npm - @decaf-ts/integrations - Versions diffs - 0.3.10 → 0.3.11 - Mend

@decaf-ts/integrations 0.3.10 → 0.3.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (226) hide show

package/dist/integrations.cjs CHANGED Viewed

@@ -1,2 +1,2 @@
-var e,t;e=this,t=function(e,t,i,r,a,n,o){"use strict";var s,d,c,p,_,l,y,u;e.IsolationTier=void 0,(s=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",s.Bridge="bridge",s.Silo="silo",e.MembershipStatus=void 0,(d=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",d.Active="active",d.Suspended="suspended",d.Removed="removed",e.PrincipalKind=void 0,(c=e.PrincipalKind||(e.PrincipalKind={})).User="user",c.Group="group",c.ServiceAccount="service_account",c.Agent="agent",c.ApiKey="api_key",e.ScopeKind=void 0,(p=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",p.OrgUnit="org_unit",p.Resource="resource",e.PermissionCategory=void 0,(_=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",_.ContentRead="content_read",_.ContentWrite="content_write",_.Memory="memory",_.Graph="graph",_.Vector="vector",_.Export="export",_.Billing="billing",_.Audit="audit",_.Security="security",_.Data="data",_.Automation="automation",e.ResourceVisibility=void 0,(l=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",l.ResourceAcl="resource_acl",l.OrgUnit="org_unit",l.OrgSubtree="org_subtree",l.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(u=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",u.Dedicated="dedicated";const g=Object.values(e.IsolationTier),m=Object.values(e.MembershipStatus),h=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),S=Object.values(e.PermissionCategory),O=Object.values(e.ResourceVisibility),f=Object.values(e.StorageKind),b=Object.values(e.StorageBindingKind),A={update:a.Cascade.NONE,delete:a.Cascade.NONE,nullable:!1},w={update:a.Cascade.NONE,delete:a.Cascade.NONE,nullable:!0},P={update:a.Cascade.CASCADE,delete:a.Cascade.CASCADE,nullable:!1},T={update:a.Cascade.CASCADE,delete:a.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function I(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function R(e,t){return`${e}:${t}`}function K(e){return e??[]}function j(e,t){return D(e)===t}function k(e,t){return!!t&&D(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function M(e,t,i){const r=e??new Date;return!(t&&t>r||i&&r>i)}function x(t){const i={},r={};for(const a of t.permissions){const t=R(a.scopeKind,a.scopeId);i[t]=i[t]??[],i[t].push(a.permissionKey),a.scopeKind===e.ScopeKind.OrgUnit&&(r[a.permissionKey]=r[a.permissionKey]??[],r[a.permissionKey].push(a.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:i,allowedOrgUnitIdsByPermission:r,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class q extends a.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...i){const r=await this.repo.read(e,...i);return this.repo.update(Object.assign(r,t),...i)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...i){return this.repo.findOneBy(e,t,...i)}async findManyBy(e,t,...i){return this.repo.select().where({[e]:t}).execute(...i)}async listAll(...e){return this.repo.select().execute(...e)}}function D(e){return"string"==typeof e?e:e.id}class C extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.User,P,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(m),a.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([a.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([a.unique(),n.type(String),a.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([a.unique(),n.type(String),a.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([a.oneToMany(()=>e.TenantMembership,A,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitMembership,A,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([a.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([a.manyToOne(()=>e.User,A,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(m),a.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([a.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),a.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([a.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([a.unique(),n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(S),a.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([a.oneToMany(()=>e.RolePermission,A,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([a.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Role,P,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([a.manyToOne(()=>e.Permission,P,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([a.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.RolePermission,A,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([a.oneToMany(()=>e.RoleAssignment,A,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([a.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([a.manyToOne(()=>e.Role,A,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),a.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),a.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([a.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.ProtectedResource,P,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([a.manyToOne(()=>e.Principal,A,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([a.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(h),a.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([a.oneToMany(()=>e.RoleAssignment,A,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([a.oneToMany(()=>e.ResourceGrant,A,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([a.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,A,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(O),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([a.manyToOne(()=>e.Principal,w,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.ResourceGrant,A,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([a.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(S),a.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([a.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,A,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnit,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitMembership,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([a.oneToMany(()=>e.ProtectedResource,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([a.oneToMany(()=>e.InheritanceBlock,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitClosure,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitClosure,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([a.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(b),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([a.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([a.unique(),n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(g),a.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnit,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([a.oneToMany(()=>e.TenantMembership,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([a.oneToMany(()=>e.Principal,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([a.oneToMany(()=>e.StorageBinding,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([a.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([a.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([a.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.Group,P,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([a.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.GroupMembership,A,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([a.