRuleSatisfied,fe as isTimeValid,En as loadFeatureFlagsFromEnvironment,he as lowerSlug,en as namespaceRlsSessionBinding,tn as namespaceRlsTypeORMOptions,un as normalizeFeatureConfig,cn as normalizeFeatureName,_n as normalizeFeatureRegistry,mn as normalizeFeatureRule,wn as normalizeFeatureSubjectKey,vn as normalizeFeatureSubjectType,_e as nowIso,ln as parseRuntimeValue,Sn as readMetadata,Ae as relationId,me as relationMatch,Gn as renderIfFeature,bn as resolveFeatureFlagFromEnvironment,Zt as resolvePrincipalForSubject,Gt as rlsBootstrapStatements,Kt as rlsPolicyStatements,qt as rlsPolicyTables,Xt as runAsPrincipal,ye as sameTenant,Yn as shouldExposeForFeatures,zn as shouldHideForFeatures};
 //# sourceMappingURL=integrations.js.map