@decaf-ts/integrations 0.5.0 → 0.6.0

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="64499f4",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.4.1-2-64499f4",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.4.1-2",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
+var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="7d93597",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.5.1-7d93597",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.5.1",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
 //# sourceMappingURL=integrations.cjs.map

package/docker/keycloak-broker-compose.yml

@@ -0,0 +1,128 @@
+services:
+  traefik:
+    image: traefik:v3.1
+    command:
+      - --api.dashboard=false
+      - --providers.file.filename=/etc/traefik/traefik-broker.yml
+      - --entrypoints.web.address=:80
+    ports:
+      - "8088:80"
+    volumes:
+      - ./traefik-broker.yml:/etc/traefik/traefik-broker.yml:ro
+    networks:
+      - broker-auth
+
+  main-keycloak:
+    image: quay.io/keycloak/keycloak:24.0.0
+    command: start-dev
+    environment:
+      KC_DB: dev-file
+      KC_HTTP_ENABLED: "true"
+      KC_HOSTNAME: auth.localhost
+      KC_HOSTNAME_PORT: "8088"
+      KC_PROXY_HEADERS: xforwarded
+      KC_HOSTNAME_STRICT: "false"
+      KC_HEALTH_ENABLED: "true"
+      KC_READY_ENABLED: "true"
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: admin
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.main-keycloak.rule: Host(`auth.localhost`)
+      traefik.http.routers.main-keycloak.entrypoints: web
+      traefik.http.services.main-keycloak.loadbalancer.server.port: "8080"
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /health/ready HTTP/1.1\r\nhost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep -q 'UP'"]
+      interval: 10s
+      timeout: 5s
+      retries: 15
+      start_period: 40s
+    extra_hosts:
+      - external-auth.localhost:host-gateway
+    networks:
+      - broker-auth
+
+  external-keycloak:
+    image: quay.io/keycloak/keycloak:24.0.0
+    command: start-dev
+    environment:
+      KC_DB: dev-file
+      KC_HTTP_ENABLED: "true"
+      KC_HOSTNAME: external-auth.localhost
+      KC_HOSTNAME_PORT: "8088"
+      KC_PROXY_HEADERS: xforwarded
+      KC_HOSTNAME_STRICT: "false"
+      KC_HEALTH_ENABLED: "true"
+      KC_READY_ENABLED: "true"
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: admin
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.external-keycloak.rule: Host(`external-auth.localhost`)
+      traefik.http.routers.external-keycloak.entrypoints: web
+      traefik.http.services.external-keycloak.loadbalancer.server.port: "8080"
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /health/ready HTTP/1.1\r\nhost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep -q 'UP'"]
+      interval: 10s
+      timeout: 5s
+      retries: 15
+      start_period: 40s
+    networks:
+      - broker-auth
+
+  protected-service:
+    image: nginx:1.27-alpine
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.protected-service.rule: Host(`protected.localhost`)
+      traefik.http.routers.protected-service.entrypoints: web
+      traefik.http.routers.protected-service.middlewares: oauth-errors@docker,oauth-auth@docker
+      traefik.http.services.protected-service.loadbalancer.server.port: "80"
+    networks:
+      - broker-auth
+
+  oauth2-proxy:
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+    depends_on:
+      main-keycloak:
+        condition: service_healthy
+      external-keycloak:
+        condition: service_healthy
+    command:
+      - --http-address=0.0.0.0:4180
+      - --provider=keycloak-oidc
+      - --oidc-issuer-url=http://auth.localhost:8088/realms/broker
+      - --oidc-extra-audience=account
+      - --login-url=http://auth.localhost:8088/realms/broker/protocol/openid-connect/auth?kc_idp_hint=external-oidc
+      - --client-id=protected-service
+      - --client-secret=protected-service-secret
+      - --redirect-url=http://protected.localhost:8088/oauth2/callback
+      - --upstream=static://202
+      - --email-domain=*
+      - --cookie-secret=01234567890123456789012345678901
+      - --cookie-secure=false
+      - --set-xauthrequest=true
+      - --pass-access-token=true
+      - --reverse-proxy=true
+      - --whitelist-domain=protected.localhost:8088
+    extra_hosts:
+      - auth.localhost:host-gateway
+      - external-auth.localhost:host-gateway
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.oauth2-proxy.rule: Host(`protected.localhost`) && PathPrefix(`/oauth2`)
+      traefik.http.routers.oauth2-proxy.entrypoints: web
+      traefik.http.services.oauth2-proxy.loadbalancer.server.port: "4180"
+      traefik.http.middlewares.oauth-auth.forwardauth.address: http://oauth2-proxy:4180/oauth2/auth
+      traefik.http.middlewares.oauth-auth.forwardauth.trustForwardHeader: "true"
+      traefik.http.middlewares.oauth-auth.forwardauth.authResponseHeaders: X-Auth-Request-User,X-Auth-Request-Email,X-Auth-Request-Access-Token,Authorization
+      traefik.http.middlewares.oauth-errors.errors.status: 401-403
+      traefik.http.middlewares.oauth-errors.errors.service: oauth2-proxy
+      traefik.http.middlewares.oauth-errors.errors.query: /oauth2/sign_in?rd={url}
+    networks:
+      - broker-auth
+    restart: on-failure
+
+networks:
+  broker-auth:
+    name: decaf-keycloak-broker

