@acorex-platform/module-security-management-client 0.0.15 → 0.0.21

package/fesm2022/acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-jSDkyMMZ.mjs

@@ -0,0 +1,2088 @@
+import * as i0 from '@angular/core';
+import { Injectable, NgModule, inject, signal, input, computed, output, ChangeDetectionStrategy, ViewEncapsulation, Component, effect, untracked } from '@angular/core';
+import { AXPSessionService, AXP_PERMISSION_DEFINITION_PROVIDER, AXPPermissionDefinitionService } from '@acorex-platform/framework-client/auth';
+import { AXPSearchCommandProvider, createEntitySearchCommand, AXP_MENU_PROVIDER, AXP_SEARCH_PROVIDER, AXP_STATUS_PROVIDERS, AXPSettingsService, AXPCommonSettings } from '@acorex-platform/framework-client/common';
+import { AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, AXP_MODULE_MANIFEST_PROVIDER, AXP_FEATURE_DEFINITION_PROVIDER, AXP_CONTEXT_DEFINITION_PROVIDER, provideLazyProvider, setupPopupFooterKeyboardShortcuts, AXPEntityBroadcastService } from '@acorex-platform/framework-client/core';
+import { AXP_PAGE_COMPONENT_PROVIDER, AXPStateMessageComponent } from '@acorex-platform/framework-client/layout/components';
+import { provideCommandSetups, AXPCommandService } from '@acorex-platform/framework-client/runtime';
+import { AXM_SECURITY_CONTEXT_DEFINITIONS } from '@acorex-platform/module-security-management-contracts';
+import { RootConfig, AXPSecurityManagementFeatureKeys, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXMUserAccessState, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXMUserEffectiveState, AXPSecurityManagementMenuKeys, AXPAdministrationPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY } from '@acorex-platform/module-security-management-client/contracts';
+import { AXPWidgetsList, AXPStatusProvider, AXPSystemStatusType } from '@acorex-platform/framework-shared/core';
+import { AXPWidgetCoreModule, AXP_WIDGET_DEFINITION_PROVIDER, AXPValueWidgetComponent, AXPColumnWidgetComponent } from '@acorex-platform/framework-client/layout/widget-core';
+import { AXPWidgetGroupEnum } from '@acorex-platform/framework-shared/widget-core';
+import { AXP_NAME_PROPERTY, AXP_DATA_PATH_PROPERTY, AXP_DISABLED_PROPERTY } from '@acorex-platform/framework-client/layout/widgets';
+import { AXPCommonMenuKeys, AXPCommonPermissionGroupKeys } from '@acorex-platform/module-common-client/contracts';
+import { AXPEntityService, AXPEntityDefinitionRegistryService, dispatchEntityModifiedSideEffects } from '@acorex-platform/framework-client/layout/entity';
+import * as i1 from '@angular/common';
+import { CommonModule } from '@angular/common';
+import { AXBasePageComponent } from '@acorex/components/page';
+import { AXFormModule } from '@acorex/components/form';
+import * as i4 from '@acorex/components/button';
+import { AXButtonModule } from '@acorex/components/button';
+import { AXTextBoxModule } from '@acorex/components/text-box';
+import * as i6 from '@acorex/components/check-box';
+import { AXCheckBoxModule } from '@acorex/components/check-box';
+import * as i5 from '@acorex/components/label';
+import { AXLabelModule } from '@acorex/components/label';
+import * as i8 from '@acorex/components/decorators';
+import { AXDecoratorModule } from '@acorex/components/decorators';
+import * as i12 from '@acorex/core/translation';
+import { AXTranslationService, AXTranslationModule, resolveMultiLanguageString } from '@acorex/core/translation';
+import * as i7 from '@acorex/components/tabs';
+import { AXTabsModule } from '@acorex/components/tabs';
+import * as i9 from '@acorex/components/badge';
+import { AXBadgeModule } from '@acorex/components/badge';
+import * as i2 from '@angular/forms';
+import { FormsModule } from '@angular/forms';
+import * as i3 from '@acorex/cdk/common';
+import { AXCommonModule } from '@acorex/cdk/common';
+import { AXTooltipModule } from '@acorex/components/tooltip';
+import * as i10 from '@acorex/components/skeleton';
+import { AXSkeletonModule } from '@acorex/components/skeleton';
+import * as i11 from '@acorex/components/search-box';
+import { AXSearchBoxModule } from '@acorex/components/search-box';
+import { isEmpty, trim, isString, isArray, isEqual, castArray } from 'lodash-es';
+import { AXPopupService } from '@acorex/components/popup';
+import { AXToastService } from '@acorex/components/toast';
+import { AXPPageLayoutBaseComponent, AXPPageLayoutBase } from '@acorex-platform/framework-client/layout/views';
+import * as i1$1 from '@acorex/components/loading';
+import { AXLoadingModule } from '@acorex/components/loading';
+
+//#region ---- Device Sessions Service ----
+/**
+ * Terminates device sessions for the current or specified session.
+ * Implementations are provided by connectivity layers (e.g. mock or API).
+ */
+class AXMDeviceSessionsService {
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMDeviceSessionsService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMDeviceSessionsService }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMDeviceSessionsService, decorators: [{
+            type: Injectable
+        }] });
+
+//#region ---- User context definitions ----
+class AXMSecurityManagementContextDefinitionProvider {
+    async items() {
+        return AXM_SECURITY_CONTEXT_DEFINITIONS;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementContextDefinitionProvider, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementContextDefinitionProvider }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementContextDefinitionProvider, decorators: [{
+            type: Injectable
+        }] });
+
+//#region ----   Imports   ----
+//#endregion
+//#region ----   Feature Definition Provider   ----
+/**
+ * Security Management Module Feature Definition Provider.
+ * Provides feature definitions for the Security Management module.
