@decaf-ts/integrations 0.6.0 → 0.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/integrations.cjs +1 -1
  2. package/lib/cjs/index.cjs +3 -3
  3. package/lib/esm/index.js +3 -3
  4. package/lib/types/index.d.cts +2 -2
  5. package/lib/types/index.d.mts +2 -2
  6. package/package.json +8 -4
package/dist/integrations.cjs CHANGED
@@ -1,2 +1,2 @@
1
- var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="7d93597",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.5.1-7d93597",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.5.1",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
1
+ var e,t;e=this,t=function(e,t,r,a,i,n,o,s){"use strict";var d,c,p,l,u,_,y,g;e.IsolationTier=void 0,(d=e.IsolationTier||(e.IsolationTier={})).Pooled="pooled",d.Bridge="bridge",d.Silo="silo",e.MembershipStatus=void 0,(c=e.MembershipStatus||(e.MembershipStatus={})).Invited="invited",c.Active="active",c.Suspended="suspended",c.Removed="removed",e.PrincipalKind=void 0,(p=e.PrincipalKind||(e.PrincipalKind={})).User="user",p.Group="group",p.ServiceAccount="service_account",p.Agent="agent",p.ApiKey="api_key",e.ScopeKind=void 0,(l=e.ScopeKind||(e.ScopeKind={})).Tenant="tenant",l.OrgUnit="org_unit",l.Resource="resource",e.PermissionCategory=void 0,(u=e.PermissionCategory||(e.PermissionCategory={})).Admin="admin",u.ContentRead="content_read",u.ContentWrite="content_write",u.Memory="memory",u.Graph="graph",u.Vector="vector",u.Export="export",u.Billing="billing",u.Audit="audit",u.Security="security",u.Data="data",u.Automation="automation",e.ResourceVisibility=void 0,(_=e.ResourceVisibility||(e.ResourceVisibility={})).Private="private",_.ResourceAcl="resource_acl",_.OrgUnit="org_unit",_.OrgSubtree="org_subtree",_.Tenant="tenant",e.StorageKind=void 0,(y=e.StorageKind||(e.StorageKind={})).Postgres="postgres",y.Arango="arango",y.Qdrant="qdrant",y.ObjectStorage="object_storage",e.StorageBindingKind=void 0,(g=e.StorageBindingKind||(e.StorageBindingKind={})).Shared="shared",g.Dedicated="dedicated";const m=Object.values(e.IsolationTier),h=Object.values(e.MembershipStatus),f=Object.values(e.PrincipalKind),v=Object.values(e.ScopeKind),b=Object.values(e.PermissionCategory),S=Object.values(e.ResourceVisibility),O=Object.values(e.StorageKind),A=Object.values(e.StorageBindingKind),w={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!1},P={update:i.Cascade.NONE,delete:i.Cascade.NONE,nullable:!0},T={update:i.Cascade.CASCADE,delete:i.Cascade.CASCADE,nullable:!1},F={update:i.Cascade.CASCADE,delete:i.Cascade.NONE,nullable:!1};function U(e){return{tenantId:e.tenantId,principalId:e.principalId,permissionKey:e.permissionKey,allowedOrgUnitIds:[...e.allowedOrgUnitIds],allowedResourceIds:[...e.allowedResourceIds]}}function R(e){return{must:[{key:"tenant_id",match:{value:e.tenantId}},{should:[{key:"org_unit_id",match:{any:e.allowedOrgUnitIds}},{key:"protected_resource_id",match:{any:e.allowedResourceIds}},{key:"owner_principal_id",match:{value:e.principalId}}]}]}}function I(e,t){return`${e}:${t}`}function j(e){return e??[]}function K(e,t){return q(e)===t}function k(e,t){return!!t&&q(e)===t}function B(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"item"}function C(e,t,r){const a=e??new Date;return!(t&&t>a||r&&a>r)}function M(t){const r={},a={};for(const i of t.permissions){const t=I(i.scopeKind,i.scopeId);r[t]=r[t]??[],r[t].push(i.permissionKey),i.scopeKind===e.ScopeKind.OrgUnit&&(a[i.permissionKey]=a[i.permissionKey]??[],a[i.permissionKey].push(i.scopeId))}return{tenantId:t.tenantId,principalId:t.principalId,permissionsByScope:r,allowedOrgUnitIdsByPermission:a,resourceGrants:t.grants.map(e=>({resourceId:e.resourceId,permissionKey:e.permissionKey}))}}class E extends i.ModelService{constructor(e){super(e)}newModel(e,t){return Object.assign(new e,t)}async create(e,...t){return this.repo.create(Object.assign({},e),...t)}async createOne(e,...t){return this.create(e,...t)}async getById(e,...t){return this.repo.read(e,...t)}async updateOne(e,t,...r){const a=await this.repo.read(e,...r);return this.repo.update(Object.assign(a,t),...r)}async deleteById(e,...t){await this.repo.delete(e,...t)}async findOneBy(e,t,...r){return this.repo.findOneBy(e,t,...r)}async findManyBy(e,t,...r){return this.repo.select().where({[e]:t}).execute(...r)}async listAll(...e){return this.repo.select().execute(...e)}}function q(e){return"string"==typeof e?e:e.id}class x extends n.Model{constructor(e){super(e)}}e.TenantMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.User,T,!1,void 0,"fk_tenant_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.TenantMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.TenantMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantMembership.prototype,"updatedAt",void 0),e.TenantMembership=o.__decorate([i.table("tenant_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantMembership),e.User=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.User.prototype,"id",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"email",void 0),o.__decorate([i.unique(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"phone",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.User.prototype,"displayName",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"tenantMemberships",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.User.prototype,"orgUnitMemberships",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.User.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.User.prototype,"updatedAt",void 0),e.User=o.__decorate([i.table("users"),n.model(),o.__metadata("design:paramtypes",[Object])],e.User),e.OrgUnitMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_memberships_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.User,w,!1,void 0,"fk_org_memberships_user"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitMembership.prototype,"user",void 0),o.__decorate([n.required(),n.type(String),n.option(h),i.column(),o.__metadata("design:type",String)],e.OrgUnitMembership.prototype,"status",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitMembership.prototype,"updatedAt",void 0),e.OrgUnitMembership=o.__decorate([i.table("org_unit_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitMembership),e.OrgUnitClosure=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitClosure.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_org_closure_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_ancestor"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"ancestor",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_closure_descendant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitClosure.prototype,"descendant",void 0),o.__decorate([n.required(),n.type(Number),i.column(),o.__metadata("design:type",Number)],e.OrgUnitClosure.prototype,"depth",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitClosure.prototype,"createdAt",void 0),e.OrgUnitClosure=o.__decorate([i.table("org_unit_closure"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitClosure),e.Permission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Permission.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"category",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Permission.prototype,"description",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Permission.prototype,"rolePermissions",void 0),e.Permission=o.