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([a.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class G extends q{constructor(){super(e.TenantProfile)}async createProfile(e,t,i,...r){return this.create({tenant:e,profileKey:t,metadata:i},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async deleteForTenant(e,...t){for(const i of await this.listForTenant(e,...t))await this.deleteById(i.id,...t)}}class F extends q{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,i,...r){return this.create({orgUnit:e,profileKey:t,metadata:i},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class E extends q{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,i,...r){return(await this.listAncestors(e,i,...r)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...i){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...i)}async insertAncestorLinksForNewChild(e,t,i,...r){const a=await this.listAncestors(e,t,...r);for(const t of a)await this.create({tenant:e,ancestor:t.ancestor,descendant:i,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...i){const r=await this.listDescendants(e,t,...i),a=new Set([t,...r.map(e=>D(e.descendant))]),n=new Set([t,...r.map(e=>D(e.ancestor))]),o=(await this.listAll(...i)).filter(t=>j(t.tenant,e)&&(a.has(D(t.descendant))||n.has(D(t.ancestor))));for(const e of o)await this.deleteById(e.id,...i)}}class N extends q{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,i,r,a,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:i,reason:a},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.orgUnit,t))}async categoryBlockedForAncestor(e,t,i,r,...a){return(await this.listForOrgUnit(e,t,...a)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,i)))}}class L extends q{constructor(){super(e.Tenant)}async createTenant(t,...i){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...i)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...i){return this.updateOne(e,{name:t},...i)}async changeSlug(e,t,...i){return this.updateOne(e,{slug:t},...i)}async setIsolationTier(e,t,...i){return this.updateOne(e,{isolationTier:t},...i)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function V(e,t,...i){for(const r of t)await e.deleteById(r.id,...i)}class $ extends q{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const i=B(t);return e?`${e.replace(/\/+$/,"")}/${i}`:"/"+i}async createProfileIfNeeded(e,t,i,...r){t&&await(new F).createProfile(e,t,i,...r)}async createRoot(e,t,i,r,a,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:i},...n);return await this.createProfileIfNeeded(o.id,r,a,...n),await(new E).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const i=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:i?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(i?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const a=new E;return await a.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await a.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async listDescendantOrgUnits(e,t,i=!1,...r){const a=await(new E).listDescendants(e,t,...r),n=new Set(a.map(e=>D(e.descendant)));return i&&n.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,i=!1,...r){const a=await(new E).listAncestors(e,t,...r),n=new Set(a.map(e=>D(e.ancestor)));return i&&n.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...i){const r=await this.getById(e,...i);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...i)}async moveOrgUnit(e,t,i,...r){const a=await this.getById(i,...r),n=await this.getById(t,...r),o=await this.updateOne(t,{parent:a.id,path:this.orgUnitPath(a.path,n.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const i=new E,r=await i.listAll(...t);await V(i,r.filter(t=>j(t.tenant,e)),...t);const a=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of a)await i.createSelfLink(e,r.id,...t),r.parent&&await i.insertAncestorLinksForNewChild(e,D(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...i){const r=new E,a=await this.listDescendantOrgUnits(e,t,!0,...i),n=new Set(a.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...i)).filter(e=>n.has(e.id));await V(this,o,...i),await r.deleteLinksForSubtree(e,t,...i)}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"createRoot",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"createChild",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"moveOrgUnit",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"rebuildTenantClosure",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"deleteOrgUnitTree",null);class z extends q{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...i){return this.updateOne(e,{displayName:t},...i)}async updateEmail(e,t,...i){return this.updateOne(e,{email:t},...i)}async updatePhone(e,t,...i){return this.updateOne(e,{phone:t},...i)}}class W extends q{constructor(){super(e.Principal)}async createPrincipal(e,t,i,...r){return this.create({tenant:e,kind:t,subjectId:i},...r)}async getForSubject(e,t,i,...r){return(await this.listAll(...r)).find(r=>j(r.tenant,e)&&r.kind===t&&r.subjectId===i)}async getOrCreateForSubject(e,t,i,...r){return await this.getForSubject(e,t,i,...r)??await this.createPrincipal(e,t,i,...r)}async getUserPrincipal(t,i,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.User,i,...r)}async getGroupPrincipal(t,i,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,i,...r)}}class Q extends q{constructor(){super(e.TenantMembership)}async addUserToTenant(t,i,r=e.MembershipStatus.Active,...a){return this.create({tenant:t,user:i,status:r},...a)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Y extends q{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,i,r,a=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:i,user:r,status:a},...n)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class H extends q{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,i,r,...a){return this.create({tenant:e,group:t,principal:i,metadata:r},...a)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const i=new W,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=D(e.tenant),a=D(e.group);return(await i.getGroupPrincipal(r,a,...t)).id}))}}class J extends q{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...i){return this.updateOne(e,{description:t},...i)}}class X extends q{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const i=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!i)throw Error(`Role "${e}" not found`);return i}async getTenantRoleByKey(e,t,...i){const r=(await this.listAll(...i)).find(i=>j(i.tenant,e)&&i.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...i){return this.updateOne(e,{name:t},...i)}async updateRoleMetadata(e,t,...i){return this.updateOne(e,{metadata:t},...i)}async listTenantRoles(e,t=!1,...i){return(await this.listAll(...i)).filter(i=>t&&!i.tenant||j(i.tenant,e))}}class Z extends q{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...i){return this.create({role:e,permission:t},...i)}async addPermissionKeyToRole(e,t,...i){const r=await(new J).getByKey(t,...i);return this.addPermissionToRole(e,r.id,...i)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...i){const r=await this.listRolePermissions(e,...i);return await(async(e,t,...i)=>{for(const r of t)await e.deleteById(r.id,...i)})(this,r,...i),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...i)))}async createRoleWithPermissions(e,t,...i){const r=await(new X).createRole(e,...i);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...i);return r}}class ee extends q{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async updateAssignmentWindow(e,t,i,...r){return this.updateOne(e,{startsAt:t,expiresAt:i},...r)}}class te extends q{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.principal,t))}async listForScope(e,t,i,...r){return(await this.listAll(...r)).filter(r=>j(r.tenant,e)&&r.scopeKind===t&&r.scopeId===i)}async hasPermission(e,t,i,r,a,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==i||e.scopeKind!