+ */
+class AXMSecurityManagementFeatureDefinitionProvider {
+    async provide(context) {
+        const i18n = RootConfig.config.i18n;
+        // Manage Roles feature
+        context.addFeature(AXPSecurityManagementFeatureKeys.ManageRoles, {
+            title: `@${i18n}:features.manage-roles.title`,
+            description: `@${i18n}:features.manage-roles.description`,
+            defaultValue: true,
+            type: 'boolean',
+        });
+        // Manage Users feature
+        context.addFeature(AXPSecurityManagementFeatureKeys.ManageUsers, {
+            title: `@${i18n}:features.manage-users.title`,
+            description: `@${i18n}:features.manage-users.description`,
+            defaultValue: true,
+            type: 'boolean',
+        });
+        // Max Total Users feature (widget configuration)
+        context.addFeature(AXPSecurityManagementFeatureKeys.MaxTotalUsers, {
+            title: `@${i18n}:features.max-total-users.title`,
+            description: `@${i18n}:features.max-total-users.description`,
+            defaultValue: 100,
+            type: 'number',
+            interface: {
+                type: AXPWidgetsList.Editors.NumberBox,
+                options: {
+                    placeholder: `@${i18n}:features.max-total-users.title`,
+                    min: 1,
+                    max: 10000,
+                    step: 1,
+                },
+            },
+        });
+        // Manage Sessions feature
+        context.addFeature(AXPSecurityManagementFeatureKeys.ManageSessions, {
+            title: `@${i18n}:features.manage-sessions.title`,
+            description: `@${i18n}:features.manage-sessions.description`,
+            defaultValue: true,
+            type: 'boolean',
+        });
+        // Manage Policies feature
+        context.addFeature(AXPSecurityManagementFeatureKeys.ManagePolicies, {
+            title: `@${i18n}:features.manage-policies.title`,
+            description: `@${i18n}:features.manage-policies.description`,
+            defaultValue: true,
+            type: 'boolean',
+        });
+        // Identity Providers — platform-tenant management only (edition feature on Platform Console)
+        context.addFeature(AXPSecurityManagementFeatureKeys.ManageIdentityProviders, {
+            title: `@${i18n}:features.manage-identity-providers.title`,
+            description: `@${i18n}:features.manage-identity-providers.description`,
+            defaultValue: false,
+            type: 'boolean',
+        });
+    }
+}
+//#endregion
+
+const AXPPermissionsWidget = {
+    name: "permissions-editor",
+    title: "Permissions Editor",
+    description: 'Widget for managing permissions with full editor interface',
+    type: 'view',
+    categories: [],
+    groups: [AXPWidgetGroupEnum.EntityWidget],
+    icon: "fa-light fa-user-shield",
+    properties: [
+        AXP_NAME_PROPERTY,
+        AXP_DATA_PATH_PROPERTY,
+        AXP_DISABLED_PROPERTY,
+    ],
+    components: {
+        view: {
+            component: () => Promise.resolve().then(function () { return permissionsWidgetView_component; }).then((c) => c.AXPPermissionsWidgetViewComponent),
+        },
+        edit: {
+            component: () => Promise.resolve().then(function () { return permissionsWidgetEdit_component; }).then((c) => c.AXPPermissionsWidgetEditComponent),
+        },
+        column: {
+            component: () => Promise.resolve().then(function () { return permissionsWidgetColumn_component; }).then((c) => c.AXPPermissionsWidgetColumnComponent),
+        },
+    }
+};
+
+//#endregion
+//#region ----   Permissions Widgets Provider   ----
+const WIDGETS = [AXPPermissionsWidget];
+class AXPPermissionsWidgetsProvider {
+    getWidgets() {
+        return WIDGETS;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetsProvider, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetsProvider }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetsProvider, decorators: [{
+            type: Injectable
+        }] });
+
+class AXMPermissionsModule {
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionsModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule }); }
+    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionsModule, imports: [AXPWidgetCoreModule] }); }
+    static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionsModule, providers: [
+            { provide: AXP_WIDGET_DEFINITION_PROVIDER, useClass: AXPPermissionsWidgetsProvider, multi: true },
+            provideCommandSetups([
+                {
+                    key: 'assign-permissions',
+                    command: () => Promise.resolve().then(function () { return assignPermissions_command; }).then((c) => c.AXMAssignPermissionsCommand),
+                },
+            ]),
+        ], imports: [AXPWidgetCoreModule] }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionsModule, decorators: [{
+            type: NgModule,
+            args: [{
+                    imports: [
+                        AXPWidgetCoreModule,
+                    ],
+                    providers: [
+                        { provide: AXP_WIDGET_DEFINITION_PROVIDER, useClass: AXPPermissionsWidgetsProvider, multi: true },
+                        provideCommandSetups([
+                            {
+                                key: 'assign-permissions',
+                                command: () => Promise.resolve().then(function () { return assignPermissions_command; }).then((c) => c.AXMAssignPermissionsCommand),
+                            },
+                        ]),
+                    ],
+                }]
+        }] });
+
+class AXMSecurityManagementEvaluatorScopeProvider {
+    constructor() {
+        this.sessionService = inject(AXPSessionService);
+    }
+    async provide(context) {
+        context.addScope('session', {
+            currentUser: () => {
+                return this.sessionService.user;
+            },
+            user: () => {
+                return this.sessionService.user;
+            },
+            currentApplication: () => {
+                return this.sessionService.application;
+            },
+            currentTenant: () => {
+                return this.sessionService.tenant;
+            },
+            currentPermissions: () => {
+                return this.sessionService.permissions;
+            },
+        });
+    }
+}
+
+//#region ---- Imports ----
+//#endregion
+//#region ---- User access state provider ----
+/**
+ * Sign-in readiness from the authentication subsystem (distinct from account lifecycle / `accountState`).
+ * Transitions listed here are the only paths offered in the status UI and validated when executing a status change command.
+ */
+class AXMUserAccessStateProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = AXM_USER_ACCESS_STATE_DEFINITION_KEY;
+        this.defaultStatus = AXMUserAccessState.Allowed;
+        this.statuses = [
+            {
+                name: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.states.allowed',
+                description: '@security-management:users.entities.user.access.descriptions.allowed',
+                icon: 'fa-light fa-circle-check',
+                color: 'success',
+                order: 1,
+                isInitial: true,
+                isFinal: false,
+            },
+            {
+                name: AXMUserAccessState.Blocked,
+                title: '@security-management:users.entities.user.access.states.blocked',
+                description: '@security-management:users.entities.user.access.descriptions.blocked',
+                icon: 'fa-light fa-ban',
+                color: 'danger',
+                order: 2,
+                isInitial: false,
+                isFinal: false,
+            },
+            {
+                name: AXMUserAccessState.Expired,
+                title: '@security-management:users.entities.user.access.states.expired',
+                description: '@security-management:users.entities.user.access.descriptions.expired',
+                icon: 'fa-light fa-clock',
+                color: 'danger',
+                order: 3,
+                isInitial: false,
+                isFinal: true,
+                generateView: false,
+            },
+        ];
+        this.transitions = [
+            {
+                from: AXMUserAccessState.Allowed,
+                to: AXMUserAccessState.Blocked,
+                title: '@security-management:users.entities.user.access.transitions.block-sign-in',
+            },
+            {
+                from: AXMUserAccessState.Allowed,
+                to: AXMUserAccessState.Expired,
+                title: '@security-management:users.entities.user.access.transitions.require-credential-renewal',
+            },
+            {
+                from: AXMUserAccessState.Blocked,
+                to: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.transitions.unblock-sign-in',
+            },
+            {
+                from: AXMUserAccessState.Expired,
+                to: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.transitions.restore-after-credential-renewal',
+            },
+        ];
+    }
+}
+//#endregion
+
+//#region ---- Imports ----
+//#endregion
+//#region ---- User effective state provider ----
+/**
+ * Unified operational state for lists, filters, and page chrome (derived from lifecycle + sign-in gate).