__decorate([i.table("permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Permission),e.RolePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RolePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Role,T,!1,void 0,"fk_role_permissions_role"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"role",void 0),o.__decorate([i.manyToOne(()=>e.Permission,T,!1,void 0,"fk_role_permissions_permission"),n.required(),o.__metadata("design:type",Object)],e.RolePermission.prototype,"permission",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RolePermission.prototype,"createdAt",void 0),e.RolePermission=o.__decorate([i.table("role_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RolePermission),e.Role=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Role.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,P,!1,void 0,"fk_roles_tenant"),o.__metadata("design:type",Object)],e.Role.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"key",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"name",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.Role.prototype,"description",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Role.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.RolePermission,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"rolePermissions",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Role.prototype,"assignments",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Role.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Role.prototype,"updatedAt",void 0),e.Role=o.__decorate([i.table("roles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Role),e.RoleAssignment=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_role_assignments_tenant"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_role_assignments_principal"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"principal",void 0),o.__decorate([i.manyToOne(()=>e.Role,w,!1,void 0,"fk_role_assignments_role"),n.required(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"role",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.RoleAssignment.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(Boolean),i.column(),o.__metadata("design:type",Boolean)],e.RoleAssignment.prototype,"inheritDown",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.RoleAssignment.prototype,"conditions",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.RoleAssignment.prototype,"updatedAt",void 0),e.RoleAssignment=o.__decorate([i.table("role_assignments"),n.model(),o.__metadata("design:paramtypes",[Object])],e.RoleAssignment),e.ResourceGrant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_resource_grants_tenant"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.ProtectedResource,T,!1,void 0,"fk_resource_grants_resource"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"resource",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_resource_grants_principal"),n.required(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ResourceGrant.prototype,"permissionKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"expiresAt",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"conditions",void 0),o.__decorate([i.manyToOne(()=>e.Principal,w,!1,void 0,"fk_resource_grants_created_by"),o.__metadata("design:type",Object)],e.ResourceGrant.prototype,"createdBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ResourceGrant.prototype,"updatedAt",void 0),e.ResourceGrant=o.__decorate([i.table("resource_grants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ResourceGrant),e.Principal=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Principal.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_principals_tenant"),n.required(),o.__metadata("design:type",Object)],e.Principal.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(f),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"kind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Principal.prototype,"subjectId",void 0),o.__decorate([i.oneToMany(()=>e.RoleAssignment,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"roleAssignments",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.Principal.prototype,"resourceGrants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Principal.prototype,"updatedAt",void 0),e.Principal=o.__decorate([i.table("principals"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Principal),e.ProtectedResource=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_protected_resources_tenant"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_protected_resources_org_unit"),n.required(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceType",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"resourceId",void 0),o.__decorate([n.required(),n.type(String),n.option(S),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"visibility",void 0),o.__decorate([i.manyToOne(()=>e.Principal,P,!1,void 0,"fk_protected_resources_owner"),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"owner",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.ProtectedResource.prototype,"sensitivity",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.ProtectedResource.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.ResourceGrant,w,!1),o.__metadata("design:type",Array)],e.ProtectedResource.prototype,"grants",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.ProtectedResource.prototype,"updatedAt",void 0),e.ProtectedResource=o.__decorate([i.table("protected_resources"),n.model(),o.__metadata("design:paramtypes",[Object])],e.ProtectedResource),e.InheritanceBlock=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_inheritance_blocks_tenant"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_inheritance_blocks_org_unit"),n.required(),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"orgUnit",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_inheritance_blocks_blocked_ancestor"),o.__metadata("design:type",Object)],e.InheritanceBlock.prototype,"blockedFromAncestor",void 0),o.__decorate([n.required(),n.type(String),n.option(b),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"permissionCategory",void 0),o.__decorate([n.type(String),i.column(),o.__metadata("design:type",String)],e.InheritanceBlock.prototype,"reason",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.InheritanceBlock.prototype,"updatedAt",void 0),e.InheritanceBlock=o.__decorate([i.table("inheritance_blocks"),n.model(),o.__metadata("design:paramtypes",[Object])],e.InheritanceBlock),e.OrgUnit=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_org_units_tenant"),n.required(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,w,!1,void 0,"fk_org_units_parent"),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"parent",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"children",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnit.prototype,"path",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnit.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitMembership,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.ProtectedResource,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"resources",void 0),o.__decorate([i.oneToMany(()=>e.InheritanceBlock,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"inheritanceBlocks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"ancestorLinks",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnitClosure,w,!1),o.__metadata("design:type",Array)],e.OrgUnit.prototype,"descendantLinks",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnit.prototype,"updatedAt",void 0),e.OrgUnit=o.