==r||e.scopeId!==a||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...i){for(const r of await this.listForPrincipal(e,t,...i))await this.deleteById(r.id,...i)}async deleteForTenant(e,...t){for(const i of(await this.listAll(...t)).filter(t=>j(t.tenant,e)))await this.deleteById(i.id,...t)}async rebuildForPrincipal(t,i,...r){await this.deleteForPrincipal(t,i,...r);const a=new ee,n=new Z,o=new J,s=new H,d=new W,c=new E,p=new N,_=[],l=await a.listPrincipalAssignments(t,i,...r),y=await s.listPrincipalGroups(i,...r),u=[...l,...(await Promise.all(y.map(async e=>{const i=await d.getGroupPrincipal(D(e.tenant),D(e.group),...r);return a.listPrincipalAssignments(t,i.id,...r)}))).flat()];for(const a of u){const s=await n.listRolePermissions(D(a.role),...r),d=await Promise.all(s.map(async e=>o.findOneBy("id",D(e.permission),...r)));for(const n of d){if(!n)continue;const o=a.scopeKind,s=a.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||a.inheritDown){if(o===e.ScopeKind.OrgUnit&&a.inheritDown){const e=await c.listDescendants(t,s,...r);d.push(...e.map(e=>({scopeKind:o,scopeId:D(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&a.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...r)||_.push({id:"",tenantId:t,principalId:i,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:a.id,startsAt:a.startsAt,expiresAt:a.expiresAt})}}return await Promise.all(_.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...r)))}async rebuildForTenant(e,...t){const i=(await(new W).listAll(...t)).filter(t=>j(t.tenant,e));for(const r of i)await this.rebuildForPrincipal(e,r.id,...t)}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],te.prototype,"rebuildForPrincipal",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],te.prototype,"rebuildForTenant",null);class ie extends q{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,i,...r){return(await this.listAll(...r)).find(r=>j(r.tenant,e)&&r.resourceType===t&&r.resourceId===i)}async moveResourceToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async setVisibility(e,t,...i){return this.updateOne(e,{visibility:t},...i)}async transferOwnership(e,t,...i){return this.updateOne(e,{owner:t},...i)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}}class re extends q{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.principal,t))}async hasGrant(e,t,i,r,a,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,i)&&e.permissionKey===r&&(!e.startsAt||!a||e.startsAt<=a)&&(!e.expiresAt||!a||e.expiresAt>=a))}async deleteAllForResource(e,...t){for(const i of await this.listResourceGrants(e,...t))await this.deleteById(i.id,...t)}}class ae{constructor(){this.tenantService=new L,this.tenantProfileService=new G,this.orgUnitService=new $,this.orgUnitProfileService=new F,this.userService=new z,this.membershipService=new Q,this.principalService=new W,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new Z,this.roleAssignmentService=new ee,this.effectivePermissionService=new te}async bootstrapTenantFromTemplate(t,...i){const r=await this.tenantService.createTenant(t.tenant,...i);t.tenant.profileKey&&await this.tenantProfileService.createProfile(r.id,t.tenant.profileKey,t.tenant.profileMetadata,...i);const a=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(r.id,t.name,t.metadata,t.profileKey,t.metadata,...i):await this.orgUnitService.createChild({tenantId:r.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...i);for(const e of t.children??[])await a(n.id,e);return n},n=await a(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...i);await this.membershipService.addUserToTenant(r.id,o.id,e.MembershipStatus.Active,...i);const s=await this.principalService.getUserPrincipal(r.id,o.id,...i);for(const e of t.permissions)await this.permissionService.createPermission(e,...i);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:r.id,key:e.key,name:e.name,description:e.description},...i);for(const r of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,r,...i)}const d=await this.roleService.getTenantRoleByKey(r.id,t.ownerRoleKey,...i);return await this.roleAssignmentService.assignRole({tenantId:r.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...i),await this.effectivePermissionService.rebuildForPrincipal(r.id,s.id,...i),{tenantId:r.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ae.prototype,"bootstrapTenantFromTemplate",null);class ne{constructor(){this.membershipService=new Q,this.orgMembershipService=new Y,this.principalService=new W,this.roleService=new X,this.roleAssignmentService=new ee,this.effectivePermissionService=new te}async onboardUserToTenantAndOrgUnit(t,i,r,a,...n){await this.membershipService.addUserToTenant(t,i,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,r,i,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,i,...n),s=await this.roleService.getTenantRoleByKey(t,a,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,i,r,a,n,...o){const s=await this.roleService.getTenantRoleByKey(t,a,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,i,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===r))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:i,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,i,...o)}async suspendUserInTenant(t,i,r,...a){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...a),await this.effectivePermissionService.deleteForPrincipal(i,r,...a)}async reactivateUserInTenant(t,i,r,...a){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...a),await this.effectivePermissionService.rebuildForPrincipal(i,r,...a)}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"changeUserOrgRole",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"suspendUserInTenant",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"reactivateUserInTenant",null),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>a.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>a.transactional}),e.AuthorizationModel=C,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...i){const r=t.at??new Date;if(t.scopeKind&&t.scopeId)return K(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const a=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!a)return!1;if(a.tenantId!==t.tenantId)return!1;if(a.ownerPrincipalId===t.principalId)return!0;if(K(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt)).length>0)return!0;const n=a.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?K(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,a.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&K(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt)))}async requireAccess(t,...i){if(!await this.canAccess(t,...i))throw new a.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(r=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${r}:${n}`)}`);var r,n}async buildAccessContext(e,t,...i){return x({tenantId:e,principalId:t,permissions:K(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:K(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,i,...r){const a=await this.buildAccessContext(e,t,...r),n=a.allowedOrgUnitIdsByPermission[i]??