@decaf-ts/integrations 0.14.0 → 0.14.2

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,t;e=this,t=function(e,t,n,r,i,a,o,s,d,c){"use strict";var p,_,l,u,g,y,m,h,S;e.IsolationTier=void 0,(p=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",p.Bridge="bridge",p.Silo="silo",e.MembershipStatus=void 0,(_=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",_.Active="active",_.Suspended="suspended",_.Removed="removed",e.PrincipalKind=void 0,(l=e.PrincipalKind||(e.PrincipalKind={})).User="user",l.Group="group",l.ServiceAccount="service_account",l.Agent="agent",l.ApiKey="api_key",e.ScopeKind=void 0,(u=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",u.OrgUnit="org_unit",u.Resource="resource",e.PermissionCategory=void 0,(g=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",g.ContentRead="content_read",g.ContentWrite="content_write",g.Memory="memory",g.Graph="graph",g.Vector="vector",g.Export="export",g.Billing="billing",g.Audit="audit",g.Security="security",g.Data="data",g.Automation="automation",e.ResourceVisibility=void 0,(y=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",y.ResourceAcl="resource_acl",y.OrgUnit="org_unit",y.OrgSubtree="org_subtree",y.Tenant="tenant",e.StorageKind=void 0,(m=e.StorageKind||(e.StorageKind={})).Postgres="postgres",m.Arango="arango",m.Qdrant="qdrant",m.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(h=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",h.Dedicated="dedicated",e.CredentialProvider=void 0,(S=e.CredentialProvider||(e.CredentialProvider={})).Model="model",S.Filesystem="filesystem";const f=Object.values(e.IsolationTier),A=Object.values(e.MembershipStatus),E=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),R=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),w=Object.values(e.StorageBindingKind),T=Object.values(e.CredentialProvider),I={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},C={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},U={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},N={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function F(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function P(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function L(e,t){return`${e}:${t}`}function D(e){return e??[]}function k(e,t){return q(e)===t}function j(e,t){return!!t&&q(e)===t}function $(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function x(e,t,n){const r=e??new Date;return!(t&&t>r||n&&r>n)}function B(t){const n={},r={};for(const i of t.permissions){const t=L(i.scopeKind,i.scopeId);n[t]=n[t]??[],n[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(r[i.permissionKey]=r[i.permissionKey]??[],r[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:n,allowedOrgUnitIdsByPermission:r,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class K extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...n){const r=await this.repo.read(e,...n);return this.repo.update(Object.assign(r,t),...n)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...n){return this.repo.findOneBy(e,t,...n)}async findManyBy(e,t,...n){return this.repo.select().where({[e]:t}).execute(...n)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class G extends a.Model{constructor(e){super(e)}}e.TenantMembership=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_tenant_memberships_tenant"),a.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,U,!1,void 0,"fk_tenant_memberships_user"),a.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([a.required(),a.type(String),a.option(A),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([s.description("Membership linking a user to a tenant"),i.table("tenant_memberships"),a.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),a.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),a.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,I,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,I,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([s.description("User identity within the authorization namespace"),i.table("users"),a.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_org_memberships_tenant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_memberships_org_unit"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,I,!1,void 0,"fk_org_memberships_user"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([a.required(),a.type(String),a.option(A),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([s.description("Membership linking a user to an organizational unit"),i.table("org_unit_memberships"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_org_closure_tenant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_closure_ancestor"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_closure_descendant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([a.required(),a.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([s.description("Ancestor/descendant closure entry for the organizational hierarchy"),i.table("org_unit_closure"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([a.required(),a.type(String),a.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,I,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([s.description("Named authorization permission with a category"),i.table("permissions"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,U,!1,void 0,"fk_role_permissions_role"),a.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,U,!1,void 0,"fk_role_permissions_permission"),a.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([s.description("Link between a role and a permission"),i.table("role_permissions"),a.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,C,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,I,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,I,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([s.description("Named role grouping permissions"),i.table("roles"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_role_assignments_tenant"),a.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_role_assignments_principal"),a.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,I,!1,void 0,"fk_role_assignments_role"),a.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([a.required(),a.type(String),a.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([a.required(),a.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([s.description("Role assigned to a principal within a scope"),i.table("role_assignments"),a.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_resource_grants_tenant"),a.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,U,!1,void 0,"fk_resource_grants_resource"),a.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_resource_grants_principal"),a.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,I,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([s.description("Permission grant on a protected resource for a principal"),i.table("resource_grants"),a.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_principals_tenant"),a.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),a.option(E),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,I,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,I,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([s.description("Authorization subject representing a user, group, service account, agent, or API key"),i.table("principals"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_protected_resources_tenant"),a.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,I,!1,void 0,"fk_protected_resources_org_unit"),a.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([a.required(),a.type(String),a.option(R),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,C,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,I,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([s.description("Resource registered for authorization and visibility decisions"),i.table("protected_resources"),a.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_inheritance_blocks_tenant"),a.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_inheritance_blocks_org_unit"),a.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,C,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([a.required(),a.type(String),a.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([s.description("Block preventing permission inheritance from an ancestor organizational unit"),i.table("inheritance_blocks"),a.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_org_units_tenant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,I,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([s.description("Organizational unit node in a tenant hierarchy (department, project, or team)"),i.table("org_units"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_storage_bindings_tenant"),a.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),a.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([a.required(),a.type(String),a.option(w),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([s.description("Storage backend binding configured for a tenant"),i.table("storage_bindings"),a.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),a.option(f),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([s.description("Top-level tenant (organization) namespace"),i.table("tenants"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_tenant_profiles_tenant"),a.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([s.description("Profile metadata attached to a tenant"),i.table("tenant_profiles"),a.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_unit_profiles_org_unit"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([s.description("Profile metadata attached to an organizational unit"),i.table("org_unit_profiles"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_group_memberships_tenant"),a.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,U,!1,void 0,"fk_group_memberships_group"),a.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_group_memberships_principal"),a.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([s.description("Membership linking a principal to a group"),i.table("group_memberships"),a.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_groups_tenant"),a.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,C,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,I,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([s.description("Named group of principals within a tenant and organizational unit"),i.table("groups"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_effective_permissions_tenant"),a.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_effective_permissions_principal"),a.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([a.required(),a.type(String),a.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([s.description("Materialized effective permission granted to a principal within a scope"),i.table("effective_permissions"),a.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission),e.Credential=class extends G{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Credential.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_credentials_tenant"),a.required(),o.__metadata("design:type",Object)],e.Credential.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,C,!1,void 0,"fk_credentials_org_unit"),o.__metadata("design:type",Object)],e.Credential.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.Principal,C,!1,void 0,"fk_credentials_owner"),o.__metadata("design:type",Object)],e.Credential.prototype,"owner",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"credentialType",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"secretName",void 0),o.__decorate([a.required(),a.type(String),a.option(T),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"provider",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"description",void 0),o.__decorate([a.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.Credential.prototype,"enabled",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.Credential.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.Credential.prototype,"expiresAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.Credential.prototype,"lastUsedAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Credential.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Credential.prototype,"updatedAt",void 0),e.Credential=o.__decorate([i.table("credentials"),a.model(),s.description("Namespaced credential metadata record referencing an encrypted secret value"),o.__metadata("design:paramtypes",[Object])],e.Credential);class M extends K{constructor(){super(e.TenantProfile)}async createProfile(e,t,n,...r){return this.create({tenant:e,profileKey:t,metadata:n},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async deleteForTenant(e,...t){for(const n of await this.listForTenant(e,...t))await this.deleteById(n.id,...t)}}class Y extends K{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,n,...r){return this.create({orgUnit:e,profileKey:t,metadata:n},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>j(t.orgUnit,e))}}class z extends K{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,n,...r){return(await this.listAncestors(e,n,...r)).some(e=>j(e.ancestor,t))}async createSelfLink(e,t,...n){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...n)}async insertAncestorLinksForNewChild(e,t,n,...r){const i=await this.listAncestors(e,t,...r);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:n,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...n){const r=await this.listDescendants(e,t,...n),i=new Set([t,...r.map(e=>q(e.descendant))]),a=new Set([t,...r.map(e=>q(e.ancestor))]),o=(await this.listAll(...n)).filter(t=>k(t.tenant,e)&&(i.has(q(t.descendant))||a.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...n)}}class V extends K{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,n,r,i,...a){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:n,reason:i},...a)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.orgUnit,t))}async categoryBlockedForAncestor(e,t,n,r,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||j(e.blockedFromAncestor,n)))}}class W extends K{constructor(){super(e.Tenant)}async createTenant(t,...n){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...n)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...n){return this.updateOne(e,{name:t},...n)}async changeSlug(e,t,...n){return this.updateOne(e,{slug:t},...n)}async setIsolationTier(e,t,...n){return this.updateOne(e,{isolationTier:t},...n)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function H(e,t,...n){for(const r of t)await e.deleteById(r.id,...n)}class X extends K{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const n=$(t);return e?`${e.replace(/\/+$/,"")}/${n}`:"/"+n}async createProfileIfNeeded(e,t,n,...r){t&&await(new Y).createProfile(e,t,n,...r)}async createRoot(e,t,n,r,i,...a){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:n},...a);return await this.createProfileIfNeeded(o.id,r,i,...a),await(new z).createSelfLink(e,o.id,...a),o}async createChild(e,...t){const n=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:n?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(n?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const i=new z;return await i.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>j(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async listDescendantOrgUnits(e,t,n=!1,...r){const i=await(new z).listDescendants(e,t,...r),a=new Set(i.map(e=>q(e.descendant)));return n&&a.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>a.has(e.id))}async listAncestorOrgUnits(e,t,n=!1,...r){const i=await(new z).listAncestors(e,t,...r),a=new Set(i.map(e=>q(e.ancestor)));return n&&a.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>a.has(e.id))}async renameOrgUnit(e,t,...n){const r=await this.getById(e,...n);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...n)}async moveOrgUnit(e,t,n,...r){const i=await this.getById(n,...r),a=await this.getById(t,...r),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,a.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const n=new z,r=await n.listAll(...t);await H(n,r.filter(t=>k(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of i)await n.createSelfLink(e,r.id,...t),r.parent&&await n.insertAncestorLinksForNewChild(e,q(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...n){const r=new z,i=await this.listDescendantOrgUnits(e,t,!0,...n),a=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...n)).filter(e=>a.has(e.id));await H(this,o,...n),await r.deleteLinksForSubtree(e,t,...n)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"deleteOrgUnitTree",null);class J extends K{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...n){return this.updateOne(e,{displayName:t},...n)}async updateEmail(e,t,...n){return this.updateOne(e,{email:t},...n)}async updatePhone(e,t,...n){return this.updateOne(e,{phone:t},...n)}}class Z extends K{constructor(){super(e.Principal)}async createPrincipal(e,t,n,...r){return this.create({tenant:e,kind:t,subjectId:n},...r)}async getForSubject(e,t,n,...r){return(await this.listAll(...r)).find(r=>k(r.tenant,e)&&r.kind===t&&r.subjectId===n)}async getOrCreateForSubject(e,t,n,...r){return await this.getForSubject(e,t,n,...r)??await this.createPrincipal(e,t,n,...r)}async getUserPrincipal(t,n,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.User,n,...r)}async getGroupPrincipal(t,n,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,n,...r)}}class Q extends K{constructor(){super(e.TenantMembership)}async addUserToTenant(t,n,r=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:n,status:r},...i)}async setStatus(e,t,...n){return this.updateOne(e,{status:t},...n)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>j(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class ee extends K{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,n,r,i=e.MembershipStatus.Active,...a){return this.create({tenant:t,orgUnit:n,user:r,status:i},...a)}async setStatus(e,t,...n){return this.updateOne(e,{status:t},...n)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>j(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>j(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class te extends K{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,n,r,...i){return this.create({tenant:e,group:t,principal:n,metadata:r},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>j(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>j(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const n=new Z,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=q(e.tenant),i=q(e.group);return(await n.getGroupPrincipal(r,i,...t)).id}))}}class ne extends K{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...n){return this.updateOne(e,{description:t},...n)}}class re extends K{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const n=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!n)throw Error(`Role "${e}" not found`);return n}async getTenantRoleByKey(e,t,...n){const r=(await this.listAll(...n)).find(n=>k(n.tenant,e)&&n.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...n){return this.updateOne(e,{name:t},...n)}async updateRoleMetadata(e,t,...n){return this.updateOne(e,{metadata:t},...n)}async listTenantRoles(e,t=!1,...n){return(await this.listAll(...n)).filter(n=>t&&!n.tenant||k(n.tenant,e))}}class ie extends K{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...n){return this.create({role:e,permission:t},...n)}async addPermissionKeyToRole(e,t,...n){const r=await(new ne).getByKey(t,...n);return this.addPermissionToRole(e,r.id,...n)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>j(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>j(t.permission,e))}async replaceRolePermissions(e,t,...n){const r=await this.listRolePermissions(e,...n);return await(async(e,t,...n)=>{for(const r of t)await e.deleteById(r.id,...n)})(this,r,...n),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...n)))}async createRoleWithPermissions(e,t,...n){const r=await(new re).createRole(e,...n);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...n);return r}}class ae extends K{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>j(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async updateAssignmentWindow(e,t,n,...r){return this.updateOne(e,{startsAt:t,expiresAt:n},...r)}}class oe extends K{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.principal,t))}async listForScope(e,t,n,...r){return(await this.listAll(...r)).filter(r=>k(r.tenant,e)&&r.scopeKind===t&&r.scopeId===n)}async hasPermission(e,t,n,r,i,a,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==n||e.scopeKind!==r||e.scopeId!==i||e.startsAt&&a&&e.startsAt>a||e.expiresAt&&a&&e.expiresAt<a))}async deleteForPrincipal(e,t,...n){for(const r of await this.listForPrincipal(e,t,...n))await this.deleteById(r.id,...n)}async deleteForTenant(e,...t){for(const n of(await this.listAll(...t)).filter(t=>k(t.tenant,e)))await this.deleteById(n.id,...t)}async rebuildForPrincipal(t,n,...r){await this.deleteForPrincipal(t,n,...r);const i=new ae,a=new ie,o=new ne,s=new te,d=new Z,c=new z,p=new V,_=[],l=await i.listPrincipalAssignments(t,n,...r),u=await s.listPrincipalGroups(n,...r),g=[...l,...