__decorate([i.table("org_units"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnit),e.StorageBinding=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_storage_bindings_tenant"),n.required(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),n.option(O),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"storageKind",void 0),o.__decorate([n.required(),n.type(String),n.option(A),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"bindingKey",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.StorageBinding.prototype,"region",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.StorageBinding.prototype,"config",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.StorageBinding.prototype,"updatedAt",void 0),e.StorageBinding=o.__decorate([i.table("storage_bindings"),n.model(),o.__metadata("design:paramtypes",[Object])],e.StorageBinding),e.Tenant=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Tenant.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"slug",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"name",void 0),o.__decorate([n.required(),n.type(String),n.option(m),i.column(),o.__metadata("design:type",String)],e.Tenant.prototype,"isolationTier",void 0),o.__decorate([i.oneToMany(()=>e.OrgUnit,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"orgUnits",void 0),o.__decorate([i.oneToMany(()=>e.TenantMembership,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"memberships",void 0),o.__decorate([i.oneToMany(()=>e.Principal,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"principals",void 0),o.__decorate([i.oneToMany(()=>e.StorageBinding,w,!1),o.__metadata("design:type",Array)],e.Tenant.prototype,"storageBindings",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Tenant.prototype,"updatedAt",void 0),e.Tenant=o.__decorate([i.table("tenants"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Tenant),e.TenantProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_tenant_profiles_tenant"),n.required(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"tenant",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.TenantProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.TenantProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.TenantProfile.prototype,"updatedAt",void 0),e.TenantProfile=o.__decorate([i.table("tenant_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.TenantProfile),e.OrgUnitProfile=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,T,!1,void 0,"fk_org_unit_profiles_org_unit"),n.required(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.OrgUnitProfile.prototype,"profileKey",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.OrgUnitProfile.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.OrgUnitProfile.prototype,"updatedAt",void 0),e.OrgUnitProfile=o.__decorate([i.table("org_unit_profiles"),n.model(),o.__metadata("design:paramtypes",[Object])],e.OrgUnitProfile),e.GroupMembership=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.GroupMembership.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_group_memberships_tenant"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Group,T,!1,void 0,"fk_group_memberships_group"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"group",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_group_memberships_principal"),n.required(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"principal",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.GroupMembership.prototype,"metadata",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.GroupMembership.prototype,"createdAt",void 0),e.GroupMembership=o.__decorate([i.table("group_memberships"),n.model(),o.__metadata("design:paramtypes",[Object])],e.GroupMembership),e.Group=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.Group.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,w,!1,void 0,"fk_groups_tenant"),n.required(),o.__metadata("design:type",Object)],e.Group.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.OrgUnit,P,!1,void 0,"fk_groups_org_unit"),o.__metadata("design:type",Object)],e.Group.prototype,"orgUnit",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.Group.prototype,"name",void 0),o.__decorate([n.type(Object),i.column(),o.__metadata("design:type",Object)],e.Group.prototype,"metadata",void 0),o.__decorate([i.oneToMany(()=>e.GroupMembership,w,!1),o.__metadata("design:type",Array)],e.Group.prototype,"members",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.Group.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.Group.prototype,"updatedAt",void 0),e.Group=o.__decorate([i.table("groups"),n.model(),o.__metadata("design:paramtypes",[Object])],e.Group),e.EffectivePermission=class extends x{constructor(e){super(e)}},o.__decorate([i.pk({type:String}),i.uuid(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"id",void 0),o.__decorate([i.manyToOne(()=>e.Tenant,T,!1,void 0,"fk_effective_permissions_tenant"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"tenant",void 0),o.__decorate([i.manyToOne(()=>e.Principal,T,!1,void 0,"fk_effective_permissions_principal"),n.required(),o.__metadata("design:type",Object)],e.EffectivePermission.prototype,"principal",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"permissionKey",void 0),o.__decorate([n.required(),n.type(String),n.option(v),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"scopeId",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceKind",void 0),o.__decorate([n.required(),n.type(String),i.column(),o.__metadata("design:type",String)],e.EffectivePermission.prototype,"sourceId",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"startsAt",void 0),o.__decorate([i.column(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"expiresAt",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.EffectivePermission.prototype,"createdAt",void 0),e.EffectivePermission=o.__decorate([i.table("effective_permissions"),n.model(),o.__metadata("design:paramtypes",[Object])],e.EffectivePermission);class D extends E{constructor(){super(e.TenantProfile)}async createProfile(e,t,r,...a){return this.create({tenant:e,profileKey:t,metadata:r},...a)}async listForTenant(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async deleteForTenant(e,...t){for(const r of await this.listForTenant(e,...t))await this.deleteById(r.id,...t)}}class G extends E{constructor(){super(e.OrgUnitProfile)}async createProfile(e,t,r,...a){return this.create({orgUnit:e,profileKey:t,metadata:r},...a)}async listForOrgUnit(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}}class L extends E{constructor(){super(e.OrgUnitClosure)}async listAncestors(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.descendant,t)).sort((e,t)=>e.depth-t.depth)}async listDescendants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.ancestor,t)).sort((e,t)=>e.depth-t.depth)}async isAncestorOf(e,t,r,...a){return(await this.listAncestors(e,r,...a)).some(e=>k(e.ancestor,t))}async createSelfLink(e,t,...r){return this.create({tenant:e,ancestor:t,descendant:t,depth:0},...r)}async insertAncestorLinksForNewChild(e,t,r,...a){const i=await this.listAncestors(e,t,...a);for(const t of i)await this.create({tenant:e,ancestor:t.ancestor,descendant:r,depth:t.depth+1},...a)}async deleteLinksForSubtree(e,t,...r){const a=await this.listDescendants(e,t,...r),i=new Set([t,...a.map(e=>q(e.descendant))]),n=new Set([t,...a.map(e=>q(e.ancestor))]),o=(await