package/docker/traefik-broker.yml

@@ -0,0 +1,51 @@
+http:
+  routers:
+    main-keycloak:
+      rule: Host(`auth.localhost`)
+      entryPoints: [web]
+      service: main-keycloak
+    external-keycloak:
+      rule: Host(`external-auth.localhost`)
+      entryPoints: [web]
+      service: external-keycloak
+    oauth2-proxy:
+      rule: Host(`protected.localhost`) && PathPrefix(`/oauth2`)
+      entryPoints: [web]
+      service: oauth2-proxy
+    protected-service:
+      rule: Host(`protected.localhost`)
+      entryPoints: [web]
+      middlewares: [oauth-errors, oauth-auth]
+      service: protected-service
+  middlewares:
+    oauth-auth:
+      forwardAuth:
+        address: http://oauth2-proxy:4180/oauth2/auth
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-Auth-Request-User
+          - X-Auth-Request-Email
+          - X-Auth-Request-Access-Token
+          - Authorization
+    oauth-errors:
+      errors:
+        status: ["401-403"]
+        service: oauth2-proxy
+        query: /oauth2/sign_in?rd={url}
+  services:
+    main-keycloak:
+      loadBalancer:
+        servers:
+          - url: http://main-keycloak:8080
+    external-keycloak:
+      loadBalancer:
+        servers:
+          - url: http://external-keycloak:8080
+    oauth2-proxy:
+      loadBalancer:
+        servers:
+          - url: http://oauth2-proxy:4180
+    protected-service:
+      loadBalancer:
+        servers:
+          - url: http://protected-service:80

package/eslint.config.js

@@ -15,6 +15,7 @@ export default [
       "!tests/**/*",
       "tests/bundling/**/*",
       "tests/web/**/*",
+      "plugins/**/*",
     ],
   },
   { languageOptions: { globals: globals.browser } },

package/lib/cjs/graph/engine/errors/GraphBreakSignal.cjs

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphBreakSignal = void 0;
+/**
+ * @module integrations/graph/errors/GraphBreakSignal
+ * @summary Control-flow signal used by `core.flow.break` to exit a loop early.
+ * @description Thrown by the Break node executor and caught by the enclosing
+ * loop executor (`core.loop.foreach`, `core.loop.while`, `core.loop.until`).
+ * Unlike a real error, a break signal is a cooperative control-flow token: it
+ * is NOT propagated as a workflow failure. When caught, the loop terminates
+ * early and returns the results collected so far (plus the optional `value`
+ * carried by the signal as the final partial result).
+ */
+const GraphExecutionError_js_1 = require("./GraphExecutionError.cjs");
+/**
+ * Control-flow signal thrown by `core.flow.break` nodes.
+ *
+ * Extends {@link GraphExecutionError} so it rides on the existing error
+ * pipeline, but carries the `graphCode` `"GRAPH_BREAK_SIGNAL"` and the flag
+ * `isBreakSignal = true` so loop executors can distinguish it from a genuine
+ * execution failure via `instanceof` or the flag.
+ */
+class GraphBreakSignal extends GraphExecutionError_js_1.GraphExecutionError {
+    /**
+     * @param value - Optional value forwarded by the Break node. The enclosing
+     *   loop appends this to the collected results as the last partial result.
+     */
+    constructor(value) {
+        super("Break signal", "GRAPH_BREAK_SIGNAL", { value });
+        /** Distinguishes a break signal from a genuine error without `instanceof`. */
+        this.isBreakSignal = true;
+        this.name = "GraphBreakSignal";
+    }
+}
+exports.GraphBreakSignal = GraphBreakSignal;
+//# sourceMappingURL=GraphBreakSignal.js.map
+//# sourceMappingURL=GraphBreakSignal.cjs.map