(await Promise.all(u.map(async e=>{const n=await d.getGroupPrincipal(q(e.tenant),q(e.group),...r);return i.listPrincipalAssignments(t,n.id,...r)}))).flat()];for(const i of g){const s=await a.listRolePermissions(q(i.role),...r),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...r)));for(const a of d){if(!a)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...r);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,a.category,...r)||_.push({id:"",tenantId:t,principalId:n,permissionKey:a.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(_.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...r)))}async rebuildForTenant(e,...t){const n=(await(new Z).listAll(...t)).filter(t=>k(t.tenant,e));for(const r of n)await this.rebuildForPrincipal(e,r.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"rebuildForTenant",null);class se extends K{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,n,...r){return(await this.listAll(...r)).find(r=>k(r.tenant,e)&&r.resourceType===t&&r.resourceId===n)}async moveResourceToOrgUnit(e,t,...n){return this.updateOne(e,{orgUnit:t},...n)}async setVisibility(e,t,...n){return this.updateOne(e,{visibility:t},...n)}async transferOwnership(e,t,...n){return this.updateOne(e,{owner:t},...n)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>j(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}}class de extends K{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>j(t.resource,e))}async listPrincipalGrants(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.principal,t))}async hasGrant(e,t,n,r,i,...a){return(await this.listPrincipalGrants(e,t,...a)).some(e=>j(e.resource,n)&&e.permissionKey===r&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const n of await this.listResourceGrants(e,...t))await this.deleteById(n.id,...t)}}class ce{constructor(){this.tenantService=new W,this.tenantProfileService=new M,this.orgUnitService=new X,this.orgUnitProfileService=new Y,this.userService=new J,this.membershipService=new Q,this.principalService=new Z,this.permissionService=new ne,this.roleService=new re,this.rolePermissionService=new ie,this.roleAssignmentService=new ae,this.effectivePermissionService=new oe}async bootstrapTenantFromTemplate(t,...n){const r=await this.tenantService.createTenant(t.tenant,...n);t.tenant.profileKey&&await this.tenantProfileService.createProfile(r.id,t.tenant.profileKey,t.tenant.profileMetadata,...n);const i=async(e,t)=>{const a=void 0===e?await this.orgUnitService.createRoot(r.id,t.name,t.metadata,t.profileKey,t.metadata,...n):await this.orgUnitService.createChild({tenantId:r.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...n);for(const e of t.children??[])await i(a.id,e);return a},a=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...n);await this.membershipService.addUserToTenant(r.id,o.id,e.MembershipStatus.Active,...n);const s=await this.principalService.getUserPrincipal(r.id,o.id,...n);for(const e of t.permissions)await this.permissionService.createPermission(e,...n);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:r.id,key:e.key,name:e.name,description:e.description},...n);for(const r of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,r,...n)}const d=await this.roleService.getTenantRoleByKey(r.id,t.ownerRoleKey,...n);return await this.roleAssignmentService.assignRole({tenantId:r.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a.id,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(r.id,s.id,...n),{tenantId:r.id,rootOrgUnitId:a.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ce.prototype,"bootstrapTenantFromTemplate",null);class pe{constructor(){this.membershipService=new Q,this.orgMembershipService=new ee,this.principalService=new Z,this.roleService=new re,this.roleAssignmentService=new ae,this.effectivePermissionService=new oe}async onboardUserToTenantAndOrgUnit(t,n,r,i,...a){await this.membershipService.addUserToTenant(t,n,e.MembershipStatus.Active,...a),await this.orgMembershipService.addUserToOrgUnit(t,r,n,e.MembershipStatus.Active,...a);const o=await this.principalService.getUserPrincipal(t,n,...a),s=await this.roleService.getTenantRoleByKey(t,i,...a);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:!0},...a),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...a),{principalId:o.id}}async changeUserOrgRole(t,n,r,i,a,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,n,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===r))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:n,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:a},...o),await this.effectivePermissionService.rebuildForPrincipal(t,n,...o)}async suspendUserInTenant(t,n,r,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(n,r,...i)}async reactivateUserInTenant(t,n,r,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(n,r,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"reactivateUserInTenant",null);let _e=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}};o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],_e.prototype,"id",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"provider",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"encryptedPayload",void 0),o.__decorate([a.required(),a.type(Object),i.column(),o.__metadata("design:type",Object)],_e.prototype,"encryption",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"contentType",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],_e.prototype,"tags",void 0),o.__decorate([a.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],_e.prototype,"enabled",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"version",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"externalId",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"uri",void 0),o.__decorate([a.type(String),i.column("tenant_id"),o.__metadata("design:type",String)],_e.prototype,"tenantId",void 0),o.__decorate([a.type(String),i.column("org_unit_id"),o.__metadata("design:type",String)],_e.prototype,"orgUnitId",void 0),o.__decorate([a.type(String),i.column("owner_principal_id"),o.__metadata("design:type",String)],_e.prototype,"ownerPrincipalId",void 0),_e=o.__decorate([i.table("secrets"),a.model(),s.description("Encrypted secret record stored through the model-backed secret service"),o.__metadata("design:paramtypes",[Object])],_e);const le=n.LoggedEnvironment.accumulate({secrets:{provider:""}}).accumulate({secrets:{model:{keySecret:"",keyId:""}}});class ue extends r.InternalError{constructor(e,t,n){super(t),this.secretCode=e,this.name="SecretError",n&&(this.cause=n)}}function ge(e){if("string"==typeof e)return{encoding:"utf8",value:e};if(e instanceof Uint8Array)return{encoding:"base64",value:Buffer.from(e).toString("base64")};if("object"==typeof e&&null!==e)try{return{encoding:"json",value:JSON.stringify(e)}}catch(e){throw new ue("SECRET_SERIALIZATION_FAILED","Failed to serialize payload as JSON: "+e.message,e)}throw new ue("SECRET_INVALID_PAYLOAD","Invalid payload type: "+typeof e)}const ye=/^[a-zA-Z0-9_-]+$/;function me(e){if(!e||"string"!=typeof e)return!1;const t=e.trim();return!(0===t.length||t.length>255||(e=>{for(const t of e){const e=t.charCodeAt(0);if(31>=e||127===e)return!0}return!1})(t)||t.includes("..")||t.includes("   ")||!ye.test(t))}function he(e){if(!me(e))throw new ue("SECRET_INVALID_NAME","Invalid secret name: "+e);return e.trim()}class Se extends i.ClientBasedService{getConfigFromArgs(...e){const t=e[0];if(t&&"object"==typeof t)return t;const n=this.configFromEnvironment();if(n)return n;throw new r.ValidationError("Secret service config must be the first initialize argument, or resolvable from environment")}}function fe(e){return"string"==typeof e&&e.length>0?e:void 0}const Ae="default-key";class Ee extends Se{constructor(){super(),this.provider="model"}configFromEnvironment(){const e=le.secrets.model,t=fe(e?.keySecret);if(t)return{provider:"model",keySecret:t,keyId:fe(e.keyId)}}async initialize(...e){const t=this.getConfigFromArgs(...e),n=e[1]||i.Repository.forModel(_e);return this.cryptoService=new c.CryptoService,await this.cryptoService.boot({}),{config:t,client:n}}async store(e,t,n={},...r){const{log:a,ctxArgs:o}=(await this.logCtx(r,"store",!0)).for(this.store);a.verbose("Storing secret "+e);try{me(e)}catch(e){throw this.parseError(e)}const s=he(e),d=ge(t),c=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret),p=this.cryptoService.extractKeyFromDerivedKey(c),{encryptedData:_,metadata:l}=await this.cryptoService.encryptPayload(JSON.stringify(d),this.config.keyId||Ae,p.key),u=new Date,g=new _e({name:s,provider:this.provider,encryptedPayload:_,encryption:{keyId:l.keyId,iv:l.iv,salt:p.salt},contentType:n.contentType,tags:n.tags,enabled:!0,version:n.version,tenantId:n.tenantId,orgUnitId:n.orgUnitId,ownerPrincipalId:n.ownerPrincipalId}),y=n.version??"";if((await this.client.select().where(i.Condition.attr("name").eq(s)).execute(...o)).some(e=>(e.version??"")===y))throw new ue("SECRET_ALREADY_EXISTS",`Secret ${JSON.stringify(s)}${y?" version "+JSON.stringify(y):""} already exists`);try{await this.client.create(g,...o)}catch(e){throw this.parseError(e)}return{provider:this.provider,name:s,version:n.version,metadata:{createdAt:u.toISOString()}}}async retrieve(e,t={},...n){const{log:a,ctx:o,ctxArgs:s}=(await this.logCtx(n,"retrieve",!0)).for(this.retrieve),d="string"==typeof e?e:e.name;let c,p;a.verbose("Retrieving secret "+d),"string"==typeof e?(c=e,p=t.version):(c=e.name,p=e.version);try{me(c)}catch(e){throw this.parseError(e)}const _=he(c);let l=i.Condition.attr("name").eq(_);p&&(l=l.and(i.Condition.attr("version").eq(p))),l=l.and(i.Condition.attr("enabled").eq(!0));const u=(await this.withinPrincipalTransaction(o,e=>this.client.override({transactionLock:e}).select().where(l).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...s)))[0];if(!u)throw new r.NotFoundError(`Secret "${_}" not found`);const g=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret,u.encryption?.salt);let y,m;try{y=await this.cryptoService.decryptPayload(u.encryptedPayload,this.cryptoService.extractKeyFromDerivedKey(g).key)}catch(e){throw new r.InternalError(`Failed to decrypt secret "${_}": ${e.message}`)}try{m=JSON.parse(y)}catch(e){throw new r.InternalError(`Failed to deserialize secret "${_}": ${e.message}`)}return(e=>{switch(e.encoding){case"utf8":return e.value;case"json":try{return JSON.parse(e.value)}catch(e){throw new ue("SECRET_DESERIALIZATION_FAILED","Failed to deserialize JSON payload: "+e.message,e)}case"base64":return Buffer.from(e.value,"base64");default:throw new ue("SECRET_DESERIALIZATION_FAILED","Unknown encoding: "+e.encoding)}})(m)}async withinPrincipalTransaction(e,t){const n=e.getOrUndefined("transactionLock"),a=n??i.resolveTransactionLock(this.client);let o;a.depth++,n||(await a.begin(e),e.cache.put("transactionLock",a));try{o=await t(a)}catch(t){const n=0===a.depth;if(a.depth=0,!n)try{await a.rollback(t,e)}catch(e){}throw t}if(a.depth--,0===a.depth)try{await a.commit(e)}catch(e){throw new r.InternalError("Failed to commit transaction: "+e)}return o}async delete(e,t={},...n){const{log:r,ctxArgs:a}=(await this.logCtx(n,"delete",!0)).for(this.delete),o="string"==typeof e?e:e.name;let s;r.verbose("Deleting secret "+o),s="string"==typeof e?e:e.name;try{me(s)}catch(e){throw this.parseError(e)}const d=he(s);let c=i.Condition.attr("name").eq(d);const p=t.version;p&&(c=c.and(i.Condition.attr("version").eq(p)));const _=(await this.client.select().where(c).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...a))[0];_&&(t.force?await this.client.delete(_.id,...a):(_.enabled=!1,_.updatedAt=new Date,await this.client.update(_,...a)))}async exists(e,t={},...n){const{log:r,ctxArgs:a}=(await this.logCtx(n,"exists",!0)).for(this.exists),o="string"==typeof e?e:e.name;let s;r.verbose(`Checking if secret ${o} exists`),s="string"==typeof e?e:e.name;try{me(s)}catch(e){throw this.parseError(e)}const d=he(s);let c=i.Condition.attr("name").eq(d);c=c.and(i.Condition.attr("enabled").eq(!0));const p=t.version??("object"==typeof e?e.version:void 0);return p&&(c=c.and(i.Condition.attr("version").eq(p))),await this.client.count().where(c).execute(...a)>0}async list(e={},...t){const{log:n,ctxArgs:r}=(await this.logCtx(t,"list",!0)).for(this.list);n.verbose("Listing secrets");let a=null;return void 0!==e.enabled&&(a=i.Condition.attr("enabled").eq(e.enabled)),(await this.client.select().where(a||i.Condition.attr("name").dif(null)).execute(...r)).map(e=>({provider:e.provider,name:e.name,version:e.version,createdAt:e.createdAt,updatedAt:e.updatedAt,enabled:e.enabled,contentType:e.contentType,tags:e.tags}))}async metadata(e,t={},...n){const{log:r,ctxArgs:a}=(await this.logCtx(n,"metadata",!0)).for(this.metadata),o="string"==typeof e?e:e.name;let s;r.verbose("Getting metadata for secret "+o),s="string"==typeof e?e:e.name;try{me(s)}catch(e){throw this.parseError(e)}const d=he(s);let c=i.Condition.attr("name").eq(d);const p=t.version??("object"==typeof e?e.version:void 0);p&&(c=c.and(i.Condition.attr("version").eq(p)));const _=(await this.client.select().where(c).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...a))[0];if(!_)return;const l={provider:_.provider,name:_.name,version:_.version,createdAt:_.createdAt,updatedAt:_.updatedAt,enabled:_.enabled,contentType:_.contentType};return t.includeTags&&(l.tags=_.tags),l}async rotate(e,t,n={},...a){const{log:o,ctxArgs:s}=(await this.logCtx(a,"rotate",!0)).for(this.rotate),d="string"==typeof e?e:e.name;o.verbose("Rotating secret "+d);const c=he(d);let p=i.Condition.attr("name").eq(c);p=p.and(i.Condition.attr("enabled").eq(!0));const _=n.oldVersion??("object"==typeof e?e.version:void 0);_&&(p=p.and(i.Condition.attr("version").eq(_)));const l=(await this.client.select().where(p).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...s))[0];if(!l)throw new r.NotFoundError(`Secret "${c}" not found`);const u=n.newVersion??l.version,g=u??"";if(g!==(l.version??"")&&(await this.client.select().where(i.Condition.attr("name").eq(c)).execute(...s)).some(e=>e.id!==l.id&&(e.version??"")===g))throw new ue("SECRET_ALREADY_EXISTS",`Secret ${JSON.stringify(c)}${g?" version "+JSON.stringify(g):""} already exists`);const y=ge(t),m=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret),h=this.cryptoService.extractKeyFromDerivedKey(m),{encryptedData:S,metadata:f}=await this.cryptoService.encryptPayload(JSON.stringify(y),n.keyId||this.config.keyId||Ae,h.key);l.encryptedPayload=S,l.encryption={keyId:f.keyId,iv:f.iv,salt:h.salt},l.version=u,l.updatedAt=new Date;try{await this.client.update(l,...s)}catch(e){throw this.parseError(e)}return{provider:this.provider,name:c,version:l.version}}parseError(e){const t=e,n=t.message||t.name||"Unknown error",r=n.toLowerCase();return r.includes("not found")||r.includes("404")?new ue("SECRET_NOT_FOUND","Secret not found: "+n,t):r.includes("already exists")||r.includes("conflict")||r.includes("409")||r.includes("duplicate key")||r.includes("unique constraint")||"23505"===t.code?new ue("SECRET_ALREADY_EXISTS","Secret already exists: "+n,t):r.includes("decryption")||r.includes("decrypt")?new ue("SECRET_DECRYPTION_FAILED","Decryption failed: "+n,t):new ue("SECRET_PROVIDER_CONFLICT","Provider error: "+n,t)}}const ve={Principal:"app.principal_id",Tenant:"app.tenant_id"},be="SELECT current_user AS rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user",Re=["tenants","org_units","org_unit_closure","users","groups","principals","tenant_memberships","org_unit_memberships","group_memberships","permissions","roles","role_permissions","role_assignments","inheritance_blocks","protected_resources","resource_grants","effective_permissions","storage_bindings","tenant_profiles","org_unit_profiles","credentials","secrets"],Oe="SET search_path = public, pg_temp",we=[`CREATE OR REPLACE FUNCTION app_rls_principal_id()\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nAS $fn$\n  SELECT NULLIF(current_setting('${ve.Principal}', true), '')::uuid\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_subject_id()\nRETURNS text\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT p.subject_id\n  FROM principals p\n  WHERE p.id = app_rls_principal_id()\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_principal_for_subject(\n  p_subject text,\n  p_tenant uuid DEFAULT NULL\n)\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE WHEN COUNT(*) = 1 THEN (MIN(p.id::text))::uuid ELSE NULL END\n  FROM principals p\n  WHERE p.subject_id = NULLIF(p_subject, '')\n    AND (p_tenant IS NULL OR p.tenant_id = p_tenant)\n$fn$;`,"REVOKE ALL ON FUNCTION app_rls_principal_for_subject(text, uuid) FROM PUBLIC;",`CREATE OR REPLACE FUNCTION app_rls_org_unit_tenant(p_org_unit uuid)\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT ou.tenant_id\n  FROM org_units ou\n  WHERE ou.id = p_org_unit\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_has_permission(\n  p_tenant uuid,\n  p_permission text,\n  p_scope_kind text,\n  p_scope_id text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM effective_permissions ep\n    WHERE ep.tenant_id = p_tenant\n      AND ep.principal_id = app_rls_principal_id()\n      AND ep.permission_key = p_permission\n      AND ep.scope_kind = p_scope_kind\n      AND ep.scope_id = p_scope_id\n      AND (ep.starts_at IS NULL OR ep.starts_at <= now())\n      AND (ep.expires_at IS NULL OR ep.expires_at >= now())\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_tenant_permission(\n  p_tenant uuid,\n  p_permission text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_has_permission(\n    p_tenant,\n    p_permission,\n    'tenant',\n    p_tenant::text\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_org_unit_permission(\n  p_tenant uuid,\n  p_org_unit uuid,\n  p_permission text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_has_permission(\n    p_tenant,\n    p_permission,\n    'tenant',\n    p_tenant::text\n  )\n  OR (\n    p_org_unit IS NOT NULL\n    AND app_rls_has_permission(\n      p_tenant,\n      p_permission,\n      'org_unit',\n      p_org_unit::text\n    )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_tenant_member(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM tenant_memberships tm\n    WHERE tm.tenant_id = p_tenant\n      AND tm.status = 'active'\n      AND tm.user_id::text = app_rls_subject_id()\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_org_unit_member(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM org_unit_memberships m\n    WHERE m.tenant_id = p_tenant\n      AND m.org_unit_id = p_org_unit\n      AND m.status = 'active'\n      AND m.user_id::text = app_rls_subject_id()\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_tenant(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.write')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.read')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_tenant(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.write')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_org_unit(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_can_read_tenant(p_tenant)\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.write')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.read')\n  OR app_rls_is_org_unit_member(p_tenant, p_org_unit)\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_org_unit(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_can_write_tenant(p_tenant)\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.write')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_admin()\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM effective_permissions ep\n    WHERE ep.principal_id = app_rls_principal_id()\n      AND ep.permission_key = 'namespace.admin'\n      AND (ep.starts_at IS NULL OR ep.starts_at <= now())\n      AND (ep.expires_at IS NULL OR ep.expires_at >= now())\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_tenant_admin(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_org_unit_admin(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_is_tenant_admin(p_tenant)\n  OR (\n    p_org_unit IS NOT NULL\n    AND app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_scope_admin(\n  p_tenant uuid,\n  p_scope_kind text,\n  p_scope_id text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE\n    WHEN p_scope_kind = 'tenant' THEN app_rls_is_tenant_admin(p_tenant)\n    WHEN p_scope_kind = 'org_unit' THEN app_rls_is_org_unit_admin(\n      p_tenant,\n      p_scope_id::uuid\n    )\n    WHEN p_scope_kind = 'resource' THEN EXISTS (\n      SELECT 1\n      FROM protected_resources r\n      WHERE r.id = p_scope_id::uuid\n        AND r.tenant_id = p_tenant\n        AND app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n    )\n    ELSE false\n  END\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_admin_user(p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM tenant_memberships tm\n    WHERE tm.user_id = p_user_id\n      AND app_rls_is_tenant_admin(tm.tenant_id)\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_group(\n  p_tenant uuid,\n  p_group uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM groups g\n    WHERE g.id = p_group\n      AND g.tenant_id = p_tenant\n      AND (\n        (g.org_unit_id IS NULL AND app_rls_can_read_tenant(p_tenant))\n        OR (\n          g.org_unit_id IS NOT NULL\n          AND