this.listAll(...r)).filter(t=>K(t.tenant,e)&&(i.has(q(t.descendant))||n.has(q(t.ancestor))));for(const e of o)await this.deleteById(e.id,...r)}}class N extends E{constructor(){super(e.InheritanceBlock)}async blockCategory(e,t,r,a,i,...n){return this.create({tenant:e,orgUnit:t,blockedFromAncestor:a,permissionCategory:r,reason:i},...n)}async unblockCategory(e,...t){await this.deleteById(e,...t)}async listForOrgUnit(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.orgUnit,t))}async categoryBlockedForAncestor(e,t,r,a,...i){return(await this.listForOrgUnit(e,t,...i)).some(e=>e.permissionCategory===a&&(!e.blockedFromAncestor||k(e.blockedFromAncestor,r)))}}class z extends E{constructor(){super(e.Tenant)}async createTenant(t,...r){return this.create({slug:t.slug,name:t.name,isolationTier:t.isolationTier??e.IsolationTier.Pooled},...r)}async getBySlug(e,...t){return this.findOneBy("slug",e,...t)}async renameTenant(e,t,...r){return this.updateOne(e,{name:t},...r)}async changeSlug(e,t,...r){return this.updateOne(e,{slug:t},...r)}async setIsolationTier(e,t,...r){return this.updateOne(e,{isolationTier:t},...r)}async deleteTenantControlled(e,...t){await this.deleteById(e,...t)}}async function $(e,t,...r){for(const a of t)await e.deleteById(a.id,...r)}class V extends E{constructor(){super(e.OrgUnit)}orgUnitPath(e,t){const r=B(t);return e?`${e.replace(/\/+$/,"")}/${r}`:"/"+r}async createProfileIfNeeded(e,t,r,...a){t&&await(new G).createProfile(e,t,r,...a)}async createRoot(e,t,r,a,i,...n){const o=await this.create({tenant:e,name:t,path:this.orgUnitPath(void 0,t),metadata:r},...n);return await this.createProfileIfNeeded(o.id,a,i,...n),await(new L).createSelfLink(e,o.id,...n),o}async createChild(e,...t){const r=e.parentOrgUnitId?await this.getById(e.parentOrgUnitId,...t):void 0,a=await this.create({tenant:e.tenantId,parent:r?.id??e.parentOrgUnitId,name:e.name,path:this.orgUnitPath(r?.path,e.name),metadata:e.metadata},...t);await this.createProfileIfNeeded(a.id,e.profileKey,e.profileMetadata,...t);const i=new L;return await i.createSelfLink(e.tenantId,a.id,...t),e.parentOrgUnitId&&await i.insertAncestorLinksForNewChild(e.tenantId,e.parentOrgUnitId,a.id,...t),a}async listChildren(e,...t){return(await this.listAll(...t)).filter(t=>k(t.parent,e))}async listTenantOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async listDescendantOrgUnits(e,t,r=!1,...a){const i=await(new L).listDescendants(e,t,...a),n=new Set(i.map(e=>q(e.descendant)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async listAncestorOrgUnits(e,t,r=!1,...a){const i=await(new L).listAncestors(e,t,...a),n=new Set(i.map(e=>q(e.ancestor)));return r&&n.add(t),(await this.listTenantOrgUnits(e,...a)).filter(e=>n.has(e.id))}async renameOrgUnit(e,t,...r){const a=await this.getById(e,...r);return this.updateOne(e,{name:t,path:this.orgUnitPath(a.path.includes("/")?a.path.replace(/\/[^/]+$/,""):void 0,t)},...r)}async moveOrgUnit(e,t,r,...a){const i=await this.getById(r,...a),n=await this.getById(t,...a),o=await this.updateOne(t,{parent:i.id,path:this.orgUnitPath(i.path,n.name)},...a);return await this.rebuildTenantClosure(e,...a),o}async rebuildTenantClosure(e,...t){const r=new L,a=await r.listAll(...t);await $(r,a.filter(t=>K(t.tenant,e)),...t);const i=(await this.listTenantOrgUnits(e,...t)).sort((e,t)=>e.path.split("/").filter(Boolean).length-t.path.split("/").filter(Boolean).length);for(const a of i)await r.createSelfLink(e,a.id,...t),a.parent&&await r.insertAncestorLinksForNewChild(e,q(a.parent),a.id,...t)}async deleteOrgUnitTree(e,t,...r){const a=new L,i=await this.listDescendantOrgUnits(e,t,!0,...r),n=new Set(i.map(e=>e.id)),o=(await this.listTenantOrgUnits(e,...r)).filter(e=>n.has(e.id));await $(this,o,...r),await a.deleteLinksForSubtree(e,t,...r)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object,String,Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createRoot",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"createChild",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"moveOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"rebuildTenantClosure",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],V.prototype,"deleteOrgUnitTree",null);class W extends E{constructor(){super(e.User)}async createUser(e,...t){return this.create({email:e.email,phone:e.phone,displayName:e.displayName},...t)}async getByEmail(e,...t){return(await this.listAll(...t)).find(t=>t.email===e)}async updateDisplayName(e,t,...r){return this.updateOne(e,{displayName:t},...r)}async updateEmail(e,t,...r){return this.updateOne(e,{email:t},...r)}async updatePhone(e,t,...r){return this.updateOne(e,{phone:t},...r)}}class Y extends E{constructor(){super(e.Principal)}async createPrincipal(e,t,r,...a){return this.create({tenant:e,kind:t,subjectId:r},...a)}async getForSubject(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.kind===t&&a.subjectId===r)}async getOrCreateForSubject(e,t,r,...a){return await this.getForSubject(e,t,r,...a)??await this.createPrincipal(e,t,r,...a)}async getUserPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.User,r,...a)}async getGroupPrincipal(t,r,...a){return this.getOrCreateForSubject(t,e.PrincipalKind.Group,r,...a)}}class H extends E{constructor(){super(e.TenantMembership)}async addUserToTenant(t,r,a=e.MembershipStatus.Active,...i){return this.create({tenant:t,user:r,status:a},...i)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserTenants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listTenantUsers(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async removeUserFromTenant(e,...t){await this.deleteById(e,...t)}}class Q extends E{constructor(){super(e.OrgUnitMembership)}async addUserToOrgUnit(t,r,a,i=e.MembershipStatus.Active,...n){return this.create({tenant:t,orgUnit:r,user:a,status:i},...n)}async setStatus(e,t,...r){return this.updateOne(e,{status:t},...r)}async listUserOrgUnits(e,...t){return(await this.listAll(...t)).filter(t=>k(t.user,e))}async listOrgUnitUsers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async removeUserFromOrgUnit(e,...t){await this.deleteById(e,...t)}}class Z extends E{constructor(){super(e.GroupMembership)}async addPrincipalToGroup(e,t,r,a,...i){return this.create({tenant:e,group:t,principal:r,metadata:a},...i)}async listGroupMembers(e,...t){return(await this.listAll(...t)).filter(t=>k(t.group,e))}async listPrincipalGroups(e,...t){return(await this.listAll(...t)).filter(t=>k(t.principal,e))}async removePrincipalFromGroup(e,...t){await this.deleteById(e,...t)}async resolveGroupPrincipalIdsForPrincipal(e,...t){const r=new Y,a=await this.listPrincipalGroups(e,...t);return await Promise.all(a.map(async e=>{const a=q(e.tenant),i=q(e.group);return(await r.getGroupPrincipal(a,i,...t)).id}))}}class J extends E{constructor(){super(e.Permission)}async createPermission(e,...t){return this.create({key:e.key,category:e.category,description:e.description},...t)}async getByKey(e,...t){return(await this.listAll(...t)).find(t=>t.key===e)}async listByCategory(e,...t){return(await this.listAll(...t)).filter(t=>t.category===e)}async updateDescription(e,t,...r){return this.updateOne(e,{description:t},...r)}}class X extends E{constructor(){super(e.Role)}async createRole(e,...t){return this.create({tenant:e.tenantId,key:e.key,name:e.name,description:e.description,metadata:e.metadata},...t)}async getSystemRoleByKey(e,...t){const r=(await this.listAll(...t)).find(t=>!t.tenant&&t.key===e);if(!r)throw Error(`Role "${e}" not found`);return r}async getTenantRoleByKey(e,t,...r){const a=(await this.listAll(...r)).find(r=>K(r.tenant,e)&&r.key===t);if(!a)throw Error(`Role "${t}" not found for tenant ${e}`);return a}async renameRole(e,t,...r){return this.updateOne(e,{name:t},...r)}async updateRoleMetadata(e,t,...r){return this.updateOne(e,{metadata:t},...r)}async listTenantRoles(e,t=!1,...r){return(await this.listAll(...r)).filter(r=>t&&!r.tenant||K(r.tenant,e))}}class ee extends E{constructor(){super(e.RolePermission)}async addPermissionToRole(e,t,...r){return this.create({role:e,permission:t},...r)}async addPermissionKeyToRole(e,t,...r){const a=await(new J).getByKey(t,...r);return this.addPermissionToRole(e,a.id,...r)}async removePermissionFromRole(e,...t){await this.deleteById(e,...t)}async listRolePermissions(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listPermissionRoles(e,...t){return(await this.listAll(...t)).filter(t=>k(t.permission,e))}async replaceRolePermissions(e,t,...r){const a=await this.listRolePermissions(e,...r);return await(async(e,t,...r)=>{for(const a of t)await e.deleteById(a.id,...r)})(this,a,...r),Promise.all(t.map(t=>this.addPermissionToRole(e,t,...r)))}async createRoleWithPermissions(e,t,...r){const a=await(new X).createRole(e,...r);for(const e of t)await this.addPermissionKeyToRole(a.id,e,...r);return a}}class te extends E{constructor(){super(e.RoleAssignment)}async assignRole(e,...t){return this.create({tenant:e.tenantId,principal:e.principalId,role:e.roleId,scopeKind:e.scopeKind,scopeId:e.scopeId,inheritDown:e.inheritDown??!1,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions},...t)}async revokeAssignment(e,...t){await this.deleteById(e,...t)}async listPrincipalAssignments(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listRoleAssignments(e,...t){return(await this.listAll(...t)).filter(t=>k(t.role,e))}async listTenantAssignments(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}async updateAssignmentWindow(e,t,r,...a){return this.updateOne(e,{startsAt:t,expiresAt:r},...a)}}class re extends E{constructor(){super(e.EffectivePermission)}async listForPrincipal(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async listForScope(e,t,r,...a){return(await this.listAll(...a)).filter(a=>K(a.tenant,e)&&a.scopeKind===t&&a.scopeId===r)}async hasPermission(e,t,r,a,i,n,...o){return(await this.listForPrincipal(e,t,...o)).some(e=>!(e.permissionKey!==r||e.scopeKind!==a||e.scopeId!==i||e.startsAt&&n&&e.startsAt>n||e.expiresAt&&n&&e.expiresAt<n))}async deleteForPrincipal(e,t,...r){for(const a of await this.listForPrincipal(e,t,...r))await this.deleteById(a.id,...r)}async deleteForTenant(e,...t){for(const r of(await this.listAll(...t)).filter(t=>K(t.tenant,e)))await this.deleteById(r.id,...t)}async rebuildForPrincipal(t,r,...a){await this.deleteForPrincipal(t,r,...a);const i=new te,n=new ee,o=new J,s=new Z,d=new Y,c=new L,p=new N,l=[],u=await i.listPrincipalAssignments(t,r,...a),_=await s.listPrincipalGroups(r,...a),y=[...u,...(await Promise.all(_.map(async e=>{const r=await d.getGroupPrincipal(q(e.tenant),q(e.group),...a);return i.listPrincipalAssignments(t,r.id,...a)}))).flat()];for(const i of y){const s=await n.listRolePermissions(q(i.role),...a),d=await Promise.all(s.map(async e=>o.findOneBy("id",q(e.permission),...a)));for(const n of d){if(!n)continue;const o=i.scopeKind,s=i.scopeId,d=[];if(o===e.ScopeKind.Tenant)d.push({scopeKind:o,scopeId:t});else if(o===e.ScopeKind.Resource)d.push({scopeKind:o,scopeId:s});else if(o!==e.ScopeKind.OrgUnit||i.inheritDown){if(o===e.ScopeKind.OrgUnit&&i.inheritDown){const e=await c.listDescendants(t,s,...a);d.push(...e.map(e=>({scopeKind:o,scopeId:q(e.descendant)})))}}else d.push({scopeKind:o,scopeId:s});for(const c of d)o===e.ScopeKind.OrgUnit&&i.inheritDown&&c.scopeId!==s&&await p.categoryBlockedForAncestor(t,c.scopeId,s,n.category,...a)||l.push({id:"",tenantId:t,principalId:r,permissionKey:n.key,scopeKind:c.scopeKind,scopeId:c.scopeId,sourceKind:"role_assignment",sourceId:i.id,startsAt:i.startsAt,expiresAt:i.expiresAt})}}return await Promise.all(l.map(e=>this.create({tenant:e.tenantId,principal:e.principalId,permissionKey:e.permissionKey,scopeKind:e.scopeKind,scopeId:e.scopeId,sourceKind:e.sourceKind,sourceId:e.sourceId,startsAt:e.startsAt,expiresAt:e.expiresAt},...a)))}async rebuildForTenant(e,...t){const r=(await(new Y).listAll(...t)).filter(t=>K(t.tenant,e));for(const a of r)await this.rebuildForPrincipal(e,a.id,...t)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForPrincipal",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,Object]),o.__metadata("design:returntype",Promise)],re.prototype,"rebuildForTenant",null);class ae extends E{constructor(){super(e.ProtectedResource)}async registerResource(e,...t){return this.create({tenant:e.tenantId,orgUnit:e.orgUnitId,resourceType:e.resourceType,resourceId:e.resourceId,visibility:e.visibility,owner:e.ownerPrincipalId,sensitivity:e.sensitivity,metadata:e.metadata},...t)}async getByDomainResource(e,t,r,...a){return(await this.listAll(...a)).find(a=>K(a.tenant,e)&&a.resourceType===t&&a.resourceId===r)}async moveResourceToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async setVisibility(e,t,...r){return this.updateOne(e,{visibility:t},...r)}async transferOwnership(e,t,...r){return this.updateOne(e,{owner:t},...r)}async listOrgUnitResources(e,...t){return(await this.listAll(...t)).filter(t=>k(t.orgUnit,e))}async listTenantResources(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}}class ie extends E{constructor(){super(e.ResourceGrant)}async grantResource(e,...t){return this.create({tenant:e.tenantId,resource:e.resourceId,principal:e.principalId,permissionKey:e.permissionKey,startsAt:e.startsAt,expiresAt:e.expiresAt,conditions:e.conditions,createdBy:e.createdByPrincipalId},...t)}async revokeGrant(e,...t){await this.deleteById(e,...t)}async listResourceGrants(e,...t){return(await this.listAll(...t)).filter(t=>k(t.resource,e))}async listPrincipalGrants(e,t,...r){return(await this.listAll(...r)).filter(r=>K(r.tenant,e)&&k(r.principal,t))}async hasGrant(e,t,r,a,i,...n){return(await this.listPrincipalGrants(e,t,...n)).some(e=>k(e.resource,r)&&e.permissionKey===a&&(!e.startsAt||!i||e.startsAt<=i)&&(!e.expiresAt||!i||e.expiresAt>=i))}async deleteAllForResource(e,...t){for(const r of await this.listResourceGrants(e,...t))await this.deleteById(r.id,...t)}}class ne{constructor(){this.tenantService=new z,this.tenantProfileService=new D,this.orgUnitService=new V,this.orgUnitProfileService=new G,this.userService=new W,this.membershipService=new H,this.principalService=new Y,this.permissionService=new J,this.roleService=new X,this.rolePermissionService=new ee,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async bootstrapTenantFromTemplate(t,...r){const a=await this.tenantService.createTenant(t.tenant,...r);t.tenant.profileKey&&await this.tenantProfileService.createProfile(a.id,t.tenant.profileKey,t.tenant.profileMetadata,...r);const i=async(e,t)=>{const n=void 0===e?await this.orgUnitService.createRoot(a.id,t.name,t.metadata,t.profileKey,t.metadata,...r):await this.orgUnitService.createChild({tenantId:a.id,parentOrgUnitId:e,name:t.name,metadata:t.metadata,profileKey:t.profileKey,profileMetadata:t.metadata},...r);for(const e of t.children??