+ */
+class AXMUserEffectiveStateProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY;
+        this.defaultStatus = AXMUserEffectiveState.Active;
+        this.statuses = [
+            {
+                name: AXMUserEffectiveState.Pending,
+                title: '@security-management:users.entities.user.effective.states.pending',
+                description: '@security-management:users.entities.user.effective.descriptions.pending',
+                icon: 'fa-light fa-hourglass-half',
+                color: 'warning',
+                order: 1,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Active,
+                title: '@security-management:users.entities.user.effective.states.active',
+                description: '@security-management:users.entities.user.effective.descriptions.active',
+                icon: 'fa-light fa-circle-check',
+                color: 'success',
+                order: 2,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.SignInBlocked,
+                title: '@security-management:users.entities.user.effective.states.sign-in-blocked',
+                description: '@security-management:users.entities.user.effective.descriptions.sign-in-blocked',
+                icon: 'fa-light fa-shield-halved',
+                color: 'danger',
+                order: 3,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.CredentialExpired,
+                title: '@security-management:users.entities.user.effective.states.credential-expired',
+                description: '@security-management:users.entities.user.effective.descriptions.credential-expired',
+                icon: 'fa-light fa-key',
+                color: 'danger',
+                order: 4,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Suspended,
+                title: '@security-management:users.entities.user.effective.states.suspended',
+                description: '@security-management:users.entities.user.effective.descriptions.suspended',
+                icon: 'fa-light fa-pause-circle',
+                color: 'warning',
+                order: 5,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Inactive,
+                title: '@security-management:users.entities.user.effective.states.inactive',
+                description: '@security-management:users.entities.user.effective.descriptions.inactive',
+                icon: 'fa-light fa-user-slash',
+                color: 'danger',
+                order: 6,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Archived,
+                title: '@security-management:users.entities.user.effective.states.archived',
+                description: '@security-management:users.entities.user.effective.descriptions.archived',
+                icon: 'fa-light fa-box-archive',
+                color: 'danger',
+                order: 7,
+                generateView: true,
+            },
+        ];
+        this.transitions = [];
+    }
+}
+//#endregion
+
+//#region ----   Imports   ----
+//#endregion
+//#region ----   User account status provider   ----
+/**
+ * Account-level state for SecurityManagement.User (lifecycle / admin).
+ * Sign-in lockout is expressed as `accessState === blocked`, not as `accountState`.
+ */
+class AXMUserStatusProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = 'security-management.account-state.user';
+        this.defaultStatus = AXPSystemStatusType.Active;
+        this.statuses = [
+            {
+                name: AXPSystemStatusType.Pending,
+                title: '@security-management:users.entities.user.states.pending',
+                description: '@security-management:users.entities.user.account.descriptions.pending',
+                icon: 'fa-light fa-envelope-open-text',
+                color: 'warning',
+                order: 1,
+                isInitial: true,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.states.active',
+                description: '@security-management:users.entities.user.account.descriptions.active',
+                icon: 'fa-light fa-user-check',
+                color: 'success',
+                order: 1,
+                isInitial: false,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Suspended,
+                title: '@security-management:users.entities.user.states.suspended',
+                description: '@security-management:users.entities.user.account.descriptions.suspended',
+                icon: 'fa-light fa-pause-circle',
+                color: 'warning',
+                order: 5,
+                isInitial: false,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.states.inactive',
+                description: '@security-management:users.entities.user.account.descriptions.inactive',
+                icon: 'fa-light fa-user-slash',
+                color: 'danger',
+                order: 2,
+                isInitial: false,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.states.archived',
+                description: '@security-management:users.entities.user.account.descriptions.archived',
+                icon: 'fa-light fa-box-archive',
+                color: 'danger',
+                order: 5,
+                isInitial: false,
+                isFinal: true,
+                generateView: true,
+            },
+        ];
+        this.transitions = [
+            {
+                from: AXPSystemStatusType.Pending,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.activate',
+            },
+            {
+                from: AXPSystemStatusType.Pending,
+                to: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.transitions.cancel-invitation',
+            },
+            {
+                from: AXPSystemStatusType.Active,
+                to: AXPSystemStatusType.Suspended,
+                title: '@security-management:users.entities.user.transitions.suspend',
+            },
+            {
+                from: AXPSystemStatusType.Suspended,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.restore',
+            },
+            {
+                from: AXPSystemStatusType.Active,
+                to: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.transitions.disable',
+            },
+            {
+                from: AXPSystemStatusType.Inactive,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.enable',
+            },
+            {
+                from: AXPSystemStatusType.Suspended,
+                to: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.transitions.disable',
+            },
+            {
+                from: AXPSystemStatusType.Active,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Suspended,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Inactive,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Pending,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Archived,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.restore-archived',
+            },
+        ];
+    }
+}
+//#endregion
+
+//#region ----   Imports   ----
+//#endregion
+//#region ----   Manifest Definition   ----
+/**
+ * Security Management Module Manifest.
+ * Defines module metadata, features, and provider references.