[],o=a.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:i,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,i,...r){const a=await this.buildAccessContext(e,t,...r);return I({tenantId:e,principalId:t,allowedOrgUnitIds:a.allowedOrgUnitIdsByPermission[i]??[],allowedResourceIds:a.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId)})}},e.BaseModelService=q,e.BootstrapService=ae,e.COMMIT="1deb3bb",e.EffectivePermissionService=te,e.FULL_VERSION="0.3.9-1deb3bb",e.GroupMembershipService=H,e.GroupService=class extends q{constructor(){super(e.Group)}async createGroup(e,t,i,r,...a){return this.create({tenant:e,orgUnit:i,name:t,metadata:r},...a)}async renameGroup(e,t,...i){return this.updateOne(e,{name:t},...i)}async moveGroupToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=g,e.MembershipStatusOptions=m,e.OrgUnitClosureService=E,e.OrgUnitMembershipService=Y,e.OrgUnitProfileService=F,e.OrgUnitService=$,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=S,e.PermissionService=J,e.PrincipalKindOptions=h,e.PrincipalService=W,e.ProtectedResourceService=ie,e.REL_CASCADE_DEPENDENT=P,e.REL_CASCADE_INSERT_UPDATE=T,e.REL_NULLIFY=w,e.REL_RESTRICT=A,e.ResourceGrantService=re,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new re).deleteAllForResource(e,...t),await(new ie).deleteById(e,...t)}async resolveResourceScope(e,...t){const i=await(new ie).getById(e,...t);return{tenantId:D(i.tenant),orgUnitId:D(i.orgUnit),visibility:i.visibility,ownerPrincipalId:i.owner?D(i.owner):void 0}}},e.ResourceVisibilityOptions=O,e.RoleAssignmentService=ee,e.RolePermissionService=Z,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=b,e.StorageBindingService=class extends q{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>D(t.tenant)===e)}async getBinding(e,t,...i){return(await this.listTenantBindings(e,...i)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...i){return this.updateOne(e,{config:t},...i)}async promoteToDedicated(t,i,r,a,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:i,region:r,config:a},...n)}async setShared(t,i,r,a,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:i,region:r,config:a},...n)}},e.StorageKindOptions=f,e.SystemManagementService=ne,e.TenantMembershipService=Q,e.TenantProfileService=G,e.TenantService=L,e.UserService=z,e.VERSION="0.3.9",e.asArray=K,e.buildAccessContext=x,e.buildArangoContext=U,e.buildQdrantFilter=I,e.execWithLogging=async(e,a,n,o=i.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((i,s)=>{const d=t.exec(e,a),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),i({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new r.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.id=()=>crypto.randomUUID(),e.isTimeValid=M,e.lowerSlug=B,e.nowIso=()=>new Date,e.relationId=D,e.relationMatch=k,e.sameTenant=j},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib);
+var e,t;e=this,t=function(e,t,i,r,a,n,o){"use strict";var s,d,c,p,_,l,y,u;e.IsolationTier=void 0,(s=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",s.Bridge="bridge",s.Silo="silo",e.MembershipStatus=void 0,(d=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",d.Active="active",d.Suspended="suspended",d.Removed="removed",e.PrincipalKind=void 0,(c=e.PrincipalKind||(e.PrincipalKind={})).User="user",c.Group="group",c.ServiceAccount="service_account",c.Agent="agent",c.ApiKey="api_key",e.ScopeKind=void 0,(p=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",p.OrgUnit="org_unit",p.Resource="resource",e.PermissionCategory=void 0,(_=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",_.ContentRead="content_read",_.ContentWrite="content_write",_.Memory="memory",_.Graph="graph",_.Vector="vector",_.Export="export",_.Billing="billing",_.Audit="audit",_.Security="security",_.Data="data",_.Automation="automation",e.ResourceVisibility=void 0,(l=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",l.ResourceAcl="resource_acl",l.OrgUnit="org_unit",l.OrgSubtree="org_subtree",l.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(u=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",u.Dedicated="dedicated";const g=Object.values(e.IsolationTier),m=Object.values(e.MembershipStatus),h=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),S=Object.values(e.PermissionCategory),O=Object.values(e.ResourceVisibility),f=Object.values(e.StorageKind),b=Object.values(e.StorageBindingKind),A={update:a.Cascade.NONE,delete:a.Cascade.NONE,nullable:!1},w={update:a.Cascade.NONE,delete:a.Cascade.NONE,nullable:!0},P={update:a.Cascade.CASCADE,delete:a.Cascade.CASCADE,nullable:!1},T={update:a.Cascade.CASCADE,delete:a.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function I(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function R(e,t){return`${e}:${t}`}function K(e){return e??[]}function j(e,t){return D(e)===t}function k(e,t){return!!t&&D(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function M(e,t,i){const r=e??new Date;return!(t&&t>r||i&&r>i)}function x(t){const i={},r={};for(const a of t.permissions){const t=R(a.scopeKind,a.scopeId);i[t]=i[t]??[],i[t].push(a.permissionKey),a.scopeKind===e.ScopeKind.OrgUnit&&(r[a.permissionKey]=r[a.permissionKey]??[],r[a.permissionKey].push(a.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:i,allowedOrgUnitIdsByPermission:r,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class q extends a.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...i){const r=await this.repo.read(e,...i);return this.repo.update(Object.assign(r,t),...i)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...i){return this.repo.findOneBy(e,t,...i)}async findManyBy(e,t,...i){return this.repo.select().where({[e]:t}).execute(...i)}async listAll(...e){return this.repo.select().execute(...e)}}function D(e){return"string"==typeof e?e:e.id}class C extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.User,P,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(m),a.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([a.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([a.unique(),n.type(String),a.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([a.unique(),n.type(String),a.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([a.oneToMany(()=>e.TenantMembership,A,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitMembership,A,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([a.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([a.manyToOne(()=>e.User,A,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(m),a.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([a.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),a.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([a.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([a.unique(),n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(S),a.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([a.oneToMany(()=>e.RolePermission,A,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([a.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Role,P,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([a.manyToOne(()=>e.Permission,P,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([a.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.RolePermission,A,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([a.oneToMany(()=>e.RoleAssignment,A,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([a.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([a.manyToOne(()=>e.Role,A,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),a.