[])await i(n.id,e);return n},n=await i(void 0,t.rootOrgUnit),o=await this.userService.createUser(t.ownerUser,...r);await this.membershipService.addUserToTenant(a.id,o.id,e.MembershipStatus.Active,...r);const s=await this.principalService.getUserPrincipal(a.id,o.id,...r);for(const e of t.permissions)await this.permissionService.createPermission(e,...r);for(const e of t.roles){const t=await this.roleService.createRole({tenantId:a.id,key:e.key,name:e.name,description:e.description},...r);for(const a of e.permissionKeys)await this.rolePermissionService.addPermissionKeyToRole(t.id,a,...r)}const d=await this.roleService.getTenantRoleByKey(a.id,t.ownerRoleKey,...r);return await this.roleAssignmentService.assignRole({tenantId:a.id,principalId:s.id,roleId:d.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:n.id,inheritDown:!0},...r),await this.effectivePermissionService.rebuildForPrincipal(a.id,s.id,...r),{tenantId:a.id,rootOrgUnitId:n.id,ownerUserId:o.id,ownerPrincipalId:s.id}}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[Object,Object]),o.__metadata("design:returntype",Promise)],ne.prototype,"bootstrapTenantFromTemplate",null);class oe{constructor(){this.membershipService=new H,this.orgMembershipService=new Q,this.principalService=new Y,this.roleService=new X,this.roleAssignmentService=new te,this.effectivePermissionService=new re}async onboardUserToTenantAndOrgUnit(t,r,a,i,...n){await this.membershipService.addUserToTenant(t,r,e.MembershipStatus.Active,...n),await this.orgMembershipService.addUserToOrgUnit(t,a,r,e.MembershipStatus.Active,...n);const o=await this.principalService.getUserPrincipal(t,r,...n),s=await this.roleService.getTenantRoleByKey(t,i,...n);return await this.roleAssignmentService.assignRole({tenantId:t,principalId:o.id,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:!0},...n),await this.effectivePermissionService.rebuildForPrincipal(t,o.id,...n),{principalId:o.id}}async changeUserOrgRole(t,r,a,i,n,...o){const s=await this.roleService.getTenantRoleByKey(t,i,...o),d=await this.roleAssignmentService.listPrincipalAssignments(t,r,...o);for(const t of d.filter(t=>t.scopeKind===e.ScopeKind.OrgUnit&&t.scopeId===a))await this.roleAssignmentService.revokeAssignment(t.id,...o);await this.roleAssignmentService.assignRole({tenantId:t,principalId:r,roleId:s.id,scopeKind:e.ScopeKind.OrgUnit,scopeId:a,inheritDown:n},...o),await this.effectivePermissionService.rebuildForPrincipal(t,r,...o)}async suspendUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Suspended,...i),await this.effectivePermissionService.deleteForPrincipal(r,a,...i)}async reactivateUserInTenant(t,r,a,...i){await this.membershipService.setStatus(t,e.MembershipStatus.Active,...i),await this.effectivePermissionService.rebuildForPrincipal(r,a,...i)}}o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"onboardUserToTenantAndOrgUnit",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,String,Boolean,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"changeUserOrgRole",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"suspendUserInTenant",null),o.__decorate([i.transactional(),o.__metadata("design:type",Function),o.__metadata("design:paramtypes",[String,String,String,Object]),o.__metadata("design:returntype",Promise)],oe.prototype,"reactivateUserInTenant",null);const se="featureFlag",de="feature-flags:model",ce="feature-flags:auth",pe="feature-flags:block",le="feature-flags:render-if",ue="feature-flags:hide-on";function _e(e){const t=e.trim();if(!t)return t;if(/^[a-z][a-zA-Z0-9]*$/.test(t))return t;const r=t.toLowerCase().replace(/[_\-\s]+/g," ").split(" ").filter(Boolean);if(0===r.length)return t;const[a,...i]=r;return[a,...i.map(e=>e?e.charAt(0).toUpperCase()+e.slice(1):e)].join("").replace(/[^a-zA-Z0-9]/g,"")}function ye(e){if("string"!=typeof e)return e;const t=e.trim();if("true"===t)return!0;if("false"===t)return!1;if(/^-?\d+(\.\d+)?$/.test(t))return Number(t);if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch{return e}return e}function ge(e){if(void 0===e)return;if(!0===e)return!0;if(!e||"object"!=typeof e||Array.isArray(e))return ye(e);const t={};return Object.entries(e).forEach(([e,r])=>{const a=(e=>{if(!e)return e;if(/^[a-z][a-zA-Z0-9]*$/.test(e))return e;const t=e.replace(/[\s-]+/g,"_").split("_").filter(Boolean);if(0===t.length)return e;const[r,...a]=t;return[r.toLowerCase(),...a.map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase())].join("")})(e);void 0!==r&&(t[a]=ge(r)??r)}),t}function me(e){return!e||"object"!=typeof e||Array.isArray(e)?{}:Object.entries(e).reduce((e,[t,r])=>{const a=_e(t),i=ge(r);return void 0!==i&&(e[a]=i),e},{})}function he(e){return!0===e||!!e&&"object"==typeof e}function fe(e,t){return he(e?.[_e(t)])}function ve(e,t="any"){return{features:[...new Set(e.map(_e).filter(Boolean))],match:t}}function be(e,t){if(!e||0===e.features.length)return!0;const r=e.features.filter(e=>fe(t,e));return"all"===e.match?r.length===e.features.length:r.length>0}function Se(e,t){return!(!e||0===e.features.length)&&e.features.some(e=>fe(t,e))}function Oe(e,t){return s.Metadata.get(e,t)}function Ae(e){return e.trim().toLowerCase()}function we(e){return e.trim()}const Pe=r.LoggedEnvironment.accumulate({[se]:{}});async function Te(e=Pe){return me(e.featureFlag)}async function Fe(e,t=Pe){return(await Te(t))[_e(e)]}e.FeatureFlag=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"id",void 0),o.__decorate([i.unique(),n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"key",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlag.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"description",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"scope",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlag.prototype,"config",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlag.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlag.prototype,"updatedAt",void 0),e.FeatureFlag=o.__decorate([i.table("feature_flags"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlag),e.FeatureFlagAccess=class extends i.BaseModel{constructor(e){super(e),this.enabled=!0}},o.__decorate([i.pk(),i.uuid(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"id",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"featureKey",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectType",void 0),o.__decorate([n.required(),i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"subjectKey",void 0),o.__decorate([i.column(),o.__metadata("design:type",Boolean)],e.FeatureFlagAccess.prototype,"enabled",void 0),o.__decorate([i.column(),o.__metadata("design:type",Object)],e.FeatureFlagAccess.prototype,"metadata",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"createdBy",void 0),o.__decorate([i.column(),o.__metadata("design:type",String)],e.FeatureFlagAccess.prototype,"updatedBy",void 0),o.__decorate([i.createdAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"createdAt",void 0),o.__decorate([i.updatedAt(),o.__metadata("design:type",Date)],e.FeatureFlagAccess.prototype,"updatedAt",void 0),e.FeatureFlagAccess=o.__decorate([i.table("feature_flag_access"),n.model(),o.__metadata("design:paramtypes",[Object])],e.FeatureFlagAccess);class Ue{async readOne(e,t){return(await this.read(t))[_e(e)]}}class Re extends Ue{async read(e={}){return Te(e.source??{[se]:{}})}}function Ie(e,t){return void 0===t?e:s.Metadata.key(e,t.toString())}function je(e,t,r="any"){const a=ve(t,r);return(t,r,i)=>{if(void 0===r)return s.metadata(e,a)(t);const n=Ie(e,r);return i?s.methodMetadata(n,a)(t,r,i):s.propMetadata(n,a)(t,r)}}function Ke(e,t,r){return Oe(e,Ie(t,r))}e.FeatureFlagService=class extends i.ModelService{constructor(){super(e.FeatureFlag),this.reader=new Re,this.cachedRegistry={}}async initialize(...e){const t=e[0]??