app_rls_can_read_org_unit(p_tenant, g.org_unit_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_group(\n  p_tenant uuid,\n  p_group uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM groups g\n    WHERE g.id = p_group\n      AND g.tenant_id = p_tenant\n      AND (\n        (g.org_unit_id IS NULL AND app_rls_can_write_tenant(p_tenant))\n        OR (\n          g.org_unit_id IS NOT NULL\n          AND app_rls_can_write_org_unit(p_tenant, g.org_unit_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_resource(\n  p_tenant uuid,\n  p_resource uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM protected_resources r\n    WHERE r.id = p_resource\n      AND r.tenant_id = p_tenant\n      AND (\n        r.owner_principal_id = app_rls_principal_id()\n        OR app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n        OR (\n          r.visibility = 'tenant'\n          AND app_rls_can_read_tenant(p_tenant)\n        )\n        OR (\n          r.visibility IN ('org_unit', 'org_subtree')\n          AND app_rls_can_read_org_unit(p_tenant, r.org_unit_id)\n        )\n        OR EXISTS (\n          SELECT 1\n          FROM resource_grants g\n          WHERE g.resource_id = r.id\n            AND g.principal_id = app_rls_principal_id()\n            AND g.permission_key IN (\n              'resource.read',\n              'namespace.read',\n              'namespace.write',\n              'namespace.admin'\n            )\n            AND (g.starts_at IS NULL OR g.starts_at <= now())\n            AND (g.expires_at IS NULL OR g.expires_at >= now())\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_resource(\n  p_tenant uuid,\n  p_resource uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM protected_resources r\n    WHERE r.id = p_resource\n      AND r.tenant_id = p_tenant\n      AND (\n        app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n        OR app_rls_can_write_org_unit(p_tenant, r.org_unit_id)\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_role_admin(p_role uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM roles r\n    WHERE r.id = p_role\n      AND (\n        (r.tenant_id IS NULL AND app_rls_is_admin())\n        OR (\n          r.tenant_id IS NOT NULL\n          AND app_rls_is_tenant_admin(r.tenant_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_credential_scope(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE\n    WHEN p_org_unit IS NULL THEN app_rls_can_read_tenant(p_tenant)\n    ELSE app_rls_can_read_org_unit(p_tenant, p_org_unit)\n  END\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_credential_scope(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE\n    WHEN p_org_unit IS NULL THEN app_rls_can_write_tenant(p_tenant)\n    ELSE app_rls_can_write_org_unit(p_tenant, p_org_unit)\n  END\n$fn$;`],Te="app_rls_is_admin()",Ie="app_rls_is_tenant_admin(tenant_id)",Ce="app_rls_can_write_org_unit(tenant_id, org_unit_id)",Ue="app_rls_can_read_credential_scope(tenant_id, org_unit_id)",Ne="app_rls_can_write_credential_scope(tenant_id, org_unit_id)",Fe=[{table:"tenants",select:"app_rls_is_tenant_member(id) OR app_rls_can_read_tenant(id)",insert:Te,update:"app_rls_is_tenant_admin(id)",delete:"app_rls_is_tenant_admin(id)"},{table:"org_units",select:"app_rls_can_read_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",insert:"app_rls_can_write_tenant(tenant_id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",update:"app_rls_can_write_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",delete:"app_rls_can_write_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))"},{table:"org_unit_closure",select:"app_rls_can_read_org_unit(tenant_id, descendant_org_unit_id)",insert:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)",update:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)",delete:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)"},{table:"users",select:"id::text = app_rls_subject_id() OR app_rls_can_admin_user(id)",insert:Te,update:"id::text = app_rls_subject_id() OR app_rls_can_admin_user(id)",delete:"app_rls_can_admin_user(id)"},{table:"groups",select:"app_rls_can_read_group(tenant_id, id)",insert:"app_rls_can_write_tenant(tenant_id) OR (org_unit_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, org_unit_id))",update:"app_rls_can_write_group(tenant_id, id)",delete:"app_rls_can_write_group(tenant_id, id)"},{table:"principals",select:"id = app_rls_principal_id() OR (kind = 'user' AND subject_id = app_rls_subject_id()) OR app_rls_is_tenant_admin(tenant_id)",insert:Ie,update:Ie,delete:Ie},{table:"tenant_memberships",select:"user_id::text = app_rls_subject_id() OR app_rls_can_read_tenant(tenant_id)",insert:Ie,update:Ie,delete:Ie},{table:"org_unit_memberships",select:"user_id::text = app_rls_subject_id() OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.admin') OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.write') OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.read')",insert:Ce,update:Ce,delete:Ce},{table:"group_memberships",select:"app_rls_can_read_group(tenant_id, group_id)",insert:"app_rls_can_write_group(tenant_id, group_id)",update:"app_rls_can_write_group(tenant_id, group_id)",delete:"app_rls_can_write_group(tenant_id, group_id)"},{table:"permissions",select:Te,insert:Te,update:Te,delete:Te},{table:"roles",select:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",insert:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",update:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",delete:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())"},{table:"role_permissions",select:"app_rls_is_role_admin(role_id)",insert:"app_rls_is_role_admin(role_id)",update:"app_rls_is_role_admin(role_id)",delete:"app_rls_is_role_admin(role_id)"},{table:"role_assignments",select:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",insert:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",update:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",delete:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)"},{table:"inheritance_blocks",select:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",insert:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",update:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",delete:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)"},{table:"protected_resources",select:"app_rls_can_read_resource(tenant_id, id)",insert:"app_rls_can_write_tenant(tenant_id) OR (org_unit_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, org_unit_id))",update:"app_rls_can_write_resource(tenant_id, id)",delete:"app_rls_can_write_resource(tenant_id, id)"},{table:"resource_grants",select:"principal_id = app_rls_principal_id() OR app_rls_can_read_resource(tenant_id, resource_id)",insert:"app_rls_can_write_resource(tenant_id, resource_id)",update:"app_rls_can_write_resource(tenant_id, resource_id)",delete:"app_rls_can_write_resource(tenant_id, resource_id)"},{table:"effective_permissions",select:"principal_id = app_rls_principal_id() OR app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",insert:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",update:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",delete:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)"},{table:"storage_bindings",select:Ie,insert:Ie,update:Ie,delete:Ie},{table:"tenant_profiles",select:"app_rls_is_tenant_member(tenant_id) OR app_rls_can_read_tenant(tenant_id)",insert:Ie,update:Ie,delete:Ie},{table:"org_unit_profiles",select:"app_rls_can_read_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",insert:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",update:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",delete:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)"},{table:"credentials",select:"owner_principal_id = app_rls_principal_id() OR "+Ue,insert:Ne,update:Ne,delete:Ne},{table:"secrets",select:"owner_principal_id = app_rls_principal_id() OR "+Ue+" OR (tenant_id IS NULL AND app_rls_is_admin())",insert:Ne+" OR (tenant_id IS NULL AND app_rls_is_admin())",update:Ne+" OR (tenant_id IS NULL AND app_rls_is_admin())",delete:Ne+" OR (tenant_id IS NULL AND app_rls_is_admin())"}];function Pe(e=Fe){const t=[];for(const n of e){!1!==n.enable&&t.push(`ALTER TABLE ${n.table} ENABLE ROW LEVEL SECURITY;`,`ALTER TABLE ${n.table} FORCE ROW LEVEL SECURITY;`);const e=n.table.replace(/[^A-Za-z0-9_]/g,"_"),r=[["select",n.select,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR SELECT USING (${t});`],["insert",n.insert,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR INSERT WITH CHECK (${t});`],["update",n.update,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR UPDATE USING (${t}) WITH CHECK (${t});`],["delete",n.delete,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR DELETE USING (${t});`]];for(const[i,a,o]of r){if(!a)continue;const r=`${e}_${i}_policy`;t.push(`DROP POLICY IF EXISTS ${r} ON ${n.table};`,o(r,a))}}return t}function Le(){return[...we,...Pe()]}function De(e=Fe){return e.map(e=>e.table)}const ke=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;class je extends r.InternalError{constructor(e){super(e),this.name="RlsFunctionOwnerError"}}function $e(e,t){if(t&&void 0!==t.local&&!0!==t.local)throw new r.ValidationError(e+" only supports transaction-local binding: session-wide binding is not allowed")}function xe(e){if(!e||!ke.test(e))throw new r.ValidationError("Invalid RLS principal id")}class Be extends i.ClientBasedService{constructor(){super()}async initialize(...e){const t=e[0];if(!t||"function"!=typeof t.query)throw new r.ValidationError("RlsBootstrapService requires a query executor as its first argument");return{config:e[1]??{},client:t}}async apply(...e){const{log:t}=(await this.logCtx(e,"apply",!0)).for(this.apply),n=this.statements();if(!n.length)throw new r.InternalError("No RLS statements to apply");await this.assertFunctionOwnerPrivileges(...e),t.verbose(`Applying ${n.length} RLS statements`);for(const e of n)await this.client.query(e);return t.info(`Applied namespace RLS template (${n.length} statements)`),{applied:n.length}}async assertFunctionOwnerPrivileges(...e){const{log:t}=(await this.logCtx(e,"assertFunctionOwnerPrivileges",!0)).for(this.assertFunctionOwnerPrivileges),n=await this.client.query(be),r=n.rows?.[0]??void 0,i=r?.rolname?JSON.stringify(r.rolname):"current_user";if("boolean"!=typeof r?.rolsuper||"boolean"!=typeof r?.rolbypassrls)throw new je(`Cannot apply the namespace RLS template: could not determine the privileges of ${i}. The SECURITY DEFINER helper functions require a SUPERUSER or BYPASSRLS owner; refusing to apply policies that would recurse under FORCE ROW LEVEL SECURITY.`);if(!r.rolsuper&&!r.rolbypassrls)throw new je(`Cannot apply the namespace RLS template as ${i}: the executor role is neither SUPERUSER nor BYPASSRLS. The SECURITY DEFINER helper functions must be owned by a role that bypasses RLS, otherwise every policy evaluation recurses under FORCE ROW LEVEL SECURITY and fails. Connect as the database owner/BYPASSRLS migration role, or create the helper functions with a dedicated BYPASSRLS owner.`);t.verbose("Verified RLS function owner privileges for "+i)}statements(){const e=this._config??{};return e.statements?[...e.statements]:e.policies?[...we,...Pe(e.policies)]:Le()}async setPrincipal(e,t={},...n){const{log:r}=(await this.logCtx(n,"setPrincipal",!0)).for(this.setPrincipal);xe(e),$e("setPrincipal",t),await this.client.query("SELECT set_config($1, $2, true)",[ve.Principal,e]),r.verbose("Bound RLS principal (transaction-local)")}async setTenant(e,t={},...n){const{log:r}=(await this.logCtx(n,"setTenant",!0)).for(this.setTenant);xe(e),$e("setTenant",t),await this.client.query("SELECT set_config($1, $2, true)",[ve.Tenant,e]),r.verbose("Bound RLS tenant (transaction-local)")}async clearPrincipal(e={},...t){const{log:n}=(await this.logCtx(t,"clearPrincipal",!0)).for(this.clearPrincipal);$e("clearPrincipal",e),await this.client.query("SELECT set_config($1, $2, true)",[ve.Principal,""]),n.verbose("Cleared RLS principal (transaction-local)")}async currentPrincipal(...e){const{log:t}=(await this.logCtx(e,"currentPrincipal",!0)).for(this.currentPrincipal);t.verbose("Reading current RLS principal");const n=await this.client.query("SELECT app_rls_principal_id() AS principal_id");return(n.rows?.[0]??{}).principal_id??null}}const Ke=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function qe(e,t){try{return e.getOrUndefined(t)}catch{return}}function Ge(e={}){const t=e.principalContextKey??"principalId",n=e.authenticatedContextKey??"user",r=e.warn??(e=>{});return e=>{if(!e)return;const i=qe(e,t),a="string"==typeof i?i.trim():"";if(a&&Ke.test(a))return{[ve.Principal]:a};qe(e,n)&&r(`Authenticated context has no resolvable namespace principal; ${ve.Principal} will not be bound and RLS will deny`)}}const Me="featureFlag",Ye="feature-flags:model",ze="feature-flags:auth",Ve="feature-flags:block",We="feature-flags:render-if",He="feature-flags:hide-on";function Xe(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const n=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===n.length)return t;const[r,...i]=n;return[r,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function Je(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function Ze(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return Je(e);const t={};return Object.entries(e).forEach(([e,n])=>{const r=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[n,...r]=t;return[n.toLowerCase(),...r.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==n&&(t[r]=Ze(n)??n)}),t}function Qe(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,n])=>{const r=Xe(t),i=Ze(n);return void 0!==i&&(e[r]=i),e},{})}function et(e){return!0===e||!!e&&"object"==typeof e}function tt(e,t){return et(e?.[Xe(t)])}function nt(e,t="any"){return{features:[...new Set(e.map(Xe).filter(Boolean))],match:t}}function rt(e,t){if(!e||0===e.features.length)return!0;const n=e.features.filter(e=>tt(t,e));return"all"===e.match?n.length===e.features.length:n.length>0}function it(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>tt(t,e))}function at(e,t){return s.Metadata.get(e,t)}function ot(e){return e.trim().toLowerCase()}function st(e){return e.trim()}const dt=n.LoggedEnvironment.accumulate({[Me]:{}});async function ct(e=dt){return Qe(e.featureFlag)}async function pt(e,t=dt){return(await ct(t))[Xe(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([s.description("Persisted feature flag definition used for runtime evaluation"),i.table("feature_flags"),a.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([s.description("Persisted feature flag access rule for a subject"),i.table("feature_flag_access"),a.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class _t{async readOne(e,t){return(await this.read(t))[Xe(e)]}}class lt extends _t{async read(e={}){return ct(e.source??{[Me]:{}})}}var ut;function gt(e){const t=Xe(e);return t?t.charAt(0).toUpperCase()+t.slice(1):t}function yt(e,t){const n=gt(e);return void 0===t?"engine"+n:`engine${n}${gt(t)}`}function mt(e){const t={};for(const n of e.engines??[]){t[yt(n.engineId)]=!0;for(const e of n.capabilities??[])t[yt(n.engineId,e.feature)]="SUPPORTED"===e.verdict}return t}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new lt,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new lt;const n={...t.readerConfig??{},source:t.readerConfig?.source??dt};return this.cachedRegistry=await this.refreshCachedRegistry(n,...e),{config:{...t,reader:this.reader,readerConfig:n},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,n])=>(e[t]=n&&"object"==typeof n&&!Array.isArray(n)?{...n}:n,e),{})}async refreshCachedRegistry(e={},...t){const n=await this.reader.read({...e,source:e.source??dt});let r=[];try{r=await this.repo.select().execute(...t)}catch{r=[]}const i=this.cloneRegistry(n);for(const e of r)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:Xe(e.featureKey),subjectType:ot(e.subjectType),subjectKey:st(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(ot(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(st(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(Xe)))),t}async create(e,...t){e.key=Xe(e.key),e.enabled??=!0;const n=await super.create(e,...t);return this.setCachedFlag(n),n}async update(e,...t){e.key=Xe(e.key),e.enabled??=!0;const n=await super.update(e,...t);return this.setCachedFlag(n),n}async findOneBy(e,t,...n){const r="key"===e&&"string"==typeof t?Xe(t):t;return this.repo.findOneBy(e,r,...n)}async readAll(e,...t){const n=await this.repo.readAll(e,...t);for(const e of n)this.setCachedFlag(e);return n}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...n){const r=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(r,...n).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,r),...n):this.getAccessRepository().create(new e.FeatureFlagAccess(r),...n)}async revokeFeatureAccess(e,...t){const n=await this.findFeatureAccess(e,...t).catch(()=>{});if(n)return this.getAccessRepository().delete(n.id,...t)}async findFeatureAccess(e,...t){const n=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(n).execute(...t))[0];if(!i)throw new r.NotFoundError(`Feature access for ${ot(e.subjectType)}:${st(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const n=await this.listFeatureAccess({...e,enabled:!0},...t),r=[...new Set(n.map(e=>e.featureKey))];if(0===r.length)return{};const a=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(r.map(Xe)));return(await this.repo.select().where(a).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...n){return tt(await this.resolveFeatureFlagsForSubject(t,...n),e)}isEnabled(e){this.assertInitialized();const t=Xe(e);return tt(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...n){this.assertInitialized();const r=await this.reader.read({...t,source:t.source??dt}),i=[];for(const[t,a]of Object.entries(r)){const r=a&&"object"==typeof a&&!Array.isArray(a)?a:{enabled:!!a},{enabled:o,...s}=r,d=Xe(t),c=await this.findOneBy("key",d,...n).catch(()=>{}),p=c?Object.assign(c,{enabled:et(a),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:et(a)}}):new e.FeatureFlag({key:d,enabled:et(a),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:et(a)}});i.push(c?await this.update(p,...n):await this.create(p,...n))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??dt},...n),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService);class ht extends _t{constructor(e){super(),this.registry=e}async read(e){return{...this.registry}}}function St(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function ft(e,t,n="any"){const r=nt(t,n);return(t,n,i)=>{if(void 0===n)return s.metadata(e,r)(t);const a=St(e,n);return i?s.methodMetadata(a,r)(t,n,i):s.propMetadata(a,r)(t,n)}}function At(e,t,n){return at(e,St(t,n))}e.EngineCapabilityFeatureFlagService=ut=class extends e.FeatureFlagService{constructor(){const e=super();if(!(this instanceof ut))return Object.assign(Object.create(ut.prototype),e,{capabilityRegistry:{}});this.capabilityRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.capabilityRegistry=mt(t.manifest??{engines:[]});const n=new ht(this.capabilityRegistry);return{config:{...t,reader:n,readerConfig:{...t.readerConfig??{},source:{}}},client:n}}isEngineEnabled(e){return tt(this.capabilityRegistry,yt(e))}isEngineFeatureEnabled(e,t){return tt(this.capabilityRegistry,yt(e,t))}isEnabled(e){return tt(this.capabilityRegistry,e)}async resolveFeatureFlags(){return{...this.capabilityRegistry}}async resolveFeatureFlagsForSubject(e,...t){return{...this.capabilityRegistry}}async isEnabledForSubject(e,t,...n){return tt(this.capabilityRegistry,e)}async listEnabled(...t){return Object.entries(this.capabilityRegistry).filter(([,e])=>et(e)).map(([t])=>new e.FeatureFlag({key:t,enabled:!0,config:{enabled:!0}}))}async syncFromEnvironment(...e){throw new r.InternalError("Engine capability feature flags are derived from the served engine manifest and are never synced from the environment")}},e.EngineCapabilityFeatureFlagService=ut=o.__decorate([i.service(),o.__metadata("design:paramtypes",[])],e.EngineCapabilityFeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=G,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...n){const r=t.at??new Date;if(t.scopeKind&&t.scopeId)return D(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(D(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt)).length>0)return!0;const a=i.visibility;return a!==e.ResourceVisibility.Private&&a!==e.ResourceVisibility.ResourceAcl&&(a===e.ResourceVisibility.OrgUnit||a===e.ResourceVisibility.OrgSubtree?D(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt)):a===e.ResourceVisibility.Tenant&&D(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt)))}async requireAccess(t,...n){if(!await this.canAccess(t,...n))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(r=t.scopeKind??e.ScopeKind.Resource,a=t.scopeId??"",`${r}:${a}`)}`);var r,a}async buildAccessContext(e,t,...n){return B({tenantId:e,principalId:t,permissions:D(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:D(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,n,...r){const i=await this.buildAccessContext(e,t,...r),a=i.allowedOrgUnitIdsByPermission[n]??