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),a.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([a.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.ProtectedResource,P,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([a.manyToOne(()=>e.Principal,A,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([a.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(h),a.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([a.oneToMany(()=>e.RoleAssignment,A,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([a.oneToMany(()=>e.ResourceGrant,A,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([a.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,A,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(O),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([a.manyToOne(()=>e.Principal,w,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.ResourceGrant,A,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([a.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(S),a.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),a.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([a.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,A,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnit,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitMembership,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([a.oneToMany(()=>e.ProtectedResource,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([a.oneToMany(()=>e.InheritanceBlock,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitClosure,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnitClosure,A,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([a.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(b),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([a.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([a.unique(),n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(g),a.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([a.oneToMany(()=>e.OrgUnit,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([a.oneToMany(()=>e.TenantMembership,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([a.oneToMany(()=>e.Principal,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([a.oneToMany(()=>e.StorageBinding,A,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([a.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([a.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([a.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.Group,P,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([a.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,A,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),a.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([a.oneToMany(()=>e.GroupMembership,A,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([a.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([a.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends C{constructor(e){super(e)}},o.__decorate([a.pk({type:String}),a.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([a.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([a.manyToOne(()=>e.Principal,P,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),a.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([a.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([a.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([a.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class G extends q{constructor(){super(e.TenantProfile)}async createProfile(e,t,i,...r){return this.create({tenant:e,profileKey:t,metadata:i},...r)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async deleteForTenant(e,...t){for(const i of await this.listForTenant(e,...t))await this.deleteById(i.id,...t)}}class F extends q{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,i,...r){return this.create({orgUnit:e,profileKey:t,metadata:i},...r)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class E extends q{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,i,...r){return(await this.listAncestors(e,i,...r)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...i){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...i)}async insertAncestorLinksForNewChild(e,t,i,...r){const a=await this.listAncestors(e,t,...r);for(const t of a)await this.create({tenant:e,ancestor:t.ancestor,descendant:i,depth:t.depth+1},...r)}async deleteLinksForSubtree(e,t,...i){const r=await this.listDescendants(e,t,...i),a=new Set([t,...r.map(e=>D(e.descendant))]),n=new Set([t,...r.map(e=>D(e.ancestor))]),o=(await this.listAll(...i)).filter(t=>j(t.tenant,e)&&(a.has(D(t.descendant))||n.has(D(t.ancestor))));for(const e of o)await this.deleteById(e.id,...i)}}class N extends q{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,i,r,a,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:r,permissionCategory:i,reason:a},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.orgUnit,t))}async categoryBlockedForAncestor(e,t,i,r,...a){return(await this.listForOrgUnit(e,t,...a)).some(e=>e.permissionCategory===r&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,i)))}}class L extends q{constructor(){super(e.Tenant)}async createTenant(t,...i){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...i)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...i){return this.updateOne(e,{name:t},...i)}async changeSlug(e,t,...i){return this.updateOne(e,{slug:t},...i)}async setIsolationTier(e,t,...i){return this.updateOne(e,{isolationTier:t},...i)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function V(e,t,...i){for(const r of t)await e.deleteById(r.id,...i)}class $ extends q{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const i=B(t);return e?`${e.replace(/\/+$/,"")}/${i}`:"/"+i}async createProfileIfNeeded(e,t,i,...r){t&&await(new F).createProfile(e,t,i,...r)}async createRoot(e,t,i,r,a,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:i},...n);return await this.createProfileIfNeeded(o.id,r,a,...n),await(new E).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const i=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,r=await this.create({tenant:e.tenantId,parent:i?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(i?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(r.id,e.profileKey,e.profileMetadata,...t);const a=new E;return await a.createSelfLink(e.tenantId,r.id,...t),e.parentOrgUnitId&&await a.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,r.id,...t),r}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async listDescendantOrgUnits(e,t,i=!1,...r){const a=await(new E).listDescendants(e,t,...r),n=new Set(a.map(e=>D(e.descendant)));return i&&n.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,i=!1,...r){const a=await(new E).listAncestors(e,t,...r),n=new Set(a.map(e=>D(e.ancestor)));return i&&n.add(t),(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...i){const r=await this.getById(e,...i);return this.updateOne(e,{name:t,path:this.orgUnitPath(r.path.includes("/")?r.path.replace(/\/[^/]+$/,""):void 0,t)},...i)}async moveOrgUnit(e,t,i,...r){const a=await this.getById(i,...r),n=await this.getById(t,...r),o=await this.updateOne(t,{parent:a.id,path:this.orgUnitPath(a.path,n.name)},...r);return await this.rebuildTenantClosure(e,...r),o}async rebuildTenantClosure(e,...t){const i=new E,r=await i.listAll(...t);await V(i,r.filter(t=>j(t.tenant,e)),...t);const a=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const r of a)await i.createSelfLink(e,r.id,...t),r.parent&&await i.insertAncestorLinksForNewChild(e,D(r.parent),r.id,...t)}async deleteOrgUnitTree(e,t,...i){const r=new E,a=await this.listDescendantOrgUnits(e,t,!0,...i),n=new Set(a.