{};t.repository&&(this._repository=t.repository),this.reader=t.reader?"function"==typeof t.reader?new t.reader:t.reader:new Re;const r={...t.readerConfig??{},source:t.readerConfig?.source??Pe};return this.cachedRegistry=await this.refreshCachedRegistry(r,...e),{config:{...t,reader:this.reader,readerConfig:r},client:this.reader}}cloneRegistry(e){return Object.entries(e).reduce((e,[t,r])=>(e[t]=r&&"object"==typeof r&&!Array.isArray(r)?{...r}:r,e),{})}async refreshCachedRegistry(e={},...t){const r=await this.reader.read({...e,source:e.source??Pe});let a=[];try{a=await this.repo.select().execute(...t)}catch{a=[]}const i=this.cloneRegistry(r);for(const e of a)i[e.key]=!!e.enabled&&(e.config??!0);return i}setCachedFlag(e){this.cachedRegistry[e.key]=!!e.enabled&&(e.config??!0)}getAccessRepository(){return this.accessRepository??i.Repository.forModel(e.FeatureFlagAccess)}assertInitialized(){this.reader}normalizeFeatureAccessInput(e){return{...e,featureKey:_e(e.featureKey),subjectType:Ae(e.subjectType),subjectKey:we(e.subjectKey)}}buildAccessCondition(e){let t=i.Condition.attr("subjectType").eq(Ae(e.subjectType));return t=t.and(i.Condition.attr("subjectKey").eq(we(e.subjectKey))),void 0!==e.enabled&&(t=t.and(i.Condition.attr("enabled").eq(e.enabled))),e.featureKeys&&e.featureKeys.length>0&&(t=t.and(i.Condition.attr("featureKey").in(e.featureKeys.map(_e)))),t}async create(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.create(e,...t);return this.setCachedFlag(r),r}async update(e,...t){e.key=_e(e.key),e.enabled??=!0;const r=await super.update(e,...t);return this.setCachedFlag(r),r}async findOneBy(e,t,...r){const a="key"===e&&"string"==typeof t?_e(t):t;return this.repo.findOneBy(e,a,...r)}async readAll(e,...t){const r=await this.repo.readAll(e,...t);for(const e of r)this.setCachedFlag(e);return r}async listEnabled(...e){return this.repo.select().where(i.Condition.attr("enabled").eq(!0)).execute(...e)}async grantFeatureAccess(t,...r){const a=this.normalizeFeatureAccessInput(t),i=await this.findFeatureAccess(a,...r).catch(()=>{});return i?this.getAccessRepository().update(Object.assign(i,a),...r):this.getAccessRepository().create(new e.FeatureFlagAccess(a),...r)}async revokeFeatureAccess(e,...t){const r=await this.findFeatureAccess(e,...t).catch(()=>{});if(r)return this.getAccessRepository().delete(r.id,...t)}async findFeatureAccess(e,...t){const r=this.buildAccessCondition(e),i=(await this.getAccessRepository().select().where(r).execute(...t))[0];if(!i)throw new a.NotFoundError(`Feature access for ${Ae(e.subjectType)}:${we(e.subjectKey)} not found`);return i}async listFeatureAccess(e,...t){return this.getAccessRepository().select().where(this.buildAccessCondition(e)).execute(...t)}async resolveFeatureFlagsForSubject(e,...t){this.assertInitialized();const r=await this.listFeatureAccess({...e,enabled:!0},...t),a=[...new Set(r.map(e=>e.featureKey))];if(0===a.length)return{};const n=i.Condition.attr("enabled").eq(!0).and(i.Condition.attr("key").in(a.map(_e)));return(await this.repo.select().where(n).execute(...t)).reduce((e,t)=>(e[t.key]=t.config??!0,e),{})}async isEnabledForSubject(e,t,...r){return fe(await this.resolveFeatureFlagsForSubject(t,...r),e)}isEnabled(e){this.assertInitialized();const t=_e(e);return fe(this.cachedRegistry,t)}async resolveFeatureFlags(){return this.assertInitialized(),this.cloneRegistry(this.cachedRegistry)}async syncFromEnvironment(t={},...r){this.assertInitialized();const a=await this.reader.read({...t,source:t.source??Pe}),i=[];for(const[t,n]of Object.entries(a)){const a=n&&"object"==typeof n&&!Array.isArray(n)?n:{enabled:!!n},{enabled:o,...s}=a,d=_e(t),c=await this.findOneBy("key",d,...r).catch(()=>{}),p=c?Object.assign(c,{enabled:he(n),description:s.description??c.description,scope:s.scope??c.scope,metadata:s.metadata??c.metadata,config:{...s,enabled:he(n)}}):new e.FeatureFlag({key:d,enabled:he(n),description:s.description,scope:s.scope,metadata:s.metadata,config:{...s,enabled:he(n)}});i.push(c?await this.update(p,...r):await this.create(p,...r))}return this.cachedRegistry=await this.refreshCachedRegistry({...t,source:t.source??Pe},...r),i}},o.__decorate([i.repository(e.FeatureFlagAccess),o.__metadata("design:type",Object)],e.FeatureFlagService.prototype,"accessRepository",void 0),e.FeatureFlagService=o.__decorate([i.service(e.FeatureFlag),o.__metadata("design:paramtypes",[])],e.FeatureFlagService),Object.defineProperty(e,"AuthorizationError",{enumerable:!0,get:()=>i.AuthorizationError}),Object.defineProperty(e,"transactional",{enumerable:!0,get:()=>i.transactional}),e.AuthorizationModel=x,e.AuthzService=class{constructor(e={}){this.dataSources=e}async canAccess(t,...r){const a=t.at??new Date;if(t.scopeKind&&t.scopeId)return j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,t.scopeKind,t.scopeId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt));if(!t.resourceProtectedId)return!1;const i=await(this.dataSources.loadResource?.(t.tenantId,t.resourceProtectedId));if(!i)return!1;if(i.tenantId!==t.tenantId)return!1;if(i.ownerPrincipalId===t.principalId)return!0;if(j(await(this.dataSources.listResourceGrants?.(t.tenantId,t.resourceProtectedId))).filter(e=>e.principalId===t.principalId&&e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)).length>0)return!0;const n=i.visibility;return n!==e.ResourceVisibility.Private&&n!==e.ResourceVisibility.ResourceAcl&&(n===e.ResourceVisibility.OrgUnit||n===e.ResourceVisibility.OrgSubtree?j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.OrgUnit,i.orgUnitId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)):n===e.ResourceVisibility.Tenant&&j(await(this.dataSources.listEffectivePermissionsForScope?.(t.tenantId,e.ScopeKind.Tenant,t.tenantId))).some(e=>e.permissionKey===t.permissionKey&&C(a,e.startsAt,e.expiresAt)))}async requireAccess(t,...r){if(!await this.canAccess(t,...r))throw new i.AuthorizationError(`Access denied for ${t.permissionKey} on ${t.resourceProtectedId??(a=t.scopeKind??e.ScopeKind.Resource,n=t.scopeId??"",`${a}:${n}`)}`);var a,n}async buildAccessContext(e,t,...r){return M({tenantId:e,principalId:t,permissions:j(await(this.dataSources.listEffectivePermissions?.(e,t))),grants:j(await(this.dataSources.listPrincipalGrants?.(e,t)))})}async buildArangoContext(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a),n=i.allowedOrgUnitIdsByPermission[r]??[],o=i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId);return U({tenantId:e,principalId:t,permissionKey:r,allowedOrgUnitIds:n,allowedResourceIds:o})}async buildQdrantFilter(e,t,r,...a){const i=await this.buildAccessContext(e,t,...a);return R({tenantId:e,principalId:t,allowedOrgUnitIds:i.allowedOrgUnitIdsByPermission[r]??