[],o=i.resourceGrants.filter(e=>e.permissionKey===n).map(e=>e.resourceId);return F({tenantId:e,principalId:t,permissionKey:n,allowedOrgUnitIds:a,allowedResourceIds:o})}async buildQdrantFilter(e,t,n,...r){const i=await this.buildAccessContext(e,t,...r);return P({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[n]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===n).map(e=>e.resourceId)})}},e.BaseModelService=K,e.BootstrapService=ce,e.COMMIT="91b0244",e.CredentialProviderOptions=T,e.CredentialService=class extends K{constructor(t={}){super(e.Credential),this.secretServiceInstance=t.secretService,t.repository&&(this._repository=t.repository)}async secretService(){let e=this.secretServiceInstance;if(!e){const t=new Ee;await t.boot(),this.secretServiceInstance=t,e=t}if("model"!==e.provider)throw new r.ValidationError("CredentialService stores user/runtime credentials in the model-backed secret service");return e}async createCredential(t,...n){const{log:i,ctxArgs:a}=(await this.logCtx(n,"createCredential",!0)).for(this.createCredential),o=t.name?.trim();if(!o||o.length>255||!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(o))throw new r.ValidationError("Invalid credential name: "+JSON.stringify(t.name));i.verbose("Creating credential "+o);const s=await this.secretService(),c=he("credential-"+d.randomUUID()),p=await s.store(c,t.secret,{tenantId:t.tenantId,orgUnitId:t.orgUnitId,ownerPrincipalId:t.ownerPrincipalId},...a);try{return await this.create({tenant:t.tenantId,orgUnit:t.orgUnitId,owner:t.ownerPrincipalId,name:o,credentialType:t.credentialType,secretName:p.name,provider:e.CredentialProvider.Model,description:t.description,metadata:t.metadata,expiresAt:t.expiresAt,enabled:!0},...a)}catch(e){throw await s.delete(c,{force:!0},...a).catch(()=>{}),e}}async rotateCredential(e,...t){const{log:n,ctxArgs:r}=(await this.logCtx(t,"rotateCredential",!0)).for(this.rotateCredential);n.verbose("Rotating credential "+e.credentialId);const i=await this.repo.read(e.credentialId,...r),a=await this.secretService();return a.rotate?await a.rotate(i.secretName,e.secret,{newVersion:e.version},...r):await a.store(i.secretName,e.secret,{version:e.version,tenantId:q(i.tenant),orgUnitId:i.orgUnit?q(i.orgUnit):void 0,ownerPrincipalId:i.owner?q(i.owner):void 0},...r),i.updatedAt=new Date,this.repo.update(i,...r)}async getCredential(e,...t){const{log:n,ctx:r,ctxArgs:i}=(await this.logCtx(t,"getCredential",!0)).for(this.getCredential);return n.verbose("Reading credential "+e),this.withinTransaction(r,()=>this.repo.read(e,...i))}async listCredentials(...e){const{log:t,ctxArgs:n}=(await this.logCtx(e,"listCredentials",!0)).for(this.listCredentials);return t.verbose("Listing credentials"),(await this.repo.select().execute(...n)).map(e=>this.toSummary(e))}async markCredentialUsed(e,...t){const{log:n,ctx:r,ctxArgs:i}=(await this.logCtx(t,"markCredentialUsed",!0)).for(this.markCredentialUsed);return n.verbose(`Marking credential ${e} as used`),this.withinTransaction(r,async()=>{const t=await this.repo.read(e,...i);return t.lastUsedAt=new Date,this.repo.update(t,...i)})}async deleteCredential(e,...t){const{log:n,ctxArgs:r}=(await this.logCtx(t,"deleteCredential",!0)).for(this.deleteCredential);n.verbose("Deleting credential "+e);const i=await this.repo.read(e,...r);await this.repo.delete(e,...r);const a=await this.secretService();await a.delete(i.secretName,{force:!0},...r)}async withinTransaction(e,t){const n=this.repo?.adapter;if(!n||"function"!=typeof n.transactionLock)return t();const a=e??await this.context("credentialTransaction",{}),o=a.getOrUndefined("transactionLock"),s=o??i.resolveTransactionLock(this.repo);let d;s.depth++,o||(await s.begin(a),a.cache.put("transactionLock",s));try{d=await t()}catch(e){const t=0===s.depth;if(s.depth=0,!t)try{await s.rollback(e,a)}catch(e){}throw e}if(s.depth--,0===s.depth)try{await s.commit(a)}catch(e){throw new r.InternalError("Failed to commit transaction: "+e)}return d}toSummary(e){return{id:e.id,tenantId:q(e.tenant),orgUnitId:e.orgUnit?q(e.orgUnit):void 0,ownerPrincipalId:e.owner?q(e.owner):void 0,name:e.name,credentialType:e.credentialType,provider:e.provider,description:e.description,enabled:e.enabled,metadata:e.metadata,expiresAt:e.expiresAt,lastUsedAt:e.lastUsedAt,createdAt:e.createdAt,updatedAt:e.updatedAt}}},e.EffectivePermissionService=oe,e.EnvironmeFlagReader=lt,e.FEATURE_FLAG_AUTH_KEY=ze,e.FEATURE_FLAG_BLOCK_KEY=Ve,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=Me,e.FEATURE_FLAG_HIDE_KEY=He,e.FEATURE_FLAG_MODEL_KEY=Ye,e.FEATURE_FLAG_RENDER_KEY=We,e.FULL_VERSION="0.13.0-91b0244",e.FeatureFlagEnvironment=dt,e.FeatureFlagReader=_t,e.GroupMembershipService=te,e.GroupService=class extends K{constructor(){super(e.Group)}async createGroup(e,t,n,r,...i){return this.create({tenant:e,orgUnit:n,name:t,metadata:r},...i)}async renameGroup(e,t,...n){return this.updateOne(e,{name:t},...n)}async moveGroupToOrgUnit(e,t,...n){return this.updateOne(e,{orgUnit:t},...n)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}},e.InheritanceBlockService=V,e.IsolationTierOptions=f,e.MembershipStatusOptions=A,e.NAMESPACE_RLS_POLICY_SETS=Fe,e.OrgUnitClosureService=z,e.OrgUnitMembershipService=ee,e.OrgUnitProfileService=Y,e.OrgUnitService=X,e.PACKAGE_NAME="@decaf-ts/integrations",e.PRINCIPAL_UUID_PATTERN=Ke,e.PermissionCategoryOptions=b,e.PermissionService=ne,e.PrincipalKindOptions=E,e.PrincipalService=Z,e.ProtectedResourceService=se,e.REL_CASCADE_DEPENDENT=U,e.REL_CASCADE_INSERT_UPDATE=N,e.REL_NULLIFY=C,e.REL_RESTRICT=I,e.RLS_FUNCTION_OWNER_QUERY=be,e.RLS_FUNCTION_STATEMENTS=we,e.RLS_PERMISSION_KEYS={Read:"namespace.read",Write:"namespace.write",Admin:"namespace.admin"},e.RLS_PROTECTED_TABLES=Re,e.RLS_ROLE_KEYS={Reader:"namespace-reader",Writer:"namespace-writer",Admin:"namespace-admin"},e.RLS_SETTINGS=ve,e.ResourceGrantService=de,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new de).deleteAllForResource(e,...t),await(new se).deleteById(e,...t)}async resolveResourceScope(e,...t){const n=await(new se).getById(e,...t);return{tenantId:q(n.tenant),orgUnitId:q(n.orgUnit),visibility:n.visibility,ownerPrincipalId:n.owner?q(n.owner):void 0}}},e.ResourceVisibilityOptions=R,e.RlsBootstrapService=Be,e.RlsFunctionOwnerError=je,e.RoleAssignmentService=ae,e.RolePermissionService=ie,e.RoleService=re,e.ScopeKindOptions=v,e.StorageBindingKindOptions=w,e.StorageBindingService=class extends K{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...n){return(await this.listTenantBindings(e,...n)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...n){return this.updateOne(e,{config:t},...n)}async promoteToDedicated(t,n,r,i,...a){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:n,region:r,config:i},...a)}async setShared(t,n,r,i,...a){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:n,region:r,config:i},...a)}},e.StorageKindOptions=O,e.SystemManagementService=pe,e.TenantMembershipService=Q,e.TenantProfileService=M,e.TenantService=W,e.UserService=J,e.VERSION="0.13.0",e.asArray=D,e.assertPrincipalId=xe,e.assertRlsTableCoverage=(e=Fe)=>{const t=new Set(De(e)),n=Re.filter(e=>!t.has(e));if(n.length)throw new r.InternalError("RLS template is missing tables: "+n.join(", "))},e.blockFeatureOperations=(...e)=>ft(Ve,e),e.buildAccessContext=B,e.buildArangoContext=F,e.buildQdrantFilter=P,e.engineCapabilityFlagKey=yt,e.engineCapabilityFlagRegistry=mt,e.execWithLogging=async(e,i,a,o=n.LogLevel.info)=>(a.debug("Executing: "+e),new Promise((n,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),a[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),a.debug(e.trim())}),d.on("close",e=>{0===e?(a.silly("Command completed successfully"),n({stdout:c.join("\n"),stderr:p.join("\n")})):(a.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new r.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{a.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>ft(ze,e),e.featureFlags=(...e)=>ft(Ye,e),e.getFeatureGateMetadata=At,e.hasFeatureFlagInEnvironment=async(e,t=dt)=>!!await pt(e,t),e.hideOnFeature=(...e)=>ft(He,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=et,e.isFeatureFlagEnabledByName=tt,e.isFeatureRuleBlocked=it,e.isFeatureRuleSatisfied=rt,e.isTimeValid=x,e.loadFeatureFlagsFromEnvironment=ct,e.lowerSlug=$,e.namespaceRlsSessionBinding=Ge,e.namespaceRlsTypeORMOptions=(e={})=>({sessionBinding:Ge(e)}),e.normalizeFeatureConfig=Ze,e.normalizeFeatureName=Xe,e.normalizeFeatureRegistry=Qe,e.normalizeFeatureRule=nt,e.normalizeFeatureSubjectKey=st,e.normalizeFeatureSubjectType=ot,e.nowIso=()=>new Date,e.parseRuntimeValue=Je,e.readMetadata=at,e.relationId=q,e.relationMatch=j,e.renderIfFeature=(...e)=>ft(We,e),e.resolveFeatureFlagFromEnvironment=pt,e.resolvePrincipalForSubject=async(e,t,n)=>{if(!e||"function"!=typeof e.query)throw new r.ValidationError("resolvePrincipalForSubject requires a privileged auth-prime/service-role client, not the application session");const i="string"==typeof t?t.trim():"";if(!i)return;if(null!=n&&("string"!=typeof n||!Ke.test(n)))throw new r.ValidationError("resolvePrincipalForSubject tenantId must be a UUID when provided");const a=await e.query("SELECT app_rls_principal_for_subject($1, $2) AS principal_id",[i,n??null]),o=Array.isArray(a)?a:a?.rows,s=Array.isArray(o)?o[0]?.principal_id:void 0;if("string"!=typeof s)return;const d=s.trim();return Ke.test(d)?d:void 0},e.rlsBootstrapStatements=Le,e.rlsPolicyStatements=Pe,e.rlsPolicyTables=De,e.runAsPrincipal=async(e,t,n,r={})=>{xe(t),await e.query("BEGIN");try{await e.query("SELECT set_config($1, $2, true)",[ve.Principal,t]);const i=await n(e);return await e.query(r.commit?"COMMIT":"ROLLBACK"),i}catch(t){try{await e.query("ROLLBACK")}catch{}throw t}},e.sameTenant=k,e.shouldExposeForFeatures=(e,t,n,r)=>rt(At(e,n,r),t),e.shouldHideForFeatures=(e,t,n,r)=>it(At(e,n,r),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration"),require("node:crypto"),require("@decaf-ts/crypto/integration/services/crypto")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration","node:crypto","@decaf-ts/crypto/integration/services/crypto"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration,e.node_crypto,e.crypto$1);
+var e,t;e=this,t=function(e,t,n,r,i,a,o,s,d,c){"use strict";var p,_,l,u,g,y,m,h,S;e.IsolationTier=void 0,(p=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",p.Bridge="bridge",p.Silo="silo",e.MembershipStatus=void 0,(_=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",_.Active="active",_.Suspended="suspended",_.Removed="removed",e.PrincipalKind=void 0,(l=e.PrincipalKind||(e.PrincipalKind={})).User="user",l.Group="group",l.ServiceAccount="service_account",l.Agent="agent",l.ApiKey="api_key",e.ScopeKind=void 0,(u=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",u.OrgUnit="org_unit",u.Resource="resource",e.PermissionCategory=void 0,(g=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",g.ContentRead="content_read",g.ContentWrite="content_write",g.Memory="memory",g.Graph="graph",g.Vector="vector",g.Export="export",g.Billing="billing",g.Audit="audit",g.Security="security",g.Data="data",g.Automation="automation",e.ResourceVisibility=void 0,(y=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",y.ResourceAcl="resource_acl",y.OrgUnit="org_unit",y.OrgSubtree="org_subtree",y.Tenant="tenant",e.StorageKind=void 0,(m=e.StorageKind||(e.StorageKind={})).Postgres="postgres",m.Arango="arango",m.Qdrant="qdrant",m.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(h=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",h.Dedicated="dedicated",e.CredentialProvider=void 0,(S=e.CredentialProvider||(e.CredentialProvider={})).Model="model",S.Filesystem="filesystem";const f=Object.values(e.IsolationTier),A=Object.values(e.MembershipStatus),E=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),R=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),w=Object.values(e.StorageBindingKind),T=Object.values(e.CredentialProvider),I={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},C={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},U={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},N={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function F(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function P(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function L(e,t){return`${e}:${t}`}function D(e){return e??[]}function k(e,t){return q(e)===t}function j(e,t){return!!t&&q(e)===t}function $(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function x(e,t,n){const r=e??new Date;return!(t&&t>r||n&&r>n)}function B(t){const n={},r={};for(const i of t.permissions){const t=L(i.scopeKind,i.scopeId);n[t]=n[t]??[],n[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(r[i.permissionKey]=r[i.permissionKey]??[],r[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:n,allowedOrgUnitIdsByPermission:r,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class K extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...n){const r=await this.repo.read(e,...n);return this.repo.update(Object.assign(r,t),...n)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...n){return this.repo.findOneBy(e,t,...n)}async findManyBy(e,t,...n){return this.repo.select().where({[e]:t}).execute(...n)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class G extends a.Model{constructor(e){super(e)}}e.TenantMembership=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_tenant_memberships_tenant"),a.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,U,!1,void 0,"fk_tenant_memberships_user"),a.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([a.required(),a.type(String),a.option(A),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([s.description("Membership linking a user to a tenant"),i.table("tenant_memberships"),a.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),a.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),a.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,I,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,I,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([s.description("User identity within the authorization namespace"),i.table("users"),a.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_org_memberships_tenant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_memberships_org_unit"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,I,!1,void 0,"fk_org_memberships_user"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([a.required(),a.type(String),a.option(A),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([s.description("Membership linking a user to an organizational unit"),i.table("org_unit_memberships"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_org_closure_tenant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_closure_ancestor"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_closure_descendant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([a.required(),a.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([s.description("Ancestor/descendant closure entry for the organizational hierarchy"),i.table("org_unit_closure"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([a.required(),a.type(String),a.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,I,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([s.description("Named authorization permission with a category"),i.table("permissions"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,U,!1,void 0,"fk_role_permissions_role"),a.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,U,!1,void 0,"fk_role_permissions_permission"),a.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([s.description("Link between a role and a permission"),i.table("role_permissions"),a.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,C,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,I,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,I,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([s.description("Named role grouping permissions"),i.table("roles"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_role_assignments_tenant"),a.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_role_assignments_principal"),a.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,I,!1,void 0,"fk_role_assignments_role"),a.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([a.required(),a.type(String),a.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([a.required(),a.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([s.description("Role assigned to a principal within a scope"),i.table("role_assignments"),a.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_resource_grants_tenant"),a.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,U,!1,void 0,"fk_resource_grants_resource"),a.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_resource_grants_principal"),a.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,I,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([s.description("Permission grant on a protected resource for a principal"),i.table("resource_grants"),a.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_principals_tenant"),a.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),a.option(E),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,I,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,I,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([s.description("Authorization subject representing a user, group, service account, agent, or API key"),i.table("principals"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_protected_resources_tenant"),a.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,I,!1,void 0,"fk_protected_resources_org_unit"),a.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([a.required(),a.type(String),a.option(R),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,C,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,I,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([s.description("Resource registered for authorization and visibility decisions"),i.table("protected_resources"),a.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_inheritance_blocks_tenant"),a.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_inheritance_blocks_org_unit"),a.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,C,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([a.required(),a.type(String),a.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([s.description("Block preventing permission inheritance from an ancestor organizational unit"),i.table("inheritance_blocks"),a.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_org_units_tenant"),a.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,I,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,I,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([s.description("Organizational unit node in a tenant hierarchy (department, project, or team)"),i.table("org_units"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_storage_bindings_tenant"),a.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),a.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([a.required(),a.type(String),a.option(w),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([s.description("Storage backend binding configured for a tenant"),i.table("storage_bindings"),a.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),a.option(f),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,I,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([s.description("Top-level tenant (organization) namespace"),i.table("tenants"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_tenant_profiles_tenant"),a.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([s.description("Profile metadata attached to a tenant"),i.table("tenant_profiles"),a.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,U,!1,void 0,"fk_org_unit_profiles_org_unit"),a.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([s.description("Profile metadata attached to an organizational unit"),i.table("org_unit_profiles"),a.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_group_memberships_tenant"),a.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,U,!1,void 0,"fk_group_memberships_group"),a.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_group_memberships_principal"),a.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([s.description("Membership linking a principal to a group"),i.table("group_memberships"),a.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_groups_tenant"),a.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,C,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,I,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([s.description("Named group of principals within a tenant and organizational unit"),i.table("groups"),a.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends G{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,U,!1,void 0,"fk_effective_permissions_tenant"),a.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,U,!1,void 0,"fk_effective_permissions_principal"),a.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([a.required(),a.type(String),a.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([s.description("Materialized effective permission granted to a principal within a scope"),i.table("effective_permissions"),a.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission),e.Credential=class extends G{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Credential.