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...i)).filter(e=>n.has(e.id));await V(this,o,...i),await r.deleteLinksForSubtree(e,t,...i)}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"createRoot",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"createChild",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"moveOrgUnit",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"rebuildTenantClosure",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],$.prototype,"deleteOrgUnitTree",null);class z extends q{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...i){return this.updateOne(e,{displayName:t},...i)}async updateEmail(e,t,...i){return this.updateOne(e,{email:t},...i)}async updatePhone(e,t,...i){return this.updateOne(e,{phone:t},...i)}}class W extends q{constructor(){super(e.Principal)}async createPrincipal(e,t,i,...r){return this.create({tenant:e,kind:t,subjectId:i},...r)}async getForSubject(e,t,i,...r){return(await this.listAll(...r)).find(r=>j(r.tenant,e)&&r.kind===t&&r.subjectId===i)}async getOrCreateForSubject(e,t,i,...r){return await this.getForSubject(e,t,i,...r)??await this.createPrincipal(e,t,i,...r)}async getUserPrincipal(t,i,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.User,i,...r)}async getGroupPrincipal(t,i,...r){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,i,...r)}}class Q extends q{constructor(){super(e.TenantMembership)}async addUserToTenant(t,i,r=e.MembershipStatus.Active,...a){return this.create({tenant:t,user:i,status:r},...a)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Y extends q{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,i,r,a=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:i,user:r,status:a},...n)}async setStatus(e,t,...i){return this.updateOne(e,{status:t},...i)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class H extends q{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,i,r,...a){return this.create({tenant:e,group:t,principal:i,metadata:r},...a)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const i=new W,r=await this.listPrincipalGroups(e,...t);return await Promise.all(r.map(async e=>{const r=D(e.tenant),a=D(e.group);return(await i.getGroupPrincipal(r,a,...t)).id}))}}class J extends q{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...i){return this.updateOne(e,{description:t},...i)}}class X extends q{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const i=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!i)throw Error(`Role "${e}" not found`);return i}async getTenantRoleByKey(e,t,...i){const r=(await this.listAll(...i)).find(i=>j(i.tenant,e)&&i.key===t);if(!r)throw Error(`Role "${t}" not found for tenant ${e}`);return r}async renameRole(e,t,...i){return this.updateOne(e,{name:t},...i)}async updateRoleMetadata(e,t,...i){return this.updateOne(e,{metadata:t},...i)}async listTenantRoles(e,t=!1,...i){return(await this.listAll(...i)).filter(i=>t&&!i.tenant||j(i.tenant,e))}}class Z extends q{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...i){return this.create({role:e,permission:t},...i)}async addPermissionKeyToRole(e,t,...i){const r=await(new J).getByKey(t,...i);return this.addPermissionToRole(e,r.id,...i)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...i){const r=await this.listRolePermissions(e,...i);return await(async(e,t,...i)=>{for(const r of t)await e.deleteById(r.id,...i)})(this,r,...i),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...i)))}async createRoleWithPermissions(e,t,...i){const r=await(new X).createRole(e,...i);for(const e of t)await this.addPermissionKeyToRole(r.id,e,...i);return r}}class ee extends q{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}async updateAssignmentWindow(e,t,i,...r){return this.updateOne(e,{startsAt:t,expiresAt:i},...r)}}class te extends q{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.principal,t))}async listForScope(e,t,i,...r){return(await this.listAll(...r)).filter(r=>j(r.tenant,e)&&r.scopeKind===t&&r.scopeId===i)}async hasPermission(e,t,i,r,a,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==i||e.scopeKind!==r||e.scopeId!==a||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...i){for(const r of await this.listForPrincipal(e,t,...i))await this.deleteById(r.id,...i)}async deleteForTenant(e,...t){for(const i of(await this.listAll(...t)).filter(t=>j(t.tenant,e)))await this.deleteById(i.id,...t)}async rebuildForPrincipal(t,i,...r){await this.deleteForPrincipal(t,i,...r);const a=new ee,n=new Z,o=new J,s=new H,d=new W,c=new E,p=new N,_=[],l=await a.listPrincipalAssignments(t,i,...r),y=await s.listPrincipalGroups(i,...r),u=[...l,...(await Promise.all(y.map(async e=>{const i=await d.getGroupPrincipal(D(e.tenant),D(e.group),...r);return a.listPrincipalAssignments(t,i.id,...r)}))).flat()];for(const a of u){const s=await n.listRolePermissions(D(a.role),...r),d=await Promise.all(s.map(async e=>o.findOneBy("id",D(e.permission),...r)));for(const n of d){if(!n)continue;const o=a.scopeKind,s=a.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||a.inheritDown){if(o===e.ScopeKind.OrgUnit&&a.inheritDown){const e=await c.listDescendants(t,s,...r);d.push(...e.map(e=>({scopeKind:o,scopeId:D(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&a.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...r)||_.push({id:"",tenantId:t,principalId:i,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:a.id,startsAt:a.startsAt,expiresAt:a.expiresAt})}}return await Promise.all(_.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...r)))}async rebuildForTenant(e,...t){const i=(await(new W).listAll(...t)).filter(t=>j(t.tenant,e));for(const r of i)await this.rebuildForPrincipal(e,r.id,...t)}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],te.prototype,"rebuildForPrincipal",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],te.prototype,"rebuildForTenant",null);class ie extends q{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,i,...r){return(await this.listAll(...r)).find(r=>j(r.tenant,e)&&r.resourceType===t&&r.resourceId===i)}async moveResourceToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async setVisibility(e,t,...i){return this.updateOne(e,{visibility:t},...i)}async transferOwnership(e,t,...i){return this.updateOne(e,{owner:t},...i)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}}class re extends q{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...i){return(await this.listAll(...i)).filter(i=>j(i.tenant,e)&&k(i.principal,t))}async hasGrant(e,t,i,r,a,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,i)&&e.permissionKey===r&&(!e.startsAt||!a||e.startsAt<=a)&&(!e.expiresAt||!a||e.expiresAt>=a))}async deleteAllForResource(e,...t){for(const i of await this.listResourceGrants(e,...t))await this.deleteById(i.id,...t)}}class ae{constructor(){this.tenantService=new L,this.tenantProfileService=new G,this.orgUnitService=new $,this.orgUnitProfileService=new F,this.userService=new z,this.membershipService=new Q,this.principalService=new W,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new Z,this.roleAssignmentService=new ee,this.effectivePermissionService=new te}async bootstrapTenantFromTemplate(t,...i){const r=await this.tenantService.createTenant(t.tenant,...i);t.tenant.profileKey&&await this.tenantProfileService.createProfile(r.id,t.tenant.profileKey,t.tenant.profileMetadata,...i);const a=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(r.id,t.name,t.metadata,t.profileKey,t.metadata,...i):await this.orgUnitService.createChild({tenantId:r.