+ */
+const SecurityManagementManifest = {
+    name: RootConfig.module.name,
+    version: '1.0.0',
+    title: RootConfig.module.title,
+    icon: RootConfig.module.icon,
+    i18n: RootConfig.config.i18n,
+    type: 'platform',
+    domain: 'platform',
+    required: true,
+    // Module dependencies (optional)
+};
+//#endregion
+
+class AXMMenuProvider {
+    constructor() {
+        this.entityService = inject(AXPEntityService);
+    }
+    async provide(context) {
+        const moduleName = RootConfig.module.name;
+        // Check if Security submenu exists under Administration, create it if not
+        const securityMenu = context.find(AXPSecurityManagementMenuKeys.Root);
+        if (!securityMenu.exists) {
+            // Add Security submenu to Administration group
+            context.find(AXPCommonMenuKeys.Administration).addItems([
+                {
+                    priority: 1,
+                    text: '@security-management:module.menus.root.title',
+                    icon: RootConfig.module.icon,
+                    name: AXPSecurityManagementMenuKeys.Root,
+                    type: 'menu',
+                    children: [],
+                    policy: {
+                        features: [RootConfig.module.name],
+                    },
+                },
+            ]);
+        }
+        // Add menu items under Security submenu
+        context.find(AXPSecurityManagementMenuKeys.Root).addItems([
+            {
+                priority: 9003,
+                text: RootConfig.entities.users.titlePlural,
+                icon: RootConfig.entities.users.icon,
+                name: AXPSecurityManagementMenuKeys.Users,
+                path: this.entityService.createPath(moduleName, RootConfig.entities.users.name),
+                policy: {
+                    features: [moduleName],
+                    permissions: [AXPAdministrationPermissionKeys.MaintainUsersAndRoles],
+                },
+            },
+            {
+                priority: 9004,
+                text: RootConfig.entities.roles.titlePlural,
+                path: this.entityService.createPath(moduleName, RootConfig.entities.roles.name),
+                icon: RootConfig.entities.roles.icon,
+                name: AXPSecurityManagementMenuKeys.Roles,
+                policy: {
+                    features: [moduleName],
+                    permissions: [AXPAdministrationPermissionKeys.MaintainUsersAndRoles],
+                },
+            },
+            {
+                priority: 9005,
+                text: RootConfig.entities.deviceSessions.titlePlural,
+                path: this.entityService.createPath(moduleName, RootConfig.entities.deviceSessions.name),
+                icon: RootConfig.entities.deviceSessions.icon,
+                name: AXPSecurityManagementMenuKeys.DeviceSessions,
+                policy: {
+                    features: [moduleName],
+                    permissions: [AXPAdministrationPermissionKeys.ManageSessions],
+                },
+            },
+            {
+                priority: 9007,
+                text: RootConfig.entities.identityProvider.titlePlural,
+                path: this.entityService.createPath(moduleName, RootConfig.entities.identityProvider.name),
+                icon: RootConfig.entities.identityProvider.icon,
+                name: AXPSecurityManagementMenuKeys.IdentityProviders,
+                policy: {
+                    // Platform Console edition only (not on Safetyminder / tenant apps)
+                    features: [AXPSecurityManagementFeatureKeys.ManageIdentityProviders],
+                    permissions: [AXPAdministrationPermissionKeys.MaintainPolicies],
+                },
+            },
+            // {
+            //   priority: 9006,
+            //   text: RootConfig.entities.policy.titlePlural,
+            //   path: this.entityService.createPath(moduleName, RootConfig.entities.policy.name),
+            //   icon: RootConfig.entities.policy.icon,
+            //   name: AXPSecurityManagementMenuKeys.Policy,
+            //   policy: {
+            //     permissions: [AXPAdministrationPermissionKeys.MaintainPolicies],
+            //   },
+            // },
+        ]);
+    }
+}
+
+//#endregion
+//#region ---- Permission Definition Provider ----
+/**
+ * Registers Administration root + Security & Access section capabilities.
+ */
+class AXMPermissionDefinitionProvider {
+    async define(context) {
+        const keys = AXPAdministrationPermissionKeys;
+        const groups = AXPCommonPermissionGroupKeys;
+        const P = '@common:administration.permissions';
+        const G = '@common:permission-groups';
+        context.addGroup(groups.Administration.Root, `${G}.administration.title`, `${G}.administration.description`, { order: 120 });
+        context
+            .addGroup(groups.Administration.SecurityAccess, `${G}.administration-security-access.title`, `${G}.administration-security-access.description`, { parent: groups.Administration.Root, order: 10 })
+            .addPermission(keys.Access, `${P}.access.title`, `${P}.access.description`)
+            .endPermission()
+            .addPermission(keys.MaintainUsersAndRoles, `${P}.maintain-users-and-roles.title`, `${P}.maintain-users-and-roles.description`)
+            .endPermission()
+            .addPermission(keys.ManageSessions, `${P}.manage-sessions.title`, `${P}.manage-sessions.description`)
+            .endPermission()
+            .addPermission(keys.MaintainPolicies, `${P}.maintain-policies.title`, `${P}.maintain-policies.description`)
+            .endPermission()
+            .endGroup();
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionDefinitionProvider, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionDefinitionProvider }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMPermissionDefinitionProvider, decorators: [{
+            type: Injectable
+        }] });
+
+// TODO: Refactor to generic provider (do it later)
+//
+// Move this logic to a generic AXPEntityCreateSearchCommandProvider in libs/platform/layout/entity.
+// The generic provider should:
+// - Inject AXPEntityDefinitionRegistryService and AXPSessionService
+// - Override search(text) to build commands dynamically from registry
+// - Filter entities: only aggregate roots (commands?.create exists AND !parentKey)
+// - Filter by permission: sessionService.authorize() for both Create and Management
+//   Permission convention: `${module}:Permission:${entity.name}.Create` or `.Management`
+// - Use createEntityCommandOptions() with Entity:Create command (same pattern as below)
+// - Register in entity module as AXP_SEARCH_PROVIDER
+// - Remove this and other module-specific search command providers that only add entity-create commands
+class AXMSearchCommandProvider extends AXPSearchCommandProvider {
+    constructor() {
+        super(...arguments);
+        this.commands = [
+            createEntitySearchCommand({
+                id: 'create-security-user',
+                entityKey: `${RootConfig.module.name}.${RootConfig.entities.users.name}`,
+                entityInfo: { name: RootConfig.entities.users.name, module: RootConfig.module.name, title: RootConfig.entities.users.title },
+                titleKey: '@security-management:users.permissions.create.title',
+                descriptionKey: '@security-management:users.permissions.create.description',
+                icon: RootConfig.entities.users.icon,
+            }),
+            createEntitySearchCommand({
+                id: 'create-security-role',
+                entityKey: `${RootConfig.module.name}.${RootConfig.entities.roles.name}`,
+                entityInfo: { name: RootConfig.entities.roles.name, module: RootConfig.module.name, title: RootConfig.entities.roles.title },
+                titleKey: '@security-management:roles.permissions.create.title',
+                descriptionKey: '@security-management:roles.permissions.create.description',
+                icon: RootConfig.entities.roles.icon,
+            }),
+        ];
+    }
+}
+
+class AXMSecurityManagementModule {
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule }); }
+    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementModule, imports: [AXMPermissionsModule] }); }
+    static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementModule, providers: [
+            // Module-specific providers (not part of manifest system)
+            {
+                provide: AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER,
+                useClass: AXMSecurityManagementEvaluatorScopeProvider,
+                multi: true,
+            },
+            // Module Manifest Provider
+            {
+                provide: AXP_MODULE_MANIFEST_PROVIDER,
+                useValue: SecurityManagementManifest,
+                multi: true,
+            },