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,I,!1,void 0,"fk_credentials_tenant"),a.required(),o.__metadata("design:type",Object)],e.Credential.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,C,!1,void 0,"fk_credentials_org_unit"),o.__metadata("design:type",Object)],e.Credential.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.Principal,C,!1,void 0,"fk_credentials_owner"),o.__metadata("design:type",Object)],e.Credential.prototype,"owner",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"credentialType",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"secretName",void 0),o.__decorate([a.required(),a.type(String),a.option(T),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"provider",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],e.Credential.prototype,"description",void 0),o.__decorate([a.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.Credential.prototype,"enabled",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],e.Credential.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.Credential.prototype,"expiresAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.Credential.prototype,"lastUsedAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Credential.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Credential.prototype,"updatedAt",void 0),e.Credential=o.__decorate([i.table("credentials"),a.model(),s.description("Namespaced credential metadata record referencing an encrypted secret value"),o.__metadata("design:paramtypes",[Object])],e.Credential);class M extends K{constructor(){super(e.TenantProfile)}async createProfile(e,t,n,...r){return this.create({tenant:e,profileKey:t,metadata:n},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async deleteForTenant(e,...t){for(const n of await this.listForTenant(e,...t))await this.deleteById(n.id,...t)}}class Y extends K{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,n,...r){return this.create({orgUnit:e,profileKey:t,metadata:n},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>j(t.orgUnit,e))}}class z extends K{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,n,...r){return(await this.listAncestors(e,n,...r)).some(e=>j(e.ancestor,t))}async createSelfLink(e,t,...n){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...n)}async insertAncestorLinksForNewChild(e,t,n,...r){const i=await this.listAncestors(e,t,...r);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:n,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...n){const r=await this.listDescendants(e,t,...n),i=new Set([t,...r.map(e=>q(e.descendant))]),a=new Set([t,...r.map(e=>q(e.ancestor))]),o=(await this.listAll(...n)).filter(t=>k(t.tenant,e)&&(i.has(q(t.descendant))||a.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...n)}}class V extends K{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,n,r,i,...a){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:n,reason:i},...a)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.orgUnit,t))}async categoryBlockedForAncestor(e,t,n,r,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||j(e.blockedFromAncestor,n)))}}class W extends K{constructor(){super(e.Tenant)}async createTenant(t,...n){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...n)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...n){return this.updateOne(e,{name:t},...n)}async changeSlug(e,t,...n){return this.updateOne(e,{slug:t},...n)}async setIsolationTier(e,t,...n){return this.updateOne(e,{isolationTier:t},...n)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function H(e,t,...n){for(const r of t)await e.deleteById(r.id,...n)}class X extends K{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const n=$(t);return e?`${e.replace(/\/+$/,"")}/${n}`:"/"+n}async createProfileIfNeeded(e,t,n,...r){t&&await(new Y).createProfile(e,t,n,...r)}async createRoot(e,t,n,r,i,...a){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:n},...a);return await this.createProfileIfNeeded(o.id,r,i,...a),await(new z).createSelfLink(e,o.id,...a),o}async createChild(e,...t){const n=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:n?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(n?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const i=new z;return await i.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>j(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async listDescendantOrgUnits(e,t,n=!1,...r){const i=await(new z).listDescendants(e,t,...r),a=new Set(i.map(e=>q(e.descendant)));return n&&a.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>a.has(e.id))}async listAncestorOrgUnits(e,t,n=!1,...r){const i=await(new z).listAncestors(e,t,...r),a=new Set(i.map(e=>q(e.ancestor)));return n&&a.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>a.has(e.id))}async renameOrgUnit(e,t,...n){const r=await this.getById(e,...n);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...n)}async moveOrgUnit(e,t,n,...r){const i=await this.getById(n,...r),a=await this.getById(t,...r),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,a.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const n=new z,r=await n.listAll(...t);await H(n,r.filter(t=>k(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of i)await n.createSelfLink(e,r.id,...t),r.parent&&await n.insertAncestorLinksForNewChild(e,q(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...n){const r=new z,i=await this.listDescendantOrgUnits(e,t,!0,...n),a=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...n)).filter(e=>a.has(e.id));await H(this,o,...n),await r.deleteLinksForSubtree(e,t,...n)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],X.prototype,"deleteOrgUnitTree",null);class J extends K{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...n){return this.updateOne(e,{displayName:t},...n)}async updateEmail(e,t,...n){return this.updateOne(e,{email:t},...n)}async updatePhone(e,t,...n){return this.updateOne(e,{phone:t},...n)}}class Z extends K{constructor(){super(e.Principal)}async createPrincipal(e,t,n,...r){return this.create({tenant:e,kind:t,subjectId:n},...r)}async getForSubject(e,t,n,...r){return(await this.listAll(...r)).find(r=>k(r.tenant,e)&&r.kind===t&&r.subjectId===n)}async getOrCreateForSubject(e,t,n,...r){return await this.getForSubject(e,t,n,...r)??await this.createPrincipal(e,t,n,...r)}async getUserPrincipal(t,n,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.User,n,...r)}async getGroupPrincipal(t,n,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,n,...r)}}class Q extends K{constructor(){super(e.TenantMembership)}async addUserToTenant(t,n,r=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:n,status:r},...i)}async setStatus(e,t,...n){return this.updateOne(e,{status:t},...n)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>j(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class ee extends K{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,n,r,i=e.MembershipStatus.Active,...a){return this.create({tenant:t,orgUnit:n,user:r,status:i},...a)}async setStatus(e,t,...n){return this.updateOne(e,{status:t},...n)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>j(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>j(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class te extends K{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,n,r,...i){return this.create({tenant:e,group:t,principal:n,metadata:r},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>j(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>j(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const n=new Z,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=q(e.tenant),i=q(e.group);return(await n.getGroupPrincipal(r,i,...t)).id}))}}class ne extends K{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...n){return this.updateOne(e,{description:t},...n)}}class re extends K{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const n=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!n)throw Error(`Role "${e}" not found`);return n}async getTenantRoleByKey(e,t,...n){const r=(await this.listAll(...n)).find(n=>k(n.tenant,e)&&n.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...n){return this.updateOne(e,{name:t},...n)}async updateRoleMetadata(e,t,...n){return this.updateOne(e,{metadata:t},...n)}async listTenantRoles(e,t=!1,...n){return(await this.listAll(...n)).filter(n=>t&&!n.tenant||k(n.tenant,e))}}class ie extends K{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...n){return this.create({role:e,permission:t},...n)}async addPermissionKeyToRole(e,t,...n){const r=await(new ne).getByKey(t,...n);return this.addPermissionToRole(e,r.id,...n)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>j(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>j(t.permission,e))}async replaceRolePermissions(e,t,...n){const r=await this.listRolePermissions(e,...n);return await(async(e,t,...n)=>{for(const r of t)await e.deleteById(r.id,...n)})(this,r,...n),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...n)))}async createRoleWithPermissions(e,t,...n){const r=await(new re).createRole(e,...n);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...n);return r}}class ae extends K{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>j(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}async updateAssignmentWindow(e,t,n,...r){return this.updateOne(e,{startsAt:t,expiresAt:n},...r)}}class oe extends K{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.principal,t))}async listForScope(e,t,n,...r){return(await this.listAll(...r)).filter(r=>k(r.tenant,e)&&r.scopeKind===t&&r.scopeId===n)}async hasPermission(e,t,n,r,i,a,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==n||e.scopeKind!==r||e.scopeId!==i||e.startsAt&&a&&e.startsAt>a||e.expiresAt&&a&&e.expiresAt<a))}async deleteForPrincipal(e,t,...n){for(const r of await this.listForPrincipal(e,t,...n))await this.deleteById(r.id,...n)}async deleteForTenant(e,...t){for(const n of(await this.listAll(...t)).filter(t=>k(t.tenant,e)))await this.deleteById(n.id,...t)}async rebuildForPrincipal(t,n,...r){await this.deleteForPrincipal(t,n,...r);const i=new ae,a=new ie,o=new ne,s=new te,d=new Z,c=new z,p=new V,_=[],l=await i.listPrincipalAssignments(t,n,...r),u=await s.listPrincipalGroups(n,...r),g=[...l,...(await Promise.all(u.map(async e=>{const n=await d.getGroupPrincipal(q(e.tenant),q(e.group),...r);return i.listPrincipalAssignments(t,n.id,...r)}))).flat()];for(const i of g){const s=await a.listRolePermissions(q(i.role),...r),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...r)));for(const a of d){if(!a)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...r);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,a.category,...r)||_.push({id:"",tenantId:t,principalId:n,permissionKey:a.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(_.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...r)))}async rebuildForTenant(e,...t){const n=(await(new Z).listAll(...t)).filter(t=>k(t.tenant,e));for(const r of n)await this.rebuildForPrincipal(e,r.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"rebuildForTenant",null);class se extends K{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,n,...r){return(await this.listAll(...r)).find(r=>k(r.tenant,e)&&r.resourceType===t&&r.resourceId===n)}async moveResourceToOrgUnit(e,t,...n){return this.updateOne(e,{orgUnit:t},...n)}async setVisibility(e,t,...n){return this.updateOne(e,{visibility:t},...n)}async transferOwnership(e,t,...n){return this.updateOne(e,{owner:t},...n)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>j(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}}class de extends K{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>j(t.resource,e))}async listPrincipalGrants(e,t,...n){return(await this.listAll(...n)).filter(n=>k(n.tenant,e)&&j(n.principal,t))}async hasGrant(e,t,n,r,i,...a){return(await this.listPrincipalGrants(e,t,...a)).some(e=>j(e.resource,n)&&e.permissionKey===r&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const n of await this.listResourceGrants(e,...t))await this.deleteById(n.id,...t)}}class ce{constructor(){this.tenantService=new W,this.tenantProfileService=new M,this.orgUnitService=new X,this.orgUnitProfileService=new Y,this.userService=new J,this.membershipService=new Q,this.principalService=new Z,this.permissionService=new ne,this.roleService=new re,this.rolePermissionService=new ie,this.roleAssignmentService=new ae,this.effectivePermissionService=new oe}async bootstrapTenantFromTemplate(t,...n){const r=await this.tenantService.createTenant(t.tenant,...n);t.tenant.profileKey&&await this.tenantProfileService.createProfile(r.id,t.tenant.profileKey,t.tenant.profileMetadata,...n);const i=async(e,t)=>{const a=void 0===e?await this.orgUnitService.createRoot(r.id,t.name,t.metadata,t.profileKey,t.metadata,...n):await this.orgUnitService.createChild({tenantId:r.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...n);for(const e of t.children??[])await i(a.id,e);return a},a=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...n);await this.membershipService.addUserToTenant(r.id,o.id,e.MembershipStatus.Active,...n);const s=await this.principalService.getUserPrincipal(r.id,o.id,...n);for(const e of t.permissions)await this.permissionService.createPermission(e,...n);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:r.id,key:e.key,name:e.name,description:e.description},...n);for(const r of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,r,...n)}const d=await this.roleService.getTenantRoleByKey(r.id,t.ownerRoleKey,...n);return await this.roleAssignmentService.assignRole({tenantId:r.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a.id,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(r.id,s.id,...n),{tenantId:r.id,rootOrgUnitId:a.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ce.prototype,"bootstrapTenantFromTemplate",null);class pe{constructor(){this.membershipService=new Q,this.orgMembershipService=new ee,this.principalService=new Z,this.roleService=new re,this.roleAssignmentService=new ae,this.effectivePermissionService=new oe}async onboardUserToTenantAndOrgUnit(t,n,r,i,...a){await this.membershipService.addUserToTenant(t,n,e.MembershipStatus.Active,...a),await this.orgMembershipService.addUserToOrgUnit(t,r,n,e.MembershipStatus.Active,...a);const o=await this.principalService.getUserPrincipal(t,n,...a),s=await this.roleService.getTenantRoleByKey(t,i,...a);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:!0},...a),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...a),{principalId:o.id}}async changeUserOrgRole(t,n,r,i,a,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,n,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===r))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:n,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:a},...o),await this.effectivePermissionService.rebuildForPrincipal(t,n,...o)}async suspendUserInTenant(t,n,r,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(n,r,...i)}async reactivateUserInTenant(t,n,r,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(n,r,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],pe.prototype,"reactivateUserInTenant",null);let _e=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}};o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],_e.prototype,"id",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"name",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"provider",void 0),o.__decorate([a.required(),a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"encryptedPayload",void 0),o.__decorate([a.required(),a.type(Object),i.column(),o.__metadata("design:type",Object)],_e.prototype,"encryption",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"contentType",void 0),o.__decorate([a.type(Object),i.column(),o.__metadata("design:type",Object)],_e.prototype,"tags",void 0),o.__decorate([a.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],_e.prototype,"enabled",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"version",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"externalId",void 0),o.__decorate([a.type(String),i.column(),o.__metadata("design:type",String)],_e.prototype,"uri",void 0),o.__decorate([a.type(String),i.column("tenant_id"),o.__metadata("design:type",String)],_e.prototype,"tenantId",void 0),o.__decorate([a.type(String),i.column("org_unit_id"),o.__metadata("design:type",String)],_e.prototype,"orgUnitId",void 0),o.__decorate([a.type(String),i.column("owner_principal_id"),o.__metadata("design:type",String)],_e.prototype,"ownerPrincipalId",void 0),_e=o.__decorate([i.table("secrets"),a.model(),s.description("Encrypted secret record stored through the model-backed secret service"),o.__metadata("design:paramtypes",[Object])],_e);const le=n.LoggedEnvironment.accumulate({secrets:{provider:""}}).accumulate({secrets:{model:{keySecret:"",keyId:""}}});class ue extends r.InternalError{constructor(e,t,n){super(t),this.secretCode=e,this.name="SecretError",n&&(this.cause=n)}}function ge(e){if("string"==typeof e)return{encoding:"utf8",value:e};if(e instanceof Uint8Array)return{encoding:"base64",value:Buffer.from(e).toString("base64")};if("object"==typeof e&&null!==e)try{return{encoding:"json",value:JSON.stringify(e)}}catch(e){throw new ue("SECRET_SERIALIZATION_FAILED","Failed to serialize payload as JSON: "+e.message,e)}throw new ue("SECRET_INVALID_PAYLOAD","Invalid payload type: "+typeof e)}const ye=/^[a-zA-Z0-9_-]+$/;function me(e){if(!e||"string"!=typeof e)return!1;const t=e.trim();return!(0===t.length||t.length>255||(e=>{for(const t of e){const e=t.charCodeAt(0);if(31>=e||127===e)return!0}return!1})(t)||t.includes("..")||t.includes("   ")||!ye.test(t))}function he(e){if(!me(e))throw new ue("SECRET_INVALID_NAME","Invalid secret name: "+e);return e.trim()}class Se extends i.ClientBasedService{getConfigFromArgs(...e){const t=e[0];if(t&&"object"==typeof t)return t;const n=this.configFromEnvironment();if(n)return n;throw new r.ValidationError("Secret service config must be the first initialize argument, or resolvable from environment")}}function fe(e){return"string"==typeof e&&e.length>0?e:void 0}const Ae="default-key";class Ee extends Se{constructor(){super(),this.provider="model"}configFromEnvironment(){const e=le.secrets.model,t=fe(e?.keySecret);if(t)return{provider:"model",keySecret:t,keyId:fe(e.keyId)}}async initialize(...e){const t=this.getConfigFromArgs(...e),n=e[1]||i.Repository.forModel(_e);return this.cryptoService=new c.CryptoService,await this.cryptoService.boot({}),{config:t,client:n}}async store(e,t,n={},...r){const{log:a,ctxArgs:o}=(await this.logCtx(r,"store",!0)).for(this.store);a.verbose("Storing secret "+e);try{me(e)}catch(e){throw this.parseError(e)}const s=he(e),d=ge(t),c=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret),p=this.cryptoService.extractKeyFromDerivedKey(c),{encryptedData:_,metadata:l}=await this.cryptoService.encryptPayload(JSON.stringify(d),this.config.keyId||Ae,p.key),u=new Date,g=new _e({name:s,provider:this.provider,encryptedPayload:_,encryption:{keyId:l.keyId,iv:l.iv,salt:p.salt},contentType:n.contentType,tags:n.tags,enabled:!0,version:n.version,tenantId:n.tenantId,orgUnitId:n.orgUnitId,ownerPrincipalId:n.ownerPrincipalId}),y=n.version??"";if((await this.client.select().where(i.Condition.attr("name").eq(s)).execute(...o)).some(e=>(e.version??"")===y))throw new ue("SECRET_ALREADY_EXISTS",`Secret ${JSON.stringify(s)}${y?" version "+JSON.stringify(y):""} already exists`);try{await this.client.create(g,...o)}catch(e){throw this.parseError(e)}return{provider:this.provider,name:s,version:n.version,metadata:{createdAt:u.toISOString()}}}async retrieve(e,t={},...n){const{log:a,ctx:o,ctxArgs:s}=(await this.logCtx(n,"retrieve",!0)).for(this.retrieve),d="string"==typeof e?e:e.name;let c,p;a.verbose("Retrieving secret "+d),"string"==typeof e?(c=e,p=t.version):(c=e.name,p=e.version);try{me(c)}catch(e){throw this.parseError(e)}const _=he(c);let l=i.Condition.attr("name").eq(_);p&&(l=l.and(i.Condition.attr("version").eq(p))),l=l.and(i.Condition.attr("enabled").eq(!0));const u=(await this.withinPrincipalTransaction(o,e=>this.client.override({transactionLock:e}).select().where(l).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...s)))[0];if(!u)throw new r.NotFoundError(`Secret "${_}" not found`);const g=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret,u.encryption?.salt);let y,m;try{y=await this.cryptoService.decryptPayload(u.encryptedPayload,this.cryptoService.extractKeyFromDerivedKey(g).key)}catch(e){throw new r.InternalError(`Failed to decrypt secret "${_}": ${e.message}`)}try{m=JSON.parse(y)}catch(e){throw new r.InternalError(`Failed to deserialize secret "${_}": ${e.message}`)}return(e=>{switch(e.encoding){case"utf8":return e.value;case"json":try{return JSON.parse(e.value)}catch(e){throw new ue("SECRET_DESERIALIZATION_FAILED","Failed to deserialize JSON payload: "+e.message,e)}case"base64":return Buffer.from(e.value,"base64");default:throw new ue("SECRET_DESERIALIZATION_FAILED","Unknown encoding: "+e.encoding)}})(m)}async withinPrincipalTransaction(e,t){const n=e.getOrUndefined("transactionLock"),a=n??i.resolveTransactionLock(this.client);let o;a.depth++,n||(await a.begin(e),e.cache.put("transactionLock",a));try{o=await t(a)}catch(t){const n=0===a.depth;if(a.depth=0,!n)try{await a.rollback(t,e)}catch(e){}throw t}if(a.depth--,0===a.depth)try{await a.commit(e)}catch(e){throw new r.InternalError("Failed to commit transaction: "+e)}return o}async delete(e,t={},...n){const{log:r,ctxArgs:a}=(await this.logCtx(n,"delete",!0)).for(this.delete),o="string"==typeof e?e:e.name;let s;r.verbose("Deleting secret "+o),s="string"==typeof e?e:e.name;try{me(s)}catch(e){throw this.parseError(e)}const d=he(s);let c=i.Condition.attr("name").eq(d);const p=t.version;p&&(c=c.and(i.Condition.attr("version").eq(p)));const _=(await this.client.select().where(c).