[],allowedResourceIds:i.resourceGrants.filter(e=>e.permissionKey===r).map(e=>e.resourceId)})}},e.BaseModelService=E,e.BootstrapService=ne,e.COMMIT="5c2d10c",e.EffectivePermissionService=re,e.EnvironmeFlagReader=Re,e.FEATURE_FLAG_AUTH_KEY=ce,e.FEATURE_FLAG_BLOCK_KEY=pe,e.FEATURE_FLAG_ENV_PREFIX="FEATURE_FLAG",e.FEATURE_FLAG_ENV_ROOT=se,e.FEATURE_FLAG_HIDE_KEY=ue,e.FEATURE_FLAG_MODEL_KEY=de,e.FEATURE_FLAG_RENDER_KEY=le,e.FULL_VERSION="0.6.0-5c2d10c",e.FeatureFlagEnvironment=Pe,e.FeatureFlagReader=Ue,e.GroupMembershipService=Z,e.GroupService=class extends E{constructor(){super(e.Group)}async createGroup(e,t,r,a,...i){return this.create({tenant:e,orgUnit:r,name:t,metadata:a},...i)}async renameGroup(e,t,...r){return this.updateOne(e,{name:t},...r)}async moveGroupToOrgUnit(e,t,...r){return this.updateOne(e,{orgUnit:t},...r)}async listTenantGroups(e,...t){return(await this.listAll(...t)).filter(t=>K(t.tenant,e))}},e.InheritanceBlockService=N,e.IsolationTierOptions=m,e.MembershipStatusOptions=h,e.OrgUnitClosureService=L,e.OrgUnitMembershipService=Q,e.OrgUnitProfileService=G,e.OrgUnitService=V,e.PACKAGE_NAME="@decaf-ts/integrations",e.PermissionCategoryOptions=b,e.PermissionService=J,e.PrincipalKindOptions=f,e.PrincipalService=Y,e.ProtectedResourceService=ae,e.REL_CASCADE_DEPENDENT=T,e.REL_CASCADE_INSERT_UPDATE=F,e.REL_NULLIFY=P,e.REL_RESTRICT=w,e.ResourceGrantService=ie,e.ResourceLifecycleService=class{async unregisterResource(e,...t){await(new ie).deleteAllForResource(e,...t),await(new ae).deleteById(e,...t)}async resolveResourceScope(e,...t){const r=await(new ae).getById(e,...t);return{tenantId:q(r.tenant),orgUnitId:q(r.orgUnit),visibility:r.visibility,ownerPrincipalId:r.owner?q(r.owner):void 0}}},e.ResourceVisibilityOptions=S,e.RoleAssignmentService=te,e.RolePermissionService=ee,e.RoleService=X,e.ScopeKindOptions=v,e.StorageBindingKindOptions=A,e.StorageBindingService=class extends E{constructor(){super(e.StorageBinding)}async createBinding(e,...t){return this.create({tenant:e.tenantId,storageKind:e.storageKind,bindingKind:e.bindingKind,bindingKey:e.bindingKey,region:e.region,config:e.config},...t)}async listTenantBindings(e,...t){return(await this.listAll(...t)).filter(t=>q(t.tenant)===e)}async getBinding(e,t,...r){return(await this.listTenantBindings(e,...r)).find(e=>e.storageKind===t)}async setBindingConfig(e,t,...r){return this.updateOne(e,{config:t},...r)}async promoteToDedicated(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Dedicated,bindingKey:r,region:a,config:i},...n)}async setShared(t,r,a,i,...n){return this.updateOne(t,{bindingKind:e.StorageBindingKind.Shared,bindingKey:r,region:a,config:i},...n)}},e.StorageKindOptions=O,e.SystemManagementService=oe,e.TenantMembershipService=H,e.TenantProfileService=D,e.TenantService=z,e.UserService=W,e.VERSION="0.6.0",e.asArray=j,e.blockFeatureOperations=(...e)=>je(pe,e),e.buildAccessContext=M,e.buildArangoContext=U,e.buildQdrantFilter=R,e.execWithLogging=async(e,i,n,o=r.LogLevel.info)=>(n.debug("Executing: "+e),new Promise((r,s)=>{const d=t.exec(e,i),c=[],p=[];d.stdout?.on("data",e=>{c.push(e),n[o](e.trim())}),d.stderr?.on("data",e=>{p.push(e),n.debug(e.trim())}),d.on("close",e=>{0===e?(n.silly("Command completed successfully"),r({stdout:c.join("\n"),stderr:p.join("\n")})):(n.critical(`Command failed with code ${e}:\n ${p.join("\n")}`),s(new a.InternalError(`Command failed with code ${e}: ${p.join("\n")}`)))}),d.on("error",e=>{n.critical("Command execution error",e),s(e)})})),e.featureAuth=(...e)=>je(ce,e),e.featureFlags=(...e)=>je(de,e),e.getFeatureGateMetadata=Ke,e.hasFeatureFlagInEnvironment=async(e,t=Pe)=>!!await Fe(e,t),e.hideOnFeature=(...e)=>je(ue,e),e.id=()=>crypto.randomUUID(),e.isFeatureFlagEnabled=he,e.isFeatureFlagEnabledByName=fe,e.isFeatureRuleBlocked=Se,e.isFeatureRuleSatisfied=be,e.isTimeValid=C,e.loadFeatureFlagsFromEnvironment=Te,e.lowerSlug=B,e.normalizeFeatureConfig=ge,e.normalizeFeatureName=_e,e.normalizeFeatureRegistry=me,e.normalizeFeatureRule=ve,e.normalizeFeatureSubjectKey=we,e.normalizeFeatureSubjectType=Ae,e.nowIso=()=>new Date,e.parseRuntimeValue=ye,e.readMetadata=Oe,e.relationId=q,e.relationMatch=k,e.renderIfFeature=(...e)=>je(le,e),e.resolveFeatureFlagFromEnvironment=Fe,e.sameTenant=K,e.shouldExposeForFeatures=(e,t,r,a)=>be(Ke(e,r,a),t),e.shouldHideForFeatures=(e,t,r,a)=>Se(Ke(e,r,a),t)},"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators"),require("@decaf-ts/core"),require("@decaf-ts/decorator-validation"),require("tslib"),require("@decaf-ts/decoration")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators","@decaf-ts/core","@decaf-ts/decorator-validation","tslib","@decaf-ts/decoration"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators,e.decafTsCore,e.decafTsDecoratorValidation,e.tslib,e.decafTsDecoration);
2
2
  //# sourceMappingURL=integrations.cjs.map
package/lib/cjs/index.cjs CHANGED
@@ -23,9 +23,9 @@ exports.PACKAGE_NAME = exports.FULL_VERSION = exports.COMMIT = exports.VERSION =
23
23
  __exportStar(require("./utils.cjs"), exports);
24
24
  __exportStar(require("./namespaces/index.cjs"), exports);
25
25
  __exportStar(require("./feature-flags/index.cjs"), exports);
26
- exports.VERSION = "0.5.1";
27
- exports.COMMIT = "7d93597";
28
- exports.FULL_VERSION = "0.5.1-7d93597";
26
+ exports.VERSION = "0.6.0";
27
+ exports.COMMIT = "5c2d10c";
28
+ exports.FULL_VERSION = "0.6.0-5c2d10c";
29
29
  exports.PACKAGE_NAME = "@decaf-ts/integrations";
30
30
  //# sourceMappingURL=index.js.map
31
31
  //# sourceMappingURL=index.cjs.map
package/lib/esm/index.js CHANGED
@@ -6,8 +6,8 @@
6
6
  export * from "./utils.js";
7
7
  export * from "./namespaces/index.js";
8
8
  export * from "./feature-flags/index.js";
9
- export const VERSION = "0.5.1";
10
- export const COMMIT = "7d93597";
11
- export const FULL_VERSION = "0.5.1-7d93597";
9
+ export const VERSION = "0.6.0";
10
+ export const COMMIT = "5c2d10c";
11
+ export const FULL_VERSION = "0.6.0-5c2d10c";
12
12
  export const PACKAGE_NAME = "@decaf-ts/integrations";
13
13
  //# sourceMappingURL=index.js.map
package/lib/types/index.d.cts CHANGED
@@ -7,6 +7,6 @@ export * from "./utils.d.cts";
7
7
  export * from "./namespaces/index.d.cts";
8
8
  export * from "./feature-flags/index.d.cts";
9
9
  export declare const VERSION: string;
10
- export declare const COMMIT = "7d93597";
11
- export declare const FULL_VERSION = "0.5.1-7d93597";
10
+ export declare const COMMIT = "5c2d10c";
11
+ export declare const FULL_VERSION = "0.6.0-5c2d10c";
12
12
  export declare const PACKAGE_NAME: string;
package/lib/types/index.d.mts CHANGED
@@ -7,6 +7,6 @@ export * from "./utils.d.mts";
7
7
  export * from "./namespaces/index.d.mts";
8
8
  export * from "./feature-flags/index.d.mts";
9
9
  export declare const VERSION: string;
10
- export declare const COMMIT = "7d93597";
11
- export declare const FULL_VERSION = "0.5.1-7d93597";
10
+ export declare const COMMIT = "5c2d10c";
11
+ export declare const FULL_VERSION = "0.6.0-5c2d10c";
12
12
  export declare const PACKAGE_NAME: string;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@decaf-ts/integrations",
3
- "version": "0.6.0",
3
+ "version": "0.6.1",
4
4
  "type": "module",
5
5
  "main": "lib/index.js",
6
6
  "types": "lib/index.d.mts",
@@ -400,8 +400,12 @@
400
400
  }
401
401
  },
402
402
  "overrides": {
403
- "js-yaml": "^4.2.0",
404
- "multer": "^2.1.2"
403
+ "multer": "^2.1.2",
404
+ "test-exclude": "^7.0.2",
405
+ "brace-expansion": "^5.0.8",
406
+ "fast-uri": "^3.1.4",
407
+ "fast-xml-parser": "^5.10.1",
408
+ "js-yaml": "^5.2.1"
405
409
  },
406
410
  "optionalDependencies": {
407
411
  "@aws-sdk/client-s3": "^3.1075.0",
@@ -412,7 +416,7 @@
412
416
  "@azure/storage-blob": "^12.33.0",
413
417
  "@google-cloud/secret-manager": "^5.6.0",
414
418
  "@google-cloud/storage": "^7.21.0",
415
- "aws-sdk": "^2.1691.0",
419
+ "aws-sdk": "^2.1693.0",
416
420
  "hashicorp-vault": "^0.1.0",
417
421
  "keycloak-admin": "^24.0.5",
418
422
  "kubo-rpc-client": "^7.1.0",