+            provideLazyProvider(AXP_PAGE_COMPONENT_PROVIDER, () => Promise.resolve().then(function () { return index; }).then((m) => m.AXMRolePermissionsPageComponentProvider)),
+            provideLazyProvider(AXP_PAGE_COMPONENT_PROVIDER, () => import('./acorex-platform-module-security-management-client-index-DOHWBEzM.mjs').then((m) => m.AXMUserRolesPageComponentProvider)),
+            // Provider references (now using tokens)
+            {
+                provide: AXP_PERMISSION_DEFINITION_PROVIDER,
+                useClass: AXMPermissionDefinitionProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_MENU_PROVIDER,
+                useClass: AXMMenuProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_SEARCH_PROVIDER,
+                useClass: AXMSearchCommandProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_FEATURE_DEFINITION_PROVIDER,
+                useClass: AXMSecurityManagementFeatureDefinitionProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_STATUS_PROVIDERS,
+                useClass: AXMUserStatusProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_STATUS_PROVIDERS,
+                useClass: AXMUserAccessStateProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_STATUS_PROVIDERS,
+                useClass: AXMUserEffectiveStateProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_CONTEXT_DEFINITION_PROVIDER,
+                useClass: AXMSecurityManagementContextDefinitionProvider,
+                multi: true,
+            },
+            provideCommandSetups([
+                {
+                    key: 'Session:Terminate',
+                    command: () => import('./acorex-platform-module-security-management-client-terminate-session.command-dsU7scOK.mjs').then((c) => c.AXPTerminateSessionCommand),
+                },
+                {
+                    key: 'SecurityManagement:User:SendPasswordResetEmail',
+                    command: () => import('./acorex-platform-module-security-management-client-send-password-reset-email.command-CoQgWdya.mjs').then((c) => c.AXPSendPasswordResetEmailCommand),
+                },
+            ]),
+        ], imports: [AXMPermissionsModule] }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMSecurityManagementModule, decorators: [{
+            type: NgModule,
+            args: [{
+                    imports: [
+                        AXMPermissionsModule,
+                    ],
+                    exports: [],
+                    declarations: [],
+                    providers: [
+                        // Module-specific providers (not part of manifest system)
+                        {
+                            provide: AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER,
+                            useClass: AXMSecurityManagementEvaluatorScopeProvider,
+                            multi: true,
+                        },
+                        // Module Manifest Provider
+                        {
+                            provide: AXP_MODULE_MANIFEST_PROVIDER,
+                            useValue: SecurityManagementManifest,
+                            multi: true,
+                        },
+                        provideLazyProvider(AXP_PAGE_COMPONENT_PROVIDER, () => Promise.resolve().then(function () { return index; }).then((m) => m.AXMRolePermissionsPageComponentProvider)),
+                        provideLazyProvider(AXP_PAGE_COMPONENT_PROVIDER, () => import('./acorex-platform-module-security-management-client-index-DOHWBEzM.mjs').then((m) => m.AXMUserRolesPageComponentProvider)),
+                        // Provider references (now using tokens)
+                        {
+                            provide: AXP_PERMISSION_DEFINITION_PROVIDER,
+                            useClass: AXMPermissionDefinitionProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_MENU_PROVIDER,
+                            useClass: AXMMenuProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_SEARCH_PROVIDER,
+                            useClass: AXMSearchCommandProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_FEATURE_DEFINITION_PROVIDER,
+                            useClass: AXMSecurityManagementFeatureDefinitionProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_STATUS_PROVIDERS,
+                            useClass: AXMUserStatusProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_STATUS_PROVIDERS,
+                            useClass: AXMUserAccessStateProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_STATUS_PROVIDERS,
+                            useClass: AXMUserEffectiveStateProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_CONTEXT_DEFINITION_PROVIDER,
+                            useClass: AXMSecurityManagementContextDefinitionProvider,
+                            multi: true,
+                        },
+                        provideCommandSetups([
+                            {
+                                key: 'Session:Terminate',
+                                command: () => import('./acorex-platform-module-security-management-client-terminate-session.command-dsU7scOK.mjs').then((c) => c.AXPTerminateSessionCommand),
+                            },
+                            {
+                                key: 'SecurityManagement:User:SendPasswordResetEmail',
+                                command: () => import('./acorex-platform-module-security-management-client-send-password-reset-email.command-CoQgWdya.mjs').then((c) => c.AXPSendPasswordResetEmailCommand),
+                            },
+                        ]),
+                    ],
+                }]
+        }] });
+
+// #region ----------------   Imports   ----------------
+// #endregion
+class AXPPermissionsEditorComponent extends AXBasePageComponent {
+    // #endregion
+    // #region ----------------   Constructor   ----------------
+    constructor() {
+        super();
+        // #region ----------------   Class Properties   ----------------
+        /** Service for fetching permission groups and definitions */
+        this.permissionService = inject(AXPPermissionDefinitionService);
+        /** Translation service for resolving permission labels during search */
+        this.translationService = inject(AXTranslationService);
+        /** Currently selected permission group */
+        this.selectedGroup = signal(null, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "selectedGroup" }] : /* istanbul ignore next */ []));
+        /** Current search query */
+        this.searchQuery = signal('', /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "searchQuery" }] : /* istanbul ignore next */ []));
+        /** All available permission groups */
+        this.groups = signal([], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "groups" }] : /* istanbul ignore next */ []));
+        /** Initial permissions to be selected - exposed as signal input */
+        this.initialPermissions = input([], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "initialPermissions" }] : /* istanbul ignore next */ []));
+        /** Whether the editor is in read-only mode */
+        this.readOnly = input(false, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "readOnly" }] : /* istanbul ignore next */ []));
+        /** Whether popup footer actions (Cancel / Select) are shown */
+        this.showActions = input(false, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "showActions" }] : /* istanbul ignore next */ []));
+        /** When true, fills the host (detail page) without the dialog max-height cap. */
+        this.fillHeight = input(false, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "fillHeight" }] : /* istanbul ignore next */ []));
+        this.hostClass = computed(() => this.fillHeight()
+            ? 'axm-permissions-editor axm-permissions-editor--fill-height flex h-full min-h-0 flex-col overflow-hidden'
+            : 'axm-permissions-editor axm-permissions-editor--dialog flex h-full max-h-[75vh] min-h-0 flex-col overflow-hidden p-4 gap-3', /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "hostClass" }] : /* istanbul ignore next */ []));
+        /** List of selected permission names */
+        this.selectedPermissions = signal([], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "selectedPermissions" }] : /* istanbul ignore next */ []));
+        /** Event emitted when permissions selection changes */
+        this.permissionsChanged = output();
+        /** Event emitted when permissions are applied/selected */
+        this.permissionsSelected = output();
+        /** Whether permission groups are being loaded */
+        this.isEditorLoading = signal(true, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isEditorLoading" }] : /* istanbul ignore next */ []));
+        /**
+         * Computed: Left-nav roots only (groups without a parent), sorted by title.