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...a))[0];_&&(t.force?await this.client.delete(_.id,...a):(_.enabled=!1,_.updatedAt=new Date,await this.client.update(_,...a)))}async exists(e,t={},...n){const{log:r,ctxArgs:a}=(await this.logCtx(n,"exists",!0)).for(this.exists),o="string"==typeof e?e:e.name;let s;r.verbose(`Checking if secret ${o} exists`),s="string"==typeof e?e:e.name;try{me(s)}catch(e){throw this.parseError(e)}const d=he(s);let c=i.Condition.attr("name").eq(d);c=c.and(i.Condition.attr("enabled").eq(!0));const p=t.version??("object"==typeof e?e.version:void 0);return p&&(c=c.and(i.Condition.attr("version").eq(p))),await this.client.count().where(c).execute(...a)>0}async list(e={},...t){const{log:n,ctxArgs:r}=(await this.logCtx(t,"list",!0)).for(this.list);n.verbose("Listing secrets");let a=null;return void 0!==e.enabled&&(a=i.Condition.attr("enabled").eq(e.enabled)),(await this.client.select().where(a||i.Condition.attr("name").dif(null)).execute(...r)).map(e=>({provider:e.provider,name:e.name,version:e.version,createdAt:e.createdAt,updatedAt:e.updatedAt,enabled:e.enabled,contentType:e.contentType,tags:e.tags}))}async metadata(e,t={},...n){const{log:r,ctxArgs:a}=(await this.logCtx(n,"metadata",!0)).for(this.metadata),o="string"==typeof e?e:e.name;let s;r.verbose("Getting metadata for secret "+o),s="string"==typeof e?e:e.name;try{me(s)}catch(e){throw this.parseError(e)}const d=he(s);let c=i.Condition.attr("name").eq(d);const p=t.version??("object"==typeof e?e.version:void 0);p&&(c=c.and(i.Condition.attr("version").eq(p)));const _=(await this.client.select().where(c).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...a))[0];if(!_)return;const l={provider:_.provider,name:_.name,version:_.version,createdAt:_.createdAt,updatedAt:_.updatedAt,enabled:_.enabled,contentType:_.contentType};return t.includeTags&&(l.tags=_.tags),l}async rotate(e,t,n={},...a){const{log:o,ctxArgs:s}=(await this.logCtx(a,"rotate",!0)).for(this.rotate),d="string"==typeof e?e:e.name;o.verbose("Rotating secret "+d);const c=he(d);let p=i.Condition.attr("name").eq(c);p=p.and(i.Condition.attr("enabled").eq(!0));const _=n.oldVersion??("object"==typeof e?e.version:void 0);_&&(p=p.and(i.Condition.attr("version").eq(_)));const l=(await this.client.select().where(p).orderBy(["updatedAt",i.OrderDirection.DSC]).execute(...s))[0];if(!l)throw new r.NotFoundError(`Secret "${c}" not found`);const u=n.newVersion??l.version,g=u??"";if(g!==(l.version??"")&&(await this.client.select().where(i.Condition.attr("name").eq(c)).execute(...s)).some(e=>e.id!==l.id&&(e.version??"")===g))throw new ue("SECRET_ALREADY_EXISTS",`Secret ${JSON.stringify(c)}${g?" version "+JSON.stringify(g):""} already exists`);const y=ge(t),m=await this.cryptoService.deriveKeyFromSecret(this.config.keySecret),h=this.cryptoService.extractKeyFromDerivedKey(m),{encryptedData:S,metadata:f}=await this.cryptoService.encryptPayload(JSON.stringify(y),n.keyId||this.config.keyId||Ae,h.key);l.encryptedPayload=S,l.encryption={keyId:f.keyId,iv:f.iv,salt:h.salt},l.version=u,l.updatedAt=new Date;try{await this.client.update(l,...s)}catch(e){throw this.parseError(e)}return{provider:this.provider,name:c,version:l.version}}parseError(e){const t=e,n=t.message||t.name||"Unknown error",r=n.toLowerCase();return r.includes("not found")||r.includes("404")?new ue("SECRET_NOT_FOUND","Secret not found: "+n,t):r.includes("already exists")||r.includes("conflict")||r.includes("409")||r.includes("duplicate key")||r.includes("unique constraint")||"23505"===t.code?new ue("SECRET_ALREADY_EXISTS","Secret already exists: "+n,t):r.includes("decryption")||r.includes("decrypt")?new ue("SECRET_DECRYPTION_FAILED","Decryption failed: "+n,t):new ue("SECRET_PROVIDER_CONFLICT","Provider error: "+n,t)}}const ve={Principal:"app.principal_id",Tenant:"app.tenant_id"},be="SELECT current_user AS rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user",Re=["tenants","org_units","org_unit_closure","users","groups","principals","tenant_memberships","org_unit_memberships","group_memberships","permissions","roles","role_permissions","role_assignments","inheritance_blocks","protected_resources","resource_grants","effective_permissions","storage_bindings","tenant_profiles","org_unit_profiles","credentials","secrets"],Oe="SET search_path = public, pg_temp",we=[`CREATE OR REPLACE FUNCTION app_rls_principal_id()\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nAS $fn$\n  SELECT NULLIF(current_setting('${ve.Principal}', true), '')::uuid\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_subject_id()\nRETURNS text\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT p.subject_id\n  FROM principals p\n  WHERE p.id = app_rls_principal_id()\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_principal_for_subject(\n  p_subject text,\n  p_tenant uuid DEFAULT NULL\n)\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE WHEN COUNT(*) = 1 THEN (MIN(p.id::text))::uuid ELSE NULL END\n  FROM principals p\n  WHERE p.subject_id = NULLIF(p_subject, '')\n    AND (p_tenant IS NULL OR p.tenant_id = p_tenant)\n$fn$;`,"REVOKE ALL ON FUNCTION app_rls_principal_for_subject(text, uuid) FROM PUBLIC;",`CREATE OR REPLACE FUNCTION app_rls_org_unit_tenant(p_org_unit uuid)\nRETURNS uuid\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT ou.tenant_id\n  FROM org_units ou\n  WHERE ou.id = p_org_unit\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_has_permission(\n  p_tenant uuid,\n  p_permission text,\n  p_scope_kind text,\n  p_scope_id text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM effective_permissions ep\n    WHERE ep.tenant_id = p_tenant\n      AND ep.principal_id = app_rls_principal_id()\n      AND ep.permission_key = p_permission\n      AND ep.scope_kind = p_scope_kind\n      AND ep.scope_id = p_scope_id\n      AND (ep.starts_at IS NULL OR ep.starts_at <= now())\n      AND (ep.expires_at IS NULL OR ep.expires_at >= now())\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_tenant_permission(\n  p_tenant uuid,\n  p_permission text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_has_permission(\n    p_tenant,\n    p_permission,\n    'tenant',\n    p_tenant::text\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_org_unit_permission(\n  p_tenant uuid,\n  p_org_unit uuid,\n  p_permission text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_has_permission(\n    p_tenant,\n    p_permission,\n    'tenant',\n    p_tenant::text\n  )\n  OR (\n    p_org_unit IS NOT NULL\n    AND app_rls_has_permission(\n      p_tenant,\n      p_permission,\n      'org_unit',\n      p_org_unit::text\n    )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_tenant_member(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM tenant_memberships tm\n    WHERE tm.tenant_id = p_tenant\n      AND tm.status = 'active'\n      AND tm.user_id::text = app_rls_subject_id()\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_org_unit_member(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM org_unit_memberships m\n    WHERE m.tenant_id = p_tenant\n      AND m.org_unit_id = p_org_unit\n      AND m.status = 'active'\n      AND m.user_id::text = app_rls_subject_id()\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_tenant(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.write')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.read')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_tenant(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n  OR app_rls_tenant_permission(p_tenant, 'namespace.write')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_org_unit(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_can_read_tenant(p_tenant)\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.write')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.read')\n  OR app_rls_is_org_unit_member(p_tenant, p_org_unit)\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_org_unit(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_can_write_tenant(p_tenant)\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  OR app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.write')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_admin()\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM effective_permissions ep\n    WHERE ep.principal_id = app_rls_principal_id()\n      AND ep.permission_key = 'namespace.admin'\n      AND (ep.starts_at IS NULL OR ep.starts_at <= now())\n      AND (ep.expires_at IS NULL OR ep.expires_at >= now())\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_tenant_admin(p_tenant uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_tenant_permission(p_tenant, 'namespace.admin')\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_org_unit_admin(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT app_rls_is_tenant_admin(p_tenant)\n  OR (\n    p_org_unit IS NOT NULL\n    AND app_rls_org_unit_permission(p_tenant, p_org_unit, 'namespace.admin')\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_scope_admin(\n  p_tenant uuid,\n  p_scope_kind text,\n  p_scope_id text\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE\n    WHEN p_scope_kind = 'tenant' THEN app_rls_is_tenant_admin(p_tenant)\n    WHEN p_scope_kind = 'org_unit' THEN app_rls_is_org_unit_admin(\n      p_tenant,\n      p_scope_id::uuid\n    )\n    WHEN p_scope_kind = 'resource' THEN EXISTS (\n      SELECT 1\n      FROM protected_resources r\n      WHERE r.id = p_scope_id::uuid\n        AND r.tenant_id = p_tenant\n        AND app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n    )\n    ELSE false\n  END\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_admin_user(p_user_id uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM tenant_memberships tm\n    WHERE tm.user_id = p_user_id\n      AND app_rls_is_tenant_admin(tm.tenant_id)\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_group(\n  p_tenant uuid,\n  p_group uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM groups g\n    WHERE g.id = p_group\n      AND g.tenant_id = p_tenant\n      AND (\n        (g.org_unit_id IS NULL AND app_rls_can_read_tenant(p_tenant))\n        OR (\n          g.org_unit_id IS NOT NULL\n          AND app_rls_can_read_org_unit(p_tenant, g.org_unit_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_group(\n  p_tenant uuid,\n  p_group uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM groups g\n    WHERE g.id = p_group\n      AND g.tenant_id = p_tenant\n      AND (\n        (g.org_unit_id IS NULL AND app_rls_can_write_tenant(p_tenant))\n        OR (\n          g.org_unit_id IS NOT NULL\n          AND app_rls_can_write_org_unit(p_tenant, g.org_unit_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_resource(\n  p_tenant uuid,\n  p_resource uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM protected_resources r\n    WHERE r.id = p_resource\n      AND r.tenant_id = p_tenant\n      AND (\n        r.owner_principal_id = app_rls_principal_id()\n        OR app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n        OR (\n          r.visibility = 'tenant'\n          AND app_rls_can_read_tenant(p_tenant)\n        )\n        OR (\n          r.visibility IN ('org_unit', 'org_subtree')\n          AND app_rls_can_read_org_unit(p_tenant, r.org_unit_id)\n        )\n        OR EXISTS (\n          SELECT 1\n          FROM resource_grants g\n          WHERE g.resource_id = r.id\n            AND g.principal_id = app_rls_principal_id()\n            AND g.permission_key IN (\n              'resource.read',\n              'namespace.read',\n              'namespace.write',\n              'namespace.admin'\n            )\n            AND (g.starts_at IS NULL OR g.starts_at <= now())\n            AND (g.expires_at IS NULL OR g.expires_at >= now())\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_resource(\n  p_tenant uuid,\n  p_resource uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM protected_resources r\n    WHERE r.id = p_resource\n      AND r.tenant_id = p_tenant\n      AND (\n        app_rls_is_org_unit_admin(p_tenant, r.org_unit_id)\n        OR app_rls_can_write_org_unit(p_tenant, r.org_unit_id)\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_is_role_admin(p_role uuid)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM roles r\n    WHERE r.id = p_role\n      AND (\n        (r.tenant_id IS NULL AND app_rls_is_admin())\n        OR (\n          r.tenant_id IS NOT NULL\n          AND app_rls_is_tenant_admin(r.tenant_id)\n        )\n      )\n  )\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_read_credential_scope(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE\n    WHEN p_org_unit IS NULL THEN app_rls_can_read_tenant(p_tenant)\n    ELSE app_rls_can_read_org_unit(p_tenant, p_org_unit)\n  END\n$fn$;`,`CREATE OR REPLACE FUNCTION app_rls_can_write_credential_scope(\n  p_tenant uuid,\n  p_org_unit uuid\n)\nRETURNS boolean\nLANGUAGE sql\nSTABLE\nSECURITY DEFINER\n${Oe}\nAS $fn$\n  SELECT CASE\n    WHEN p_org_unit IS NULL THEN app_rls_can_write_tenant(p_tenant)\n    ELSE app_rls_can_write_org_unit(p_tenant, p_org_unit)\n  END\n$fn$;`],Te="app_rls_is_admin()",Ie="app_rls_is_tenant_admin(tenant_id)",Ce="app_rls_can_write_org_unit(tenant_id, org_unit_id)",Ue="app_rls_can_read_credential_scope(tenant_id, org_unit_id)",Ne="app_rls_can_write_credential_scope(tenant_id, org_unit_id)",Fe=[{table:"tenants",select:"app_rls_is_tenant_member(id) OR app_rls_can_read_tenant(id)",insert:Te,update:"app_rls_is_tenant_admin(id)",delete:"app_rls_is_tenant_admin(id)"},{table:"org_units",select:"app_rls_can_read_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",insert:"app_rls_can_write_tenant(tenant_id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",update:"app_rls_can_write_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))",delete:"app_rls_can_write_org_unit(tenant_id, id) OR (parent_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, parent_id))"},{table:"org_unit_closure",select:"app_rls_can_read_org_unit(tenant_id, descendant_org_unit_id)",insert:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)",update:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)",delete:"app_rls_can_write_org_unit(tenant_id, descendant_org_unit_id)"},{table:"users",select:"id::text = app_rls_subject_id() OR app_rls_can_admin_user(id)",insert:Te,update:"id::text = app_rls_subject_id() OR app_rls_can_admin_user(id)",delete:"app_rls_can_admin_user(id)"},{table:"groups",select:"app_rls_can_read_group(tenant_id, id)",insert:"app_rls_can_write_tenant(tenant_id) OR (org_unit_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, org_unit_id))",update:"app_rls_can_write_group(tenant_id, id)",delete:"app_rls_can_write_group(tenant_id, id)"},{table:"principals",select:"id = app_rls_principal_id() OR (kind = 'user' AND subject_id = app_rls_subject_id()) OR app_rls_is_tenant_admin(tenant_id)",insert:Ie,update:Ie,delete:Ie},{table:"tenant_memberships",select:"user_id::text = app_rls_subject_id() OR app_rls_can_read_tenant(tenant_id)",insert:Ie,update:Ie,delete:Ie},{table:"org_unit_memberships",select:"user_id::text = app_rls_subject_id() OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.admin') OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.write') OR app_rls_org_unit_permission(tenant_id, org_unit_id, 'namespace.read')",insert:Ce,update:Ce,delete:Ce},{table:"group_memberships",select:"app_rls_can_read_group(tenant_id, group_id)",insert:"app_rls_can_write_group(tenant_id, group_id)",update:"app_rls_can_write_group(tenant_id, group_id)",delete:"app_rls_can_write_group(tenant_id, group_id)"},{table:"permissions",select:Te,insert:Te,update:Te,delete:Te},{table:"roles",select:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",insert:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",update:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())",delete:"(tenant_id IS NOT NULL AND app_rls_is_tenant_admin(tenant_id)) OR (tenant_id IS NULL AND app_rls_is_admin())"},{table:"role_permissions",select:"app_rls_is_role_admin(role_id)",insert:"app_rls_is_role_admin(role_id)",update:"app_rls_is_role_admin(role_id)",delete:"app_rls_is_role_admin(role_id)"},{table:"role_assignments",select:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",insert:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",update:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",delete:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)"},{table:"inheritance_blocks",select:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",insert:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",update:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)",delete:"app_rls_is_org_unit_admin(tenant_id, org_unit_id)"},{table:"protected_resources",select:"app_rls_can_read_resource(tenant_id, id)",insert:"app_rls_can_write_tenant(tenant_id) OR (org_unit_id IS NOT NULL AND app_rls_can_write_org_unit(tenant_id, org_unit_id))",update:"app_rls_can_write_resource(tenant_id, id)",delete:"app_rls_can_write_resource(tenant_id, id)"},{table:"resource_grants",select:"principal_id = app_rls_principal_id() OR app_rls_can_read_resource(tenant_id, resource_id)",insert:"app_rls_can_write_resource(tenant_id, resource_id)",update:"app_rls_can_write_resource(tenant_id, resource_id)",delete:"app_rls_can_write_resource(tenant_id, resource_id)"},{table:"effective_permissions",select:"principal_id = app_rls_principal_id() OR app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",insert:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",update:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)",delete:"app_rls_is_scope_admin(tenant_id, scope_kind, scope_id)"},{table:"storage_bindings",select:Ie,insert:Ie,update:Ie,delete:Ie},{table:"tenant_profiles",select:"app_rls_is_tenant_member(tenant_id) OR app_rls_can_read_tenant(tenant_id)",insert:Ie,update:Ie,delete:Ie},{table:"org_unit_profiles",select:"app_rls_can_read_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",insert:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",update:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)",delete:"app_rls_can_write_org_unit(app_rls_org_unit_tenant(org_unit_id), org_unit_id)"},{table:"credentials",select:"owner_principal_id = app_rls_principal_id() OR "+Ue,insert:Ne,update:Ne,delete:Ne},{table:"secrets",select:"owner_principal_id = app_rls_principal_id() OR "+Ue+" OR (tenant_id IS NULL AND app_rls_is_admin())",insert:Ne+" OR (tenant_id IS NULL AND app_rls_is_admin())",update:Ne+" OR (tenant_id IS NULL AND app_rls_is_admin())",delete:Ne+" OR (tenant_id IS NULL AND app_rls_is_admin())"}];function Pe(e=Fe){const t=[];for(const n of e){!1!==n.enable&&t.push(`ALTER TABLE ${n.table} ENABLE ROW LEVEL SECURITY;`,`ALTER TABLE ${n.table} FORCE ROW LEVEL SECURITY;`);const e=n.table.replace(/[^A-Za-z0-9_]/g,"_"),r=[["select",n.select,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR SELECT USING (${t});`],["insert",n.insert,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR INSERT WITH CHECK (${t});`],["update",n.update,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR UPDATE USING (${t}) WITH CHECK (${t});`],["delete",n.delete,(e,t)=>`CREATE POLICY ${e} ON ${n.table} FOR DELETE USING (${t});`]];for(const[i,a,o]of r){if(!a)continue;const r=`${e}_${i}_policy`;t.push(`DROP POLICY IF EXISTS ${r} ON ${n.table};`,o(r,a))}}return t}function Le(){return[...we,...Pe()]}function De(e=Fe){return e.map(e=>e.table)}const ke=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;class je extends r.InternalError{constructor(e){super(e),this.name="RlsFunctionOwnerError"}}function $e(e,t){if(t&&void 0!==t.local&&!0!==t.local)throw new r.ValidationError(e+" only supports transaction-local binding: session-wide binding is not allowed")}function xe(e){if(!e||!ke.test(e))throw new r.ValidationError("Invalid RLS principal id")}class Be extends i.ClientBasedService{constructor(){super()}async initialize(...e){const t=e[0];if(!t||"function"!=typeof t.query)throw new r.ValidationError("RlsBootstrapService requires a query executor as its first argument");return{config:e[1]??{},client:t}}async apply(...e){const{log:t}=(await this.logCtx(e,"apply",!0)).for(this.apply),n=this.statements();if(!n.length)throw new r.InternalError("No RLS statements to apply");await this.assertFunctionOwnerPrivileges(...e),t.verbose(`Applying ${n.length} RLS statements`);for(const e of n)await this.client.query(e);return t.info(`Applied namespace RLS template (${n.length} statements)`),{applied:n.length}}async assertFunctionOwnerPrivileges(...e){const{log:t}=(await this.logCtx(e,"assertFunctionOwnerPrivileges",!0)).for(this.assertFunctionOwnerPrivileges),n=await this.client.query(be),r=n.rows?.