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...i);for(const e of t.children??[])await a(n.id,e);return n},n=await a(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...i);await this.membershipService.addUserToTenant(r.id,o.id,e.MembershipStatus.Active,...i);const s=await this.principalService.getUserPrincipal(r.id,o.id,...i);for(const e of t.permissions)await this.permissionService.createPermission(e,...i);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:r.id,key:e.key,name:e.name,description:e.description},...i);for(const r of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,r,...i)}const d=await this.roleService.getTenantRoleByKey(r.id,t.ownerRoleKey,...i);return await this.roleAssignmentService.assignRole({tenantId:r.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...i),await this.effectivePermissionService.rebuildForPrincipal(r.id,s.id,...i),{tenantId:r.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ae.prototype,"bootstrapTenantFromTemplate",null);class ne{constructor(){this.membershipService=new Q,this.orgMembershipService=new Y,this.principalService=new W,this.roleService=new X,this.roleAssignmentService=new ee,this.effectivePermissionService=new te}async onboardUserToTenantAndOrgUnit(t,i,r,a,...n){await this.membershipService.addUserToTenant(t,i,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,r,i,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,i,...n),s=await this.roleService.getTenantRoleByKey(t,a,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,i,r,a,n,...o){const s=await this.roleService.getTenantRoleByKey(t,a,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,i,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===r))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:i,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:r,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,i,...o)}async suspendUserInTenant(t,i,r,...a){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...a),await this.effectivePermissionService.deleteForPrincipal(i,r,...a)}async reactivateUserInTenant(t,i,r,...a){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...a),await this.effectivePermissionService.rebuildForPrincipal(i,r,...a)}}o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"changeUserOrgRole",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"suspendUserInTenant",null),o.__decorate([a.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"reactivateUserInTenant",null),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>a.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>a.transactional}),e.AuthorizationModel=C,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...i){const r=t.at??new Date;if(t.scopeKind&&t.scopeId)return K(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const a=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!a)return!1;if(a.tenantId!==t.tenantId)return!1;if(a.ownerPrincipalId===t.principalId)return!0;if(K(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt)).length>0)return!0;const n=a.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?K(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,a.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&K(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&M(r,e.startsAt,e.expiresAt)))}async requireAccess(t,...i){if(!await this.canAccess(t,...i))throw new a.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(r=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${r}:${n}`)}`);var r,n}async buildAccessContext(e,t,...i){return x({tenantId:e,principalId:t,permissions:K(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:K(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,i,...r){const a=await this.buildAccessContext(e,t,...r),n=a.allowedOrgUnitIdsByPermission[i]??[],o=a.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:i,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,i,...r){const a=await this.buildAccessContext(e,t,...r);return I({tenantId:e,principalId:t,allowedOrgUnitIds:a.allowedOrgUnitIdsByPermission[i]??[],allowedResourceIds:a.resourceGrants.filter(e=>e.permissionKey===i).map(e=>e.resourceId)})}},e.BaseModelService=q,e.BootstrapService=ae,e.COMMIT="857014d",e.EffectivePermissionService=te,e.FULL_VERSION="0.3.10-857014d",e.GroupMembershipService=H,e.GroupService=class extends q{constructor(){super(e.Group)}async createGroup(e,t,i,r,...a){return this.create({tenant:e,orgUnit:i,name:t,metadata:r},...a)}async renameGroup(e,t,...i){return this.updateOne(e,{name:t},...i)}async moveGroupToOrgUnit(e,t,...i){return this.updateOne(e,{orgUnit:t},...i)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>j(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=g,e.MembershipStatusOptions=m,e.OrgUnitClosureService=E,e.OrgUnitMembershipService=Y,e.OrgUnitProfileService=F,e.OrgUnitService=$,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=S,e.PermissionService=J,e.PrincipalKindOptions=h,e.PrincipalService=W,e.ProtectedResourceService=ie,e.REL_CASCADE_DEPENDENT=P,e.REL_CASCADE_INSERT_UPDATE=T,e.REL_NULLIFY=w,e.REL_RESTRICT=A,e.ResourceGrantService=re,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new re).deleteAllForResource(e,...t),await(new ie).deleteById(e,...t)}async resolveResourceScope(e,...t){const i=await(new ie).getById(e,...t);return{tenantId:D(i.tenant),orgUnitId:D(i.orgUnit),visibility:i.visibility,ownerPrincipalId:i.owner?D(i.owner):void 0}}},e.ResourceVisibilityOptions=O,e.RoleAssignmentService=ee,e.RolePermissionService=Z,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=b,e.StorageBindingService=class extends q{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>D(t.tenant)===e)}async getBinding(e,t,...i){return(await this.listTenantBindings(e,...i)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...i){return this.updateOne(e,{config:t},...i)}async promoteToDedicated(t,i,r,a,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:i,region:r,config:a},...n)}async setShared(t,i,r,a,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:i,region:r,config:a},...n)}},e.StorageKindOptions=f,e.SystemManagementService=ne,e.TenantMembershipService=Q,e.TenantProfileService=G,e.TenantService=L,e.UserService=z,e.VERSION="0.3.10",e.asArray=K,e.buildAccessContext=x,e.buildArangoContext=U,e.buildQdrantFilter=I,e.execWithLogging=async(e,a,n,o=i.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((i,s)=>{const d=t.exec(e,a),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),i({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new r.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.id=()=>crypto.randomUUID(),e.isTimeValid=M,e.lowerSlug=B,e.nowIso=()=>new Date,e.relationId=D,e.relationMatch=k,e.sameTenant=j},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib);
 //# sourceMappingURL=integrations.cjs.map

package/lib/cjs/graph/engine/execution/CodeGraphNodeExecutor.cjs ADDED Viewed

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodeGraphNodeExecutor = void 0;
+const GraphExecutionError_js_1 = require("./../errors/GraphExecutionError.cjs");
+const GraphInputError_js_1 = require("./../errors/GraphInputError.cjs");
+/**
+ * Reads the Code node metadata from the node definition's graph metadata.