+         */
+        this.groupsWithBadge = computed(() => {
+            const roots = this.groups().filter((group) => !group.parent);
+            const result = roots.map((group) => ({
+                ...group,
+                badge: this.getBadge(group) || '',
+            }));
+            return result.sort((a, b) => this.compareByTitle(a.title, b.title, a.name, b.name));
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "groupsWithBadge" }] : /* istanbul ignore next */ []));
+        /**
+         * Computed: Right-panel sections for the selected root (or one flat block).
+         */
+        this.selectedSections = computed(() => {
+            const selected = this.selectedGroup();
+            if (!selected) {
+                return [];
+            }
+            return this.buildPanelSections(selected, null);
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "selectedSections" }] : /* istanbul ignore next */ []));
+        /** Sidebar group placeholders for the loading skeleton */
+        this.groupSkeletonPlaceholders = computed(() => [
+            'w-4/5',
+            'w-3/5',
+            'w-4/5',
+            'w-3/5',
+            'w-4/5',
+            'w-3/5',
+            'w-4/5',
+        ], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "groupSkeletonPlaceholders" }] : /* istanbul ignore next */ []));
+        /** Permission group placeholders (parent + child rows) for the loading skeleton */
+        this.permissionGroupSkeletonPlaceholders = computed(() => [
+            { childCount: 4 },
+            { childCount: 4 },
+            { childCount: 2 },
+            { childCount: 4 },
+        ], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "permissionGroupSkeletonPlaceholders" }] : /* istanbul ignore next */ []));
+        /** Child row placeholders for a permission group skeleton */
+        this.childSkeletonPlaceholders = (count) => Array.from({ length: count }, (_, index) => index);
+        /** Whether the user is actively searching permissions */
+        this.isSearchActive = computed(() => !isEmpty(trim(this.searchQuery())), /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isSearchActive" }] : /* istanbul ignore next */ []));
+        /** Grouped search results across all root permission groups */
+        this.searchResultsGrouped = computed(() => {
+            const normalizedQuery = trim(this.searchQuery()).toLowerCase();
+            if (!normalizedQuery) {
+                return [];
+            }
+            return this.groupsWithBadge()
+                .map((group) => ({
+                group,
+                sections: this.buildPanelSections(group, normalizedQuery),
+            }))
+                .filter((result) => !isEmpty(result.sections));
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "searchResultsGrouped" }] : /* istanbul ignore next */ []));
+        /** Whether the active search returned any permission groups */
+        this.hasSearchResults = computed(() => !isEmpty(this.searchResultsGrouped()), /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "hasSearchResults" }] : /* istanbul ignore next */ []));
+        setupPopupFooterKeyboardShortcuts(() => {
+            if (!this.isShowActions()) {
+                return [];
+            }
+            return [
+                {
+                    title: '@general:actions.cancel.title',
+                    command: 'cancel',
+                    handler: () => this.handleCancelClick(),
+                },
+                {
+                    title: '@general:actions.select.title',
+                    command: 'select',
+                    handler: () => this.handleSelectClick(),
+                },
+            ];
+        }, { id: 'permissions-editor-popup', when: () => this.isShowActions() });
+    }
+    // #endregion
+    // #region ----------------   Computed Properties   ----------------
+    /**
+     * Reads a signal input or a plain value assigned by AXPopupService data binding.
+     */
+    readBoundValue(value, fallback) {
+        if (typeof value === 'function') {
+            return value();
+        }
+        return (value ?? fallback);
+    }
+    /** Whether popup footer actions are visible (supports popup data and input binding). */
+    isShowActions() {
+        return this.readBoundValue(this.showActions, false);
+    }
+    /** Whether the editor is read-only (supports popup data and input binding). */
+    isReadOnlyMode() {
+        return this.readBoundValue(this.readOnly, false);
+    }
+    /** Initial permission selection (supports popup data and input binding). */
+    getInitialPermissions() {
+        return this.readBoundValue(this.initialPermissions, []);
+    }
+    /**
+     * Recursively maps permissions to include selection state and children.
+     * Sorted alphabetically by translated title.
+     */
+    mapPermissions(items) {
+        const mapped = (items || []).map((item) => {
+            const children = item.children;
+            return {
+                ...item,
+                isSelected: this.isSelected(item.name),
+                children: children?.length ? this.mapPermissions(children) : null,
+            };
+        });
+        return mapped.sort((a, b) => this.compareByTitle(a.title, b.title, a.name, b.name));
+    }
+    /**
+     * Locale-aware label comparison using the resolved translation when available.
+     */
+    compareByTitle(titleA, titleB, tieBreakerA = titleA, tieBreakerB = titleB) {
+        const labelA = (this.translationService.translateSync(titleA) || titleA).toLocaleLowerCase();
+        const labelB = (this.translationService.translateSync(titleB) || titleB).toLocaleLowerCase();
+        const byLabel = labelA.localeCompare(labelB);
+        if (byLabel !== 0) {
+            return byLabel;
+        }
+        return tieBreakerA.localeCompare(tieBreakerB);
+    }
+    // #endregion
+    // #region ----------------   Utility Methods   ----------------
+    /**
+     * Drops empty roots/sections after session feature filtering in
+     * {@link AXPPermissionDefinitionService}. Keeps a root only when it or a child
+     * section still has at least one permission.
+     */
+    filterGroupsByEnabledModules(groups) {
+        const withPermissions = new Set(groups.filter((group) => (group.permissions?.length ?? 0) > 0).map((group) => group.name));
+        const parentsOfKept = new Set(groups
+            .filter((group) => withPermissions.has(group.name) && group.parent)
+            .map((group) => group.parent));
+        return groups.filter((group) => withPermissions.has(group.name) || parentsOfKept.has(group.name));
+    }
+    /** Permission keys still visible after edition/feature filtering. */
+    collectAvailablePermissionNames(groups) {
+        const names = new Set();
+        const walk = (permissions) => {
+            for (const permission of permissions) {
+                names.add(permission.name);
+                if (permission.children?.length) {
+                    walk(permission.children);
+                }
+            }
+        };
+        for (const group of groups) {
+            walk(group.permissions ?? []);
+        }
+        return names;
+    }
+    /**
+     * Child section groups under a root, sorted alphabetically by translated title.
+     */
+    getChildSections(root) {
+        return this.groups()
+            .filter((group) => group.parent === root.name)
+            .sort((a, b) => this.compareByTitle(a.title, b.title, a.name, b.name));
+    }
+    /**
+     * Builds right-panel sections for a root. When `normalizedQuery` is set, keeps
+     * only matching permissions/sections (and sections whose title matches).