[0]??void 0,i=r?.rolname?JSON.stringify(r.rolname):"current_user";if("boolean"!=typeof r?.rolsuper||"boolean"!=typeof r?.rolbypassrls)throw new je(`Cannot apply the namespace RLS template: could not determine the privileges of ${i}. The SECURITY DEFINER helper functions require a SUPERUSER or BYPASSRLS owner; refusing to apply policies that would recurse under FORCE ROW LEVEL SECURITY.`);if(!r.rolsuper&&!r.rolbypassrls)throw new je(`Cannot apply the namespace RLS template as ${i}: the executor role is neither SUPERUSER nor BYPASSRLS. The SECURITY DEFINER helper functions must be owned by a role that bypasses RLS, otherwise every policy evaluation recurses under FORCE ROW LEVEL SECURITY and fails. Connect as the database owner/BYPASSRLS migration role, or create the helper functions with a dedicated BYPASSRLS owner.`);t.verbose("Verified RLS function owner privileges for "+i)}statements(){const e=this._config??{};return e.statements?[...e.statements]:e.policies?[...we,...Pe(e.policies)]:Le()}async setPrincipal(e,t={},...n){const{log:r}=(await this.logCtx(n,"setPrincipal",!0)).for(this.setPrincipal);xe(e),$e("setPrincipal",t),await this.client.query("SELECT set_config($1, $2, true)",[ve.Principal,e]),r.verbose("Bound RLS principal (transaction-local)")}async setTenant(e,t={},...n){const{log:r}=(await this.logCtx(n,"setTenant",!0)).for(this.setTenant);xe(e),$e("setTenant",t),await this.client.query("SELECT set_config($1, $2, true)",[ve.Tenant,e]),r.verbose("Bound RLS tenant (transaction-local)")}async clearPrincipal(e={},...t){const{log:n}=(await this.logCtx(t,"clearPrincipal",!0)).for(this.clearPrincipal);$e("clearPrincipal",e),await this.client.query("SELECT set_config($1, $2, true)",[ve.Principal,""]),n.verbose("Cleared RLS principal (transaction-local)")}async currentPrincipal(...e){const{log:t}=(await this.logCtx(e,"currentPrincipal",!0)).for(this.currentPrincipal);t.verbose("Reading current RLS principal");const n=await this.client.query("SELECT app_rls_principal_id() AS principal_id");return(n.rows?.[0]??{}).principal_id??null}}const Ke=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function qe(e,t){try{return e.getOrUndefined(t)}catch{return}}function Ge(e={}){const t=e.principalContextKey??"principalId",n=e.authenticatedContextKey??"user",r=e.warn??(e=>{});return e=>{if(!e)return;const i=qe(e,t),a="string"==typeof i?i.trim():"";if(a&&Ke.test(a))return{[ve.Principal]:a};qe(e,n)&&r(`Authenticated context has no resolvable namespace principal; ${ve.Principal} will not be bound and RLS will deny`)}}const Me="featureFlag",Ye="feature-flags:model",ze="feature-flags:auth",Ve="feature-flags:block",We="feature-flags:render-if",He="feature-flags:hide-on";function Xe(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const n=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===n.length)return t;const[r,...i]=n;return[r,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function Je(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function Ze(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return Je(e);const t={};return Object.entries(e).forEach(([e,n])=>{const r=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[n,...r]=t;return[n.toLowerCase(),...r.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==n&&(t[r]=Ze(n)??n)}),t}function Qe(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,n])=>{const r=Xe(t),i=Ze(n);return void 0!==i&&(e[r]=i),e},{})}function et(e){return!0===e||!!e&&"object"==typeof e}function tt(e,t){return et(e?.[Xe(t)])}function nt(e,t="any"){return{features:[...new Set(e.map(Xe).filter(Boolean))],match:t}}function rt(e,t){if(!e||0===e.features.length)return!0;const n=e.features.filter(e=>tt(t,e));return"all"===e.match?n.length===e.features.length:n.length>0}function it(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>tt(t,e))}function at(e,t){return s.Metadata.get(e,t)}function ot(e){return e.trim().toLowerCase()}function st(e){return e.trim()}const dt=n.LoggedEnvironment.accumulate({[Me]:{}});async function ct(e=dt){return Qe(e.featureFlag)}async function pt(e,t=dt){return(await ct(t))[Xe(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([s.description("Persisted feature flag definition used for runtime evaluation"),i.table("feature_flags"),a.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([a.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([s.description("Persisted feature flag access rule for a subject"),i.table("feature_flag_access"),a.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class _t{async readOne(e,t){return(await this.read(t))[Xe(e)]}}class lt extends _t{async read(e={}){return ct(e.source??{[Me]:{}})}}var ut;function gt(e){const t=Xe(e);return t?t.charAt(0).toUpperCase()+t.slice(1):t}function yt(e,t){const n=gt(e);return void 0===t?"engine"+n:`engine${n}${gt(t)}`}function mt(e){const t={};for(const n of e.engines??[]){t[yt(n.engineId)]=!0;for(const e of n.capabilities??[])t[yt(n.engineId,e.feature)]="SUPPORTED"===e.verdict}return t}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new lt,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new lt;const n={...t.readerConfig??{},source:t.readerConfig?.source??dt};return this.cachedRegistry=await this.refreshCachedRegistry(n,...e),{config:{...t,reader:this.reader,readerConfig:n},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,n])=>(e[t]=n&&"object"==typeof n&&!Array.isArray(n)?{...n}:n,e),{})}async refreshCachedRegistry(e={},...t){const n=await this.reader.read({...e,source:e.source??dt});let r=[];try{r=await this.repo.select().execute(...t)}catch{r=[]}const i=this.cloneRegistry(n);for(const e of r)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:Xe(e.featureKey),subjectType:ot(e.subjectType),subjectKey:st(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(ot(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(st(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(Xe)))),t}async create(e,...t){e.key=Xe(e.key),e.enabled??=!0;const n=await super.create(e,...t);return this.setCachedFlag(n),n}async update(e,...t){e.key=Xe(e.key),e.enabled??=!0;const n=await super.update(e,...t);return this.setCachedFlag(n),n}async findOneBy(e,t,...n){const r="key"===e&&"string"==typeof t?Xe(t):t;return this.repo.findOneBy(e,r,...n)}async readAll(e,...t){const n=await this.repo.readAll(e,...t);for(const e of n)this.setCachedFlag(e);return n}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...n){const r=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(r,...n).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,r),...n):this.getAccessRepository().create(new e.FeatureFlagAccess(r),...n)}async revokeFeatureAccess(e,...t){const n=await this.findFeatureAccess(e,...t).catch(()=>{});if(n)return this.getAccessRepository().delete(n.id,...t)}async findFeatureAccess(e,...t){const n=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(n).execute(...t))[0];if(!i)throw new r.NotFoundError(`Feature access for ${ot(e.subjectType)}:${st(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const n=await this.listFeatureAccess({...e,enabled:!0},...t),r=[...new Set(n.map(e=>e.featureKey))];if(0===r.length)return{};const a=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(r.map(Xe)));return(await this.repo.select().where(a).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...n){return tt(await this.resolveFeatureFlagsForSubject(t,...n),e)}isEnabled(e){this.assertInitialized();const t=Xe(e);return tt(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...n){this.assertInitialized();const r=await this.reader.read({...t,source:t.source??dt}),i=[];for(const[t,a]of Object.entries(r)){const r=a&&"object"==typeof a&&!Array.isArray(a)?a:{enabled:!!a},{enabled:o,...s}=r,d=Xe(t),c=await this.findOneBy("key",d,...n).catch(()=>{}),p=c?Object.assign(c,{enabled:et(a),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:et(a)}}):new e.FeatureFlag({key:d,enabled:et(a),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:et(a)}});i.push(c?await this.update(p,...n):await this.create(p,...n))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??dt},...n),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService);class ht extends _t{constructor(e){super(),this.registry=e}async read(e){return{...this.registry}}}function St(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function ft(e,t,n="any"){const r=nt(t,n);return(t,n,i)=>{if(void 0===n)return s.metadata(e,r)(t);const a=St(e,n);return i?s.methodMetadata(a,r)(t,n,i):s.propMetadata(a,r)(t,n)}}function At(e,t,n){return at(e,St(t,n))}e.EngineCapabilityFeatureFlagService=ut=class extends e.FeatureFlagService{constructor(){const e=super();if(!(this instanceof ut))return Object.assign(Object.create(ut.prototype),e,{capabilityRegistry:{}});this.capabilityRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.capabilityRegistry=mt(t.manifest??{engines:[]});const n=new ht(this.capabilityRegistry);return{config:{...t,reader:n,readerConfig:{...t.readerConfig??{},source:{}}},client:n}}isEngineEnabled(e){return tt(this.capabilityRegistry,yt(e))}isEngineFeatureEnabled(e,t){return tt(this.capabilityRegistry,yt(e,t))}isEnabled(e){return tt(this.capabilityRegistry,e)}async resolveFeatureFlags(){return{...this.capabilityRegistry}}async resolveFeatureFlagsForSubject(e,...t){return{...this.capabilityRegistry}}async isEnabledForSubject(e,t,...n){return tt(this.capabilityRegistry,e)}async listEnabled(...t){return Object.entries(this.capabilityRegistry).filter(([,e])=>et(e)).map(([t])=>new e.FeatureFlag({key:t,enabled:!0,config:{enabled:!0}}))}async syncFromEnvironment(...e){throw new r.InternalError("Engine capability feature flags are derived from the served engine manifest and are never synced from the environment")}},e.EngineCapabilityFeatureFlagService=ut=o.__decorate([i.service(),o.__metadata("design:paramtypes",[])],e.EngineCapabilityFeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=G,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...n){const r=t.at??new Date;if(t.scopeKind&&t.scopeId)return D(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(D(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt)).length>0)return!0;const a=i.visibility;return a!==e.ResourceVisibility.Private&&a!==e.ResourceVisibility.ResourceAcl&&(a===e.ResourceVisibility.OrgUnit||a===e.ResourceVisibility.OrgSubtree?D(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt)):a===e.ResourceVisibility.Tenant&&D(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&x(r,e.startsAt,e.expiresAt)))}async requireAccess(t,...n){if(!await this.canAccess(t,...n))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(r=t.scopeKind??e.ScopeKind.Resource,a=t.scopeId??"",`${r}:${a}`)}`);var r,a}async buildAccessContext(e,t,...n){return B({tenantId:e,principalId:t,permissions:D(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:D(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,n,...r){const i=await this.buildAccessContext(e,t,...r),a=i.allowedOrgUnitIdsByPermission[n]??[],o=i.resourceGrants.filter(e=>e.permissionKey===n).map(e=>e.resourceId);return F({tenantId:e,principalId:t,permissionKey:n,allowedOrgUnitIds:a,allowedResourceIds:o})}async buildQdrantFilter(e,t,n,...r){const i=await this.buildAccessContext(e,t,...r);return P({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[n]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===n).map(e=>e.resourceId)})}},e.BaseModelService=K,e.BootstrapService=ce,e.COMMIT="b661b6f",e.CredentialProviderOptions=T,e.CredentialService=class extends K{constructor(t={}){super(e.Credential),this.secretServiceInstance=t.secretService,t.repository&&(this._repository=t.repository)}async secretService(){let e=this.secretServiceInstance;if(!e){const t=new Ee;await t.boot(),this.secretServiceInstance=t,e=t}if("model"!==e.provider)throw new r.ValidationError("CredentialService stores user/runtime credentials in the model-backed secret service");return e}async createCredential(t,...n){const{log:i,ctxArgs:a}=(await this.logCtx(n,"createCredential",!0)).for(this.createCredential),o=t.name?.trim();if(!o||o.length>255||!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(o))throw new r.ValidationError("Invalid credential name: "+JSON.stringify(t.name));i.verbose("Creating credential "+o);const s=await this.secretService(),c=he("credential-"+d.randomUUID()),p=await s.store(c,t.secret,{tenantId:t.tenantId,orgUnitId:t.orgUnitId,ownerPrincipalId:t.ownerPrincipalId},...a);try{return await this.create({tenant:t.tenantId,orgUnit:t.orgUnitId,owner:t.ownerPrincipalId,name:o,credentialType:t.credentialType,secretName:p.name,provider:e.CredentialProvider.Model,description:t.description,metadata:t.metadata,expiresAt:t.expiresAt,enabled:!0},...a)}catch(e){throw await s.delete(c,{force:!0},...a).catch(()=>{}),e}}async rotateCredential(e,...t){const{log:n,ctxArgs:r}=(await this.logCtx(t,"rotateCredential",!0)).for(this.rotateCredential);n.verbose("Rotating credential "+e.credentialId);const i=await this.repo.read(e.credentialId,...r),a=await this.secretService();return a.rotate?await a.rotate(i.secretName,e.secret,{newVersion:e.version},...r):await a.store(i.secretName,e.secret,{version:e.version,tenantId:q(i.tenant),orgUnitId:i.orgUnit?q(i.orgUnit):void 0,ownerPrincipalId:i.owner?q(i.owner):void 0},...r),i.updatedAt=new Date,this.repo.update(i,...r)}async getCredential(e,...t){const{log:n,ctx:r,ctxArgs:i}=(await this.logCtx(t,"getCredential",!0)).for(this.getCredential);return n.verbose("Reading credential "+e),this.withinTransaction(r,()=>this.repo.read(e,...i))}async listCredentials(...e){const{log:t,ctxArgs:n}=(await this.logCtx(e,"listCredentials",!0)).for(this.listCredentials);return t.verbose("Listing credentials"),(await this.repo.select().execute(...n)).map(e=>this.toSummary(e))}async markCredentialUsed(e,...t){const{log:n,ctx:r,ctxArgs:i}=(await this.logCtx(t,"markCredentialUsed",!0)).for(this.markCredentialUsed);return n.verbose(`Marking credential ${e} as used`),this.withinTransaction(r,async()=>{const t=await this.repo.read(e,...i);return t.lastUsedAt=new Date,this.repo.update(t,...i)})}async deleteCredential(e,...t){const{log:n,ctxArgs:r}=(await this.logCtx(t,"deleteCredential",!0)).for(this.deleteCredential);n.verbose("Deleting credential "+e);const i=await this.repo.read(e,...r);await this.repo.delete(e,...r);const a=await this.secretService();await a.delete(i.secretName,{force:!0},...r)}async withinTransaction(e,t){const n=this.repo?.adapter;if(!n||"function"!=typeof n.transactionLock)return t();const a=e??await this.context("credentialTransaction",{}),o=a.getOrUndefined("transactionLock"),s=o??i.resolveTransactionLock(this.repo);let d;s.depth++,o||(await s.begin(a),a.cache.put("transactionLock",s));try{d=await t()}catch(e){const t=0===s.depth;if(s.depth=0,!t)try{await s.rollback(e,a)}catch(e){}throw e}if(s.depth--,0===s.depth)try{await s.commit(a)}catch(e){throw new r.InternalError("Failed to commit transaction: "+e)}return d}toSummary(e){return{id:e.id,tenantId:q(e.tenant),orgUnitId:e.orgUnit?q(e.orgUnit):void 0,ownerPrincipalId:e.owner?q(e.owner):void 0,name:e.name,credentialType:e.credentialType,provider:e.provider,description:e.description,enabled:e.enabled,metadata:e.metadata,expiresAt:e.expiresAt,lastUsedAt:e.lastUsedAt,createdAt:e.createdAt,updatedAt:e.updatedAt}}},e.EffectivePermissionService=oe,e.EnvironmeFlagReader=lt,e.FEATURE_FLAG_AUTH_KEY=ze,e.FEATURE_FLAG_BLOCK_KEY=Ve,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=Me,e.FEATURE_FLAG_HIDE_KEY=He,e.FEATURE_FLAG_MODEL_KEY=Ye,e.FEATURE_FLAG_RENDER_KEY=We,e.FULL_VERSION="0.14.1-b661b6f",e.FeatureFlagEnvironment=dt,e.FeatureFlagReader=_t,e.GroupMembershipService=te,e.GroupService=class extends K{constructor(){super(e.Group)}async createGroup(e,t,n,r,...i){return this.create({tenant:e,orgUnit:n,name:t,metadata:r},...i)}async renameGroup(e,t,...n){return this.updateOne(e,{name:t},...n)}async moveGroupToOrgUnit(e,t,...n){return this.updateOne(e,{orgUnit:t},...n)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.tenant,e))}},e.InheritanceBlockService=V,e.IsolationTierOptions=f,e.MembershipStatusOptions=A,e.NAMESPACE_RLS_POLICY_SETS=Fe,e.OrgUnitClosureService=z,e.OrgUnitMembershipService=ee,e.OrgUnitProfileService=Y,e.OrgUnitService=X,e.PACKAGE_NAME="@decaf-ts/integrations",e.PRINCIPAL_UUID_PATTERN=Ke,e.PermissionCategoryOptions=b,e.PermissionService=ne,e.PrincipalKindOptions=E,e.PrincipalService=Z,e.ProtectedResourceService=se,e.REL_CASCADE_DEPENDENT=U,e.REL_CASCADE_INSERT_UPDATE=N,e.REL_NULLIFY=C,e.REL_RESTRICT=I,e.RLS_FUNCTION_OWNER_QUERY=be,e.RLS_FUNCTION_STATEMENTS=we,e.RLS_PERMISSION_KEYS={Read:"namespace.read",Write:"namespace.write",Admin:"namespace.admin"},e.RLS_PROTECTED_TABLES=Re,e.RLS_ROLE_KEYS={Reader:"namespace-reader",Writer:"namespace-writer",Admin:"namespace-admin"},e.RLS_SETTINGS=ve,e.ResourceGrantService=de,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new de).deleteAllForResource(e,...t),await(new se).deleteById(e,...t)}async resolveResourceScope(e,...t){const n=await(new se).getById(e,...t);return{tenantId:q(n.tenant),orgUnitId:q(n.orgUnit),visibility:n.visibility,ownerPrincipalId:n.owner?q(n.owner):void 0}}},e.ResourceVisibilityOptions=R,e.RlsBootstrapService=Be,e.RlsFunctionOwnerError=je,e.RoleAssignmentService=ae,e.RolePermissionService=ie,e.RoleService=re,e.ScopeKindOptions=v,e.StorageBindingKindOptions=w,e.StorageBindingService=class extends K{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...n){return(await this.listTenantBindings(e,...n)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...n){return this.updateOne(e,{config:t},...n)}async promoteToDedicated(t,n,r,i,...a){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:n,region:r,config:i},...a)}async setShared(t,n,r,i,...a){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:n,region:r,config:i},...a)}},e.StorageKindOptions=O,e.SystemManagementService=pe,e.TenantMembershipService=Q,e.TenantProfileService=M,e.TenantService=W,e.UserService=J,e.VERSION="0.14.1",e.asArray=D,e.assertPrincipalId=xe,e.assertRlsTableCoverage=(e=Fe)=>{const t=new Set(De(e)),n=Re.filter(e=>!t.has(e));if(n.length)throw new r.InternalError("RLS template is missing tables: "+n.join(", "))},e.blockFeatureOperations=(...e)=>ft(Ve,e),e.buildAccessContext=B,e.buildArangoContext=F,e.buildQdrantFilter=P,e.engineCapabilityFlagKey=yt,e.engineCapabilityFlagRegistry=mt,e.execWithLogging=async(e,i,a,o=n.LogLevel.info)=>(a.debug("Executing: "+e),new Promise((n,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),a[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),a.debug(e.trim())}),d.on("close",e=>{0===e?(a.silly("Command completed successfully"),n({stdout:c.join("\n"),stderr:p.join("\n")})):(a.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new r.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{a.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>ft(ze,e),e.featureFlags=(...e)=>ft(Ye,e),e.getFeatureGateMetadata=At,e.hasFeatureFlagInEnvironment=async(e,t=dt)=>!!await pt(e,t),e.hideOnFeature=(...e)=>ft(He,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=et,e.isFeatureFlagEnabledByName=tt,e.isFeatureRuleBlocked=it,e.isFeatureRuleSatisfied=rt,e.isTimeValid=x,e.loadFeatureFlagsFromEnvironment=ct,e.lowerSlug=$,e.namespaceRlsSessionBinding=Ge,e.namespaceRlsTypeORMOptions=(e={})=>({sessionBinding:Ge(e)}),e.normalizeFeatureConfig=Ze,e.normalizeFeatureName=Xe,e.normalizeFeatureRegistry=Qe,e.normalizeFeatureRule=nt,e.normalizeFeatureSubjectKey=st,e.normalizeFeatureSubjectType=ot,e.nowIso=()=>new Date,e.parseRuntimeValue=Je,e.readMetadata=at,e.relationId=q,e.relationMatch=j,e.renderIfFeature=(...e)=>ft(We,e),e.resolveFeatureFlagFromEnvironment=pt,e.resolvePrincipalForSubject=async(e,t,n)=>{if(!e||"function"!=typeof e.query)throw new r.ValidationError("resolvePrincipalForSubject requires a privileged auth-prime/service-role client, not the application session");const i="string"==typeof t?t.trim():"";if(!i)return;if(null!=n&&("string"!=typeof n||!Ke.test(n)))throw new r.ValidationError("resolvePrincipalForSubject tenantId must be a UUID when provided");const a=await e.query("SELECT app_rls_principal_for_subject($1, $2) AS principal_id",[i,n??null]),o=Array.isArray(a)?a:a?.rows,s=Array.isArray(o)?o[0]?.principal_id:void 0;if("string"!=typeof s)return;const d=s.trim();return Ke.test(d)?d:void 0},e.rlsBootstrapStatements=Le,e.rlsPolicyStatements=Pe,e.rlsPolicyTables=De,e.runAsPrincipal=async(e,t,n,r={})=>{xe(t),await e.query("BEGIN");try{await e.query("SELECT set_config($1, $2, true)",[ve.Principal,t]);const i=await n(e);return await e.query(r.commit?"COMMIT":"ROLLBACK"),i}catch(t){try{await e.query("ROLLBACK")}catch{}throw t}},e.sameTenant=k,e.shouldExposeForFeatures=(e,t,n,r)=>rt(At(e,n,r),t),e.shouldHideForFeatures=(e,t,n,r)=>it(At(e,n,r),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration"),require("node:crypto"),require("@decaf-ts/crypto/integration/services/crypto")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration","node:crypto","@decaf-ts/crypto/integration/services/crypto"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration,e.node_crypto,e.crypto$1);
 //# sourceMappingURL=integrations.cjs.map