+ */
+function readCodeMetadata(context) {
+    const meta = context.node.graph?.metadata;
+    if (!meta)
+        return {};
+    const codeMeta = meta["code"];
+    if (!codeMeta)
+        return {};
+    return codeMeta;
+}
+/**
+ * Executor for `core.flow.code` nodes.
+ *
+ * The Code Node runs user-authored JS/TS in a restricted sandbox. The engine
+ * does not implement the sandbox directly (§22.4); instead it delegates to the
+ * pluggable {@link CodeSandboxEvaluator} registered on the engine config. When
+ * no evaluator is registered, the executor throws
+ * `GRAPH_CODE_SANDBOX_NOT_CONFIGURED`.
+ *
+ * The sandbox context exposes:
+ * - `$input` — the value on the node's `input` port (or the full input object
+ *   as a fallback when no `input` port is present).
+ * - `$vars` — workflow variables (sourced from `context.metadata.vars` when
+ *   the engine populates it).
+ * - `$item` / `$index` — current loop item and index (sourced from
+ *   `context.metadata` when the node executes inside a foreach body).
+ * - `$node` — outputs of upstream nodes (sourced from
+ *   `context.metadata.nodes` when available).
+ * - `$output` — the current draft output (sourced from
+ *   `context.metadata.output`).
+ *
+ * The evaluator's return value is forwarded verbatim on the `result` output
+ * port.
+ */
+class CodeGraphNodeExecutor {
+    /**
+     * @param engine - The graph execution engine (or any object exposing the
+     *   optional `codeSandboxEvaluator`). This mirrors the pattern used by
+     *   {@link SwitchGraphNodeExecutor} for code conditions.
+     */
+    constructor(engine) {
+        this.engine = engine;
+    }
+    async execute(input, context) {
+        const meta = readCodeMetadata(context);
+        const code = meta.code;
+        if (!code || typeof code !== "string" || code.trim().length === 0) {
+            throw new GraphInputError_js_1.GraphInputError("Code node has no code to execute (metadata.code is empty)", { metadata: meta });
+        }
+        const evaluator = this.engine?.codeSandboxEvaluator;
+        if (!evaluator) {
+            throw new GraphExecutionError_js_1.GraphExecutionError("Code node execution requires a CodeSandboxEvaluator to be registered in GraphExecutionEngineConfig.codeSandboxEvaluator", "GRAPH_CODE_SANDBOX_NOT_CONFIGURED", { code });
+        }
+        const sandboxContext = this.buildSandboxContext(input, context, meta);
+        await context.log("Executing code node", {
+            language: meta.language ?? "javascript",
+            length: code.length,
+        });
+        const result = await evaluator.evaluate(sandboxContext);
+        await context.log("Code node executed", { hasResult: result !== undefined });
+        return { result };
+    }
+    /**
+     * Builds the {@link CodeSandboxContext} from the executor input and the
+     * graph execution context.
+     *
+     * The `$input` value is resolved from the node's `input` port. When the node
+     * has no explicit `input` port, the full input values object is used as
+     * `$input` so the code can still access every resolved port value.
+     *
+     * The `$vars`, `$item`, `$index`, `$node`, and `$output` values are sourced
+     * from `context.metadata` — the engine (or a wrapping loop executor) may
+     * populate these when the Code node runs inside a loop body or a workflow
+     * with variables.
+     */
+    buildSandboxContext(input, context, meta) {
+        const inputPortValue = "input" in input ? input["input"] : input;
+        const md = context.metadata;
+        return {
+            code: meta.code,
+            language: meta.language ?? "javascript",
+            input: typeof inputPortValue === "object" && inputPortValue !== null
+                ? inputPortValue
+                : { value: inputPortValue },
+            vars: md?.vars ?? undefined,
+            item: md?.item,
+            index: md?.index,
+            nodes: md?.nodes ??
+                undefined,
+        };
+    }
+}
+exports.CodeGraphNodeExecutor = CodeGraphNodeExecutor;
+//# sourceMappingURL=CodeGraphNodeExecutor.js.map
+//# sourceMappingURL=CodeGraphNodeExecutor.cjs.map

package/lib/cjs/graph/engine/execution/CodeGraphNodeExecutor.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"graph/engine/execution/CodeGraphNodeExecutor.cjs","sourceRoot":"","sources":["graph/engine/execution/CodeGraphNodeExecutor.js"],"names":[],"mappings":";;;AAAA,+EAAyE;AACzE,uEAAiE;AACjE;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAO;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;IAC1C,IAAI,CAAC,IAAI;QACL,OAAO,EAAE,CAAC;IACd,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ;QACT,OAAO,EAAE,CAAC;IACd,OAAO,QAAQ,CAAC;AACpB,CAAC;AACD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAa,qBAAqB;IAC9B;;;;OAIG;IACH,YAAY,MAAM;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;QACxB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,oCAAe,CAAC,2DAA2D,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,4CAAmB,CAAC,yHAAyH,EAAE,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5M,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,YAAY;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IACtB,CAAC;IACD;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI;QACpC,MAAM,cAAc,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,OAAO;YACH,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,YAAY;YACvC,KAAK,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI;gBAChE,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC/B,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,SAAS;YAC3B,IAAI,EAAE,EAAE,EAAE,IAAI;YACd,KAAK,EAAE,EAAE,EAAE,KAAK;YAChB,KAAK,EAAE,EAAE,EAAE,KAAK;gBACZ,SAAS;SAChB,CAAC;IACN,CAAC;CACJ;AAzDD,sDAyDC;AACD,iDAAiD"}