+     */
+    buildPanelSections(root, normalizedQuery) {
+        const children = this.getChildSections(root);
+        const sections = [];
+        const rootMatches = !!normalizedQuery && this.matchesGroup(root, normalizedQuery);
+        if (children.length === 0) {
+            const permissions = normalizedQuery
+                ? this.getFilteredGroupPermissions(root, normalizedQuery)
+                : (root.permissions ?? []);
+            if (!isEmpty(permissions)) {
+                sections.push({
+                    name: root.name,
+                    title: null,
+                    items: this.mapPermissions(permissions),
+                });
+            }
+            return sections;
+        }
+        const rootPermissions = !normalizedQuery || rootMatches
+            ? (root.permissions ?? [])
+            : this.getFilteredGroupPermissions(root, normalizedQuery);
+        if (!isEmpty(rootPermissions)) {
+            sections.push({
+                name: `${root.name}__root`,
+                title: null,
+                items: this.mapPermissions(rootPermissions),
+            });
+        }
+        for (const child of children) {
+            const sectionMatches = !!normalizedQuery && this.matchesGroup(child, normalizedQuery);
+            const permissions = !normalizedQuery || rootMatches || sectionMatches
+                ? (child.permissions ?? [])
+                : this.getFilteredGroupPermissions(child, normalizedQuery);
+            if (isEmpty(permissions)) {
+                continue;
+            }
+            sections.push({
+                name: child.name,
+                title: child.title,
+                items: this.mapPermissions(permissions),
+            });
+        }
+        return sections;
+    }
+    /**
+     * Recursively collects all permission names (parents and children) from an array.
+     */
+    collectAllPermissionNames(permissions) {
+        let names = [];
+        for (const item of permissions) {
+            names.push(item.name);
+            if (item.children?.length) {
+                names = names.concat(this.collectAllPermissionNames(item.children));
+            }
+        }
+        return names;
+    }
+    /**
+     * Returns the badge count for a root (own permissions + child section permissions).
+     */
+    getBadge(group) {
+        const ownNames = this.collectAllPermissionNames(group.permissions || []);
+        const childNames = this.getChildSections(group).flatMap((child) => this.collectAllPermissionNames(child.permissions || []));
+        const allNames = [...ownNames, ...childNames];
+        const selectedPermissions = this.selectedPermissions();
+        const count = allNames.filter((name) => selectedPermissions.includes(name)).length;
+        return count.toString();
+    }
+    /**
+     * Checks if a permission is selected.
+     */
+    isSelected(name) {
+        return this.selectedPermissions().includes(name);
+    }
+    /**
+     * Checks if a permission is selected.
+     */
+    badgeToNumber(value) {
+        return Number(value);
+    }
+    /** Looks up a left-nav root group by tab key (group name). */
+    getGroupByKey(key) {
+        if (!key) {
+            return undefined;
+        }
+        return this.groupsWithBadge().find((group) => group.name === key);
+    }
+    /**
+     * Returns true when searchable text contains the query.
+     */
+    matchesSearchText(text, normalizedQuery) {
+        if (!text) {
+            return false;
+        }
+        const translated = this.translationService.translateSync(text) || text;
+        return (translated.toLowerCase().includes(normalizedQuery) ||
+            text.toLowerCase().includes(normalizedQuery));
+    }
+    /**
+     * Returns true when a permission title or description matches the query.
+     */
+    matchesPermission(permission, normalizedQuery) {
+        return (this.matchesSearchText(permission.title, normalizedQuery) ||
+            this.matchesSearchText(permission.description, normalizedQuery));
+    }
+    /**
+     * Returns true when a permission group title or description matches the query.
+     */
+    matchesGroup(group, normalizedQuery) {
+        return (this.matchesSearchText(group.title, normalizedQuery) ||
+            this.matchesSearchText(group.description, normalizedQuery));
+    }
+    /**
+     * Filters permissions while keeping ancestor nodes for matching descendants.
+     */
+    filterPermissions(items, normalizedQuery) {
+        const result = [];
+        for (const item of items) {
+            const filteredChildren = this.filterPermissions(item.children ?? [], normalizedQuery);
+            const selfMatches = this.matchesPermission(item, normalizedQuery);
+            if (selfMatches || !isEmpty(filteredChildren)) {
+                result.push({
+                    ...item,
+                    children: filteredChildren,
+                });
+            }
+        }
+        return result;
+    }
+    /**
+     * Returns filtered permissions for a group, or all permissions when the group itself matches.
+     */
+    getFilteredGroupPermissions(group, normalizedQuery) {
+        const permissions = group.permissions ?? [];
+        if (this.matchesGroup(group, normalizedQuery)) {
+            return permissions;
+        }
+        return this.filterPermissions(permissions, normalizedQuery);
+    }
+    /**
+     * Recursively collects all descendant permission names for a single item (including itself).
+     */
+    collectPermissionNames(item) {
+        let names = [item.name];
+        if (item.children) {
+            for (const child of item.children) {
+                names = names.concat(this.collectPermissionNames(child));
+            }
+        }
+        return names;
+    }
+    /**
+     * Gets the current selected permissions.
+     */
+    getSelectedPermissions() {
+        return this.selectedPermissions();
+    }
+    /**
+     * Sets the selected permissions.
+     */
+    setSelectedPermissions(permissions) {
+        this.selectedPermissions.set(permissions || []);
+        this.permissionsChanged.emit(this.selectedPermissions());
+    }
+    /**
+     * Applies/selects the current permissions.
+     */
+    selectPermissions() {
+        this.permissionsSelected.emit(this.selectedPermissions());
+    }
+    // #endregion
+    // #region ----------------   Lifecycle Methods   ----------------
+    /**
+     * Initializes the component and loads permission groups.
+     * Filters groups to only show permissions from modules enabled for the current tenant.
+     */
+    async ngOnInit() {
+        super.ngOnInit();
+        try {
+            const allGroups = await this.permissionService.getGroups();
+            const filteredGroups = this.filterGroupsByEnabledModules(allGroups);
+            this.groups.set(filteredGroups);
+            // Select first left-nav root in the same title-sorted order as the sidebar
+            const firstRoot = [...filteredGroups]
+                .filter((group) => !group.parent)
+                .sort((a, b) => this.compareByTitle(a.title, b.title, a.name, b.name))[0];
+            if (firstRoot) {
+                this.selectedGroup.set(firstRoot);
+            }
+            // Drop grants for permissions not available in this edition (e.g. platform caps in Safetyminder).