package/lib/cjs/index.cjs

@@ -23,9 +23,9 @@ exports.PACKAGE_NAME = exports.FULL_VERSION = exports.COMMIT = exports.VERSION =
 __exportStar(require("./utils.cjs"), exports);
 __exportStar(require("./namespaces/index.cjs"), exports);
 __exportStar(require("./feature-flags/index.cjs"), exports);
-exports.VERSION = "0.13.0";
-exports.COMMIT = "91b0244";
-exports.FULL_VERSION = "0.13.0-91b0244";
+exports.VERSION = "0.14.1";
+exports.COMMIT = "b661b6f";
+exports.FULL_VERSION = "0.14.1-b661b6f";
 exports.PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.cjs.map

package/lib/cjs/sftp/aws/index.cjs

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @module integrations/sftp/aws
+ * @summary AWS SFTP integration exports.
+ */
+__exportStar(require("./AwsSftpService.cjs"), exports);
+__exportStar(require("./AwsSftpEnvironment.cjs"), exports);
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.cjs.map

package/lib/cjs/sftp/aws/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sftp/aws/index.cjs","sourceRoot":"","sources":["sftp/aws/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,sDAAoC;AACpC,0DAAwC;AACxC,iCAAiC"}

package/lib/cjs/sftp/ssh2/index.cjs

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @module integrations/sftp/ssh2
+ * @summary SSH2 SFTP integration exports.
+ */
+__exportStar(require("./Ssh2SftpService.cjs"), exports);
+__exportStar(require("./Ssh2SftpEnvironment.cjs"), exports);
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.cjs.map

package/lib/cjs/sftp/ssh2/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sftp/ssh2/index.cjs","sourceRoot":"","sources":["sftp/ssh2/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,uDAAqC;AACrC,2DAAyC;AACzC,iCAAiC"}

package/lib/esm/index.js

@@ -6,8 +6,8 @@
 export * from "./utils.js";
 export * from "./namespaces/index.js";
 export * from "./feature-flags/index.js";
-export const VERSION = "0.13.0";
-export const COMMIT = "91b0244";
-export const FULL_VERSION = "0.13.0-91b0244";
+export const VERSION = "0.14.1";
+export const COMMIT = "b661b6f";
+export const FULL_VERSION = "0.14.1-b661b6f";
 export const PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map

package/lib/esm/sftp/aws/index.js

@@ -0,0 +1,7 @@
+/**
+ * @module integrations/sftp/aws
+ * @summary AWS SFTP integration exports.
+ */
+export * from "./AwsSftpService.js";
+export * from "./AwsSftpEnvironment.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/sftp/aws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/sftp/aws/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oCAAiC;AACjC,wCAAqC"}

package/lib/esm/sftp/ssh2/index.js

@@ -0,0 +1,7 @@
+/**
+ * @module integrations/sftp/ssh2
+ * @summary SSH2 SFTP integration exports.
+ */
+export * from "./Ssh2SftpService.js";
+export * from "./Ssh2SftpEnvironment.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/sftp/ssh2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/sftp/ssh2/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qCAAkC;AAClC,yCAAsC"}

package/lib/types/index.d.cts

@@ -7,6 +7,6 @@ export * from "./utils.d.cts";
 export * from "./namespaces/index.d.cts";
 export * from "./feature-flags/index.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "91b0244";
-export declare const FULL_VERSION = "0.13.0-91b0244";
+export declare const COMMIT = "b661b6f";
+export declare const FULL_VERSION = "0.14.1-b661b6f";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -7,6 +7,6 @@ export * from "./utils.d.mts";
 export * from "./namespaces/index.d.mts";
 export * from "./feature-flags/index.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "91b0244";
-export declare const FULL_VERSION = "0.13.0-91b0244";
+export declare const COMMIT = "b661b6f";
+export declare const FULL_VERSION = "0.14.1-b661b6f";
 export declare const PACKAGE_NAME: string;

package/lib/types/sftp/aws/index.d.cts

@@ -0,0 +1,6 @@
+/**
+ * @module integrations/sftp/aws
+ * @summary AWS SFTP integration exports.
+ */
+export * from "./AwsSftpService.d.cts";
+export * from "./AwsSftpEnvironment.d.cts";

package/lib/types/sftp/aws/index.d.mts

@@ -0,0 +1,6 @@
+/**
+ * @module integrations/sftp/aws
+ * @summary AWS SFTP integration exports.
+ */
+export * from "./AwsSftpService.d.mts";
+export * from "./AwsSftpEnvironment.d.mts";

package/lib/types/sftp/ssh2/index.d.cts

@@ -0,0 +1,6 @@
+/**
+ * @module integrations/sftp/ssh2
+ * @summary SSH2 SFTP integration exports.
+ */
+export * from "./Ssh2SftpService.d.cts";
+export * from "./Ssh2SftpEnvironment.d.cts";

package/lib/types/sftp/ssh2/index.d.mts

@@ -0,0 +1,6 @@
+/**
+ * @module integrations/sftp/ssh2
+ * @summary SSH2 SFTP integration exports.
+ */
+export * from "./Ssh2SftpService.d.mts";
+export * from "./Ssh2SftpEnvironment.d.mts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decaf-ts/integrations",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.mts",
@@ -150,14 +150,25 @@
     },
     "./secrets/oneppassword": {
       "import": {
-        "types": "./lib/types/secrets/oneppassword/index.d.mts",
-        "default": "./lib/esm/secrets/oneppassword/index.js"
+        "types": "./lib/types/secrets/onepassword/index.d.mts",
+        "default": "./lib/esm/secrets/onepassword/index.js"
       },
       "require": {
-        "types": "./lib/types/secrets/oneppassword/index.d.cts",
-        "default": "./lib/cjs/secrets/oneppassword/index.cjs"
+        "types": "./lib/types/secrets/onepassword/index.d.cts",
+        "default": "./lib/cjs/secrets/onepassword/index.cjs"
       },
-      "default": "./lib/esm/secrets/oneppassword/index.js"
+      "default": "./lib/esm/secrets/onepassword/index.js"
+    },
+    "./secrets/onepassword": {
+      "import": {
+        "types": "./lib/types/secrets/onepassword/index.d.mts",
+        "default": "./lib/esm/secrets/onepassword/index.js"
+      },
+      "require": {
+        "types": "./lib/types/secrets/onepassword/index.d.cts",
+        "default": "./lib/cjs/secrets/onepassword/index.cjs"
+      },
+      "default": "./lib/esm/secrets/onepassword/index.js"
     },
     "./secrets/vault": {
       "import": {
@@ -225,17 +236,6 @@
       },
       "default": "./lib/esm/blob/local/index.js"
     },
-    "./blob/ipfs": {
-      "import": {
-        "types": "./lib/types/blob/ipfs/index.d.mts",
-        "default": "./lib/esm/blob/ipfs/index.js"
-      },
-      "require": {
-        "types": "./lib/types/blob/ipfs/index.d.cts",
-        "default": "./lib/cjs/blob/ipfs/index.cjs"
-      },
-      "default": "./lib/esm/blob/ipfs/index.js"
-    },
     "./blob/memory": {
       "import": {
         "types": "./lib/types/blob/memory/index.d.mts",
@@ -280,6 +280,28 @@
       },
       "default": "./lib/esm/sftp/index.js"
     },
+    "./sftp/aws": {
+      "import": {
+        "types": "./lib/types/sftp/aws/index.d.mts",
+        "default": "./lib/esm/sftp/aws/index.js"
+      },
+      "require": {
+        "types": "./lib/types/sftp/aws/index.d.cts",
+        "default": "./lib/cjs/sftp/aws/index.cjs"
+      },
+      "default": "./lib/esm/sftp/aws/index.js"
+    },
+    "./sftp/ssh2": {
+      "import": {
+        "types": "./lib/types/sftp/ssh2/index.d.mts",
+        "default": "./lib/esm/sftp/ssh2/index.js"
+      },
+      "require": {
+        "types": "./lib/types/sftp/ssh2/index.d.cts",
+        "default": "./lib/cjs/sftp/ssh2/index.cjs"
+      },
+      "default": "./lib/esm/sftp/ssh2/index.js"
+    },
     "./redis": {
       "import": {
         "types": "./lib/types/redis/index.d.mts",
@@ -620,33 +642,31 @@
     "repo:pr": "npm run repo:doc && npm run repo:tests && npm run repo:readme",
     "clean": "rimraf ./lib ./workdocs/coverage"
   },
-  "dependencies": {
+  "devDependencies": {
+    "@aws-sdk/client-s3": "^3.1075.0",
+    "@aws-sdk/client-secrets-manager": "^3.758.0",
+    "@aws-sdk/s3-request-presigner": "^3.1075.0",
+    "@azure/identity": "4.13.0",
+    "@azure/keyvault-secrets": "^4.9.0",
+    "@azure/storage-blob": "^12.33.0",
+    "@decaf-ts/as-zod": "latest",
+    "@decaf-ts/cli": "latest",
     "@decaf-ts/core": "latest",
     "@decaf-ts/crypto": "latest",
     "@decaf-ts/db-decorators": "latest",
     "@decaf-ts/decoration": "latest",
     "@decaf-ts/decorator-validation": "latest",
+    "@decaf-ts/for-http": "latest",
+    "@decaf-ts/for-nano": "latest",
+    "@decaf-ts/for-nest": "latest",
     "@decaf-ts/injectable-decorators": "latest",
     "@decaf-ts/logging": "latest",
     "@decaf-ts/transactional-decorators": "latest",
     "@decaf-ts/ui-decorators": "latest",
-    "acorn": "^8.17.0",
-    "acorn-walk": "^8.3.5",
-    "axios": "^1.7.9",
-    "isolated-vm": "^6.1.2",
-    "node-fetch": "^3.3.2",
-    "redis": "^6.3.0",
-    "tslib": "^2.8.1",
-    "typescript": "^5.9.3",
-    "uuid": "^11.1.1"
-  },
-  "devDependencies": {
-    "@decaf-ts/as-zod": "latest",
-    "@decaf-ts/cli": "latest",
-    "@decaf-ts/for-http": "latest",
-    "@decaf-ts/for-nano": "latest",
-    "@decaf-ts/for-nest": "latest",
     "@decaf-ts/utils": "latest",
+    "@google-cloud/secret-manager": "^5.6.0",
+    "@google-cloud/storage": "^7.21.0",
+    "@grpc/grpc-js": "^1.14.6",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-express": "^11.0.0",
@@ -656,51 +676,139 @@
     "@types/jest": "^30.0.0",
     "@types/pg": "^8.23.1",
     "@types/supertest": "^6.0.0",
+    "acorn": "^8.17.0",
+    "acorn-walk": "^8.3.5",
+    "axios": "^1.7.9",
     "cron-parser": "^5.7.0",
+    "form-data": "^4.0.6",
+    "imapflow": "^1.7.1",
+    "isolated-vm": "^6.1.2",
+    "node-fetch": "^3.3.2",
     "nodemailer": "^10.1.7",
     "pg": "^8.23.1",
+    "redis": "^6.3.0",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.0",
-    "supertest": "^7.0.0"
+    "ssh2": "^1.16.0",
+    "supertest": "^7.0.0",
+    "tslib": "^2.8.1",
+    "typescript": "^5.9.3",
+    "uuid": "^11.1.1"
   },
   "peerDependencies": {
-    "@decaf-ts/as-zod": "latest",
+    "@aws-sdk/client-s3": "^3.1075.0",
+    "@aws-sdk/client-secrets-manager": "^3.758.0",
+    "@aws-sdk/s3-request-presigner": "^3.1075.0",
+    "@azure/identity": "^4.13.0",
+    "@azure/keyvault-secrets": "^4.9.0",
+    "@azure/storage-blob": "^12.33.0",
+    "@decaf-ts/core": "latest",
+    "@decaf-ts/crypto": "latest",
+    "@decaf-ts/db-decorators": "latest",
+    "@decaf-ts/decoration": "latest",
+    "@decaf-ts/decorator-validation": "latest",
     "@decaf-ts/for-http": "latest",
-    "@decaf-ts/for-nest": "latest",
-    "jose": ">=5.0.0",
+    "@decaf-ts/injectable-decorators": "latest",
+    "@decaf-ts/logging": "latest",
+    "@decaf-ts/ui-decorators": "latest",
+    "@google-cloud/secret-manager": "^5.6.0",
+    "@google-cloud/storage": "^7.21.0",
+    "@grpc/grpc-js": "^1.14.6",
+    "@nestjs/common": "^11.0.0",
+    "axios": "^1.7.9",
+    "cron-parser": "^5.7.0",
+    "form-data": "^4.0.6",
+    "imapflow": "^1.7.1",
     "nodemailer": "^10.1.7",
-    "pg": ">=8.0.0"
+    "redis": "^6.3.0",
+    "reflect-metadata": "^0.2.0",
+    "ssh2": "^1.16.0"
   },
   "peerDependenciesMeta": {
+    "@aws-sdk/client-s3": {
+      "optional": true
+    },
+    "@aws-sdk/client-secrets-manager": {
+      "optional": true
+    },
+    "@aws-sdk/s3-request-presigner": {
+      "optional": true
+    },
+    "@azure/identity": {
+      "optional": true
+    },
+    "@azure/keyvault-secrets": {
+      "optional": true
+    },
+    "@azure/storage-blob": {
+      "optional": true
+    },
+    "@decaf-ts/core": {
+      "optional": true
+    },
+    "@decaf-ts/crypto": {
+      "optional": true
+    },
+    "@decaf-ts/db-decorators": {
+      "optional": true
+    },
+    "@decaf-ts/decoration": {
+      "optional": true
+    },
+    "@decaf-ts/decorator-validation": {
+      "optional": true
+    },
     "@decaf-ts/for-http": {
       "optional": true
     },
-    "@decaf-ts/for-nest": {
+    "@decaf-ts/injectable-decorators": {
+      "optional": true
+    },
+    "@decaf-ts/logging": {
+      "optional": true
+    },
+    "@decaf-ts/ui-decorators": {
+      "optional": true
+    },
+    "@google-cloud/secret-manager": {
+      "optional": true
+    },
+    "@google-cloud/storage": {
+      "optional": true
+    },
+    "@grpc/grpc-js": {
+      "optional": true
+    },
+    "axios": {
+      "optional": true
+    },
+    "cron-parser": {
+      "optional": true
+    },
+    "form-data": {
       "optional": true
     },
-    "jose": {
+    "imapflow": {
       "optional": true
     },
     "nodemailer": {
       "optional": true
     },
-    "pg": {
+    "redis": {
+      "optional": true
+    },
+    "reflect-metadata": {
+      "optional": true
+    },
+    "ssh2": {
+      "optional": true
+    },
+    "@nestjs/common": {
       "optional": true
     }
   },
   "overrides": {
-    "js-yaml": "^5.2.2"
-  },
-  "optionalDependencies": {
-    "@aws-sdk/client-s3": "^3.1075.0",
-    "@aws-sdk/client-secrets-manager": "^3.758.0",
-    "@aws-sdk/s3-request-presigner": "^3.1075.0",
-    "@azure/identity": "^4.13.1",
-    "@azure/keyvault-secrets": "^4.9.0",
-    "@azure/storage-blob": "^12.33.0",
-    "@google-cloud/secret-manager": "^5.6.0",
-    "@google-cloud/storage": "^7.21.0",
-    "imapflow": "^1.7.1",
-    "ssh2": "^1.16.0"
+    "js-yaml": "^5.2.2",
+    "multer": "^2.5.0"
   }
 }