package/lib/cjs/graph/engine/errors/GraphBreakSignal.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/errors/GraphBreakSignal.cjs","sourceRoot":"","sources":["graph/engine/errors/GraphBreakSignal.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,qEAA+D;AAC/D;;;;;;;GAOG;AACH,MAAa,gBAAiB,SAAQ,4CAAmB;IACrD;;;OAGG;IACH,YAAY,KAAK;QACb,KAAK,CAAC,cAAc,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,8EAA8E;QAC9E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACnC,CAAC;CACJ;AAXD,4CAWC;AACD,4CAA4C"}

package/lib/cjs/graph/engine/errors/index.cjs

@@ -27,5 +27,6 @@ __exportStar(require("./GraphPinningError.cjs"), exports);
 __exportStar(require("./GraphPortError.cjs"), exports);
 __exportStar(require("./GraphStoreError.cjs"), exports);
 __exportStar(require("./GraphTopologyError.cjs"), exports);
+__exportStar(require("./GraphBreakSignal.cjs"), exports);
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.cjs.map

package/lib/cjs/graph/engine/errors/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graph/engine/errors/index.cjs","sourceRoot":"","sources":["graph/engine/errors/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,2DAAyC;AACzC,uDAAqC;AACrC,uDAAqC;AACrC,2DAAyC;AACzC,yDAAuC;AACvC,sDAAoC;AACpC,uDAAqC;AACrC,0DAAwC;AACxC,iCAAiC"}
+{"version":3,"file":"graph/engine/errors/index.cjs","sourceRoot":"","sources":["graph/engine/errors/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,2DAAyC;AACzC,uDAAqC;AACrC,uDAAqC;AACrC,2DAAyC;AACzC,yDAAuC;AACvC,sDAAoC;AACpC,uDAAqC;AACrC,0DAAwC;AACxC,wDAAsC;AACtC,iCAAiC"}

package/lib/cjs/graph/engine/execution/BreakGraphNodeExecutor.cjs

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BreakGraphNodeExecutor = void 0;
+const GraphBreakSignal_js_1 = require("./../errors/GraphBreakSignal.cjs");
+/**
+ * Executor for `core.flow.break` nodes.
+ *
+ * Reads the optional `value` input port and throws a {@link GraphBreakSignal}
+ * carrying it. The enclosing loop executor (`core.loop.foreach`,
+ * `core.loop.while`, `core.loop.until`) catches the signal, stops iterating,
+ * and returns the results collected so far (plus the carried value as the
+ * final partial result).
+ */
+class BreakGraphNodeExecutor {
+    async execute(input, 
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _context) {
+        const value = input["value"];
+        throw new GraphBreakSignal_js_1.GraphBreakSignal(value);
+    }
+}
+exports.BreakGraphNodeExecutor = BreakGraphNodeExecutor;
+//# sourceMappingURL=BreakGraphNodeExecutor.js.map
+//# sourceMappingURL=BreakGraphNodeExecutor.cjs.map

package/lib/cjs/graph/engine/execution/BreakGraphNodeExecutor.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/execution/BreakGraphNodeExecutor.cjs","sourceRoot":"","sources":["graph/engine/execution/BreakGraphNodeExecutor.js"],"names":[],"mappings":";;;AAAA,yEAAmE;AACnE;;;;;;;;GAQG;AACH,MAAa,sBAAsB;IAC/B,KAAK,CAAC,OAAO,CAAC,KAAK;IACnB,6DAA6D;IAC7D,QAAQ;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,sCAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;CACJ;AAPD,wDAOC;AACD,kDAAkD"}