+            const available = this.collectAvailablePermissionNames(filteredGroups);
+            const initial = this.getInitialPermissions().filter((name) => available.has(name));
+            this.selectedPermissions.set(initial);
+            this.permissionsChanged.emit(initial);
+        }
+        finally {
+            this.isEditorLoading.set(false);
+        }
+    }
+    // #endregion
+    // #region ----------------   UI Handlers   ----------------
+    /**
+     * Handles group tab/menu item click.
+     */
+    handleMenuItemClick(item) {
+        this.selectedGroup.set(item);
+    }
+    /**
+     * Updates the search query when the search box value changes.
+     */
+    handleSearchChanged(event) {
+        this.searchQuery.set(event.value ?? '');
+    }
+    /**
+     * Handles permission checkbox toggle (checks/unchecks all children recursively).
+     */
+    onPermissionToggle(item, e) {
+        // Don't allow changes in read-only mode
+        if (this.isReadOnlyMode()) {
+            return;
+        }
+        const names = this.collectPermissionNames(item);
+        if (e.value) {
+            // Add all names (parent + children), avoiding duplicates
+            const set = new Set([...this.selectedPermissions(), ...names]);
+            this.selectedPermissions.set(Array.from(set));
+        }
+        else {
+            // Remove all names (parent + children)
+            this.selectedPermissions.set(this.selectedPermissions().filter((name) => !names.includes(name)));
+        }
+        this.permissionsChanged.emit(this.selectedPermissions());
+    }
+    /**
+     * Closes the popup without applying permission changes.
+     */
+    handleCancelClick() {
+        this.close();
+    }
+    /**
+     * Applies the current selection and closes the popup.
+     */
+    handleSelectClick() {
+        const permissions = this.getSelectedPermissions();
+        this.permissionsSelected.emit(permissions);
+        this.close(permissions);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsEditorComponent, deps: [], target: i0.ɵɵFactoryTarget.Component }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.0.8", type: AXPPermissionsEditorComponent, isStandalone: true, selector: "axm-permissions-editor", inputs: { initialPermissions: { classPropertyName: "initialPermissions", publicName: "initialPermissions", isSignal: true, isRequired: false, transformFunction: null }, readOnly: { classPropertyName: "readOnly", publicName: "readOnly", isSignal: true, isRequired: false, transformFunction: null }, showActions: { classPropertyName: "showActions", publicName: "showActions", isSignal: true, isRequired: false, transformFunction: null }, fillHeight: { classPropertyName: "fillHeight", publicName: "fillHeight", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { permissionsChanged: "permissionsChanged", permissionsSelected: "permissionsSelected" }, host: { properties: { "class": "hostClass()", "attr.aria-busy": "isEditorLoading() ? \"true\" : null" } }, usesInheritance: true, ngImport: i0, template: "<div class=\"__frame\">\n  @if (isEditorLoading()) {\n    <!-- ----- Skeleton while permission groups load ----- -->\n    <div class=\"__body flex min-h-0 flex-1 overflow-hidden\">\n      <div class=\"__groups p-4 w-2/5\" aria-hidden=\"true\">\n        <div class=\"flex flex-col gap-3 h-full\">\n          @for (widthClass of groupSkeletonPlaceholders(); track $index) {\n            <div class=\"flex items-center py-2\">\n              <div class=\"h-5 rounded-md overflow-hidden\" [class]=\"widthClass\">\n                <ax-skeleton\n                  [animated]=\"true\"\n                  style=\"display: block; width: 100%; height: 100%\"\n                ></ax-skeleton>\n              </div>\n            </div>\n          }\n        </div>\n      </div>\n\n      <div\n        class=\"__permissions flex w-3/5 flex-col overflow-hidden border-s\"\n        aria-hidden=\"true\"\n      >\n        <div class=\"__header p-4 border-b border-lightest\">\n          <div class=\"h-6 w-48 rounded-md overflow-hidden\">\n            <ax-skeleton\n              [animated]=\"true\"\n              style=\"display: block; width: 100%; height: 100%\"\n            ></ax-skeleton>\n          </div>\n        </div>\n\n        <div class=\"__content flex flex-col gap-1 p-4\">\n          @for (group of permissionGroupSkeletonPlaceholders(); track $index) {\n            <div class=\"__skeleton-permission-group\">\n              <div class=\"flex items-center gap-2 py-1\">\n                <div class=\"h-4 w-4 shrink-0 rounded-sm overflow-hidden\">\n                  <ax-skeleton\n                    [animated]=\"true\"\n                    style=\"display: block; width: 100%; height: 100%\"\n                  ></ax-skeleton>\n                </div>\n                <div class=\"h-4 w-40 max-w-full rounded-md overflow-hidden\">\n                  <ax-skeleton\n                    [animated]=\"true\"\n                    style=\"display: block; width: 100%; height: 100%\"\n                  ></ax-skeleton>\n                </div>\n                <div class=\"h-3 w-3 shrink-0 rounded-full overflow-hidden\">\n                  <ax-skeleton\n                    [animated]=\"true\"\n                    style=\"display: block; width: 100%; height: 100%\"\n                  ></ax-skeleton>\n                </div>\n              </div>\n\n              <div class=\"__children p-2 mt-1 ms-1\">\n                @for (\n                  childIndex of childSkeletonPlaceholders(group.childCount);\n                  track childIndex\n                ) {\n                  <div class=\"flex items-center gap-2 py-1 ps-2\">\n                    <div class=\"h-4 w-4 shrink-0 rounded-sm overflow-hidden\">\n                      <ax-skeleton\n                        [animated]=\"true\"\n                        style=\"display: block; width: 100%; height: 100%\"\n                      ></ax-skeleton>\n                    </div>\n                    <div class=\"h-4 w-32 max-w-full rounded-md overflow-hidden\">\n                      <ax-skeleton\n                        [animated]=\"true\"\n                        style=\"display: block; width: 100%; height: 100%\"\n                      ></ax-skeleton>\n                    </div>\n                    <div class=\"h-3 w-3 shrink-0 rounded-full overflow-hidden\">\n                      <ax-skeleton\n                        [animated]=\"true\"\n                        style=\"display: block; width: 100%; height: 100%\"\n                      ></ax-skeleton>\n                    </div>\n                  </div>\n                }\n              </div>\n            </div>\n          }\n        </div>\n      </div>\n    </div>\n  }\n  <!-- ----- Loaded editor: search + group/permission columns ----- -->\n  @else {\n    <div class=\"__search px-4 pt-4 pb-3 border-b border-border-lightest\">\n      <ax-search-box\n        [axAutoFocus]\n        [ngModel]=\"searchQuery()\"\n        (onValueChanged)=\"handleSearchChanged($event)\"\n        [placeholder]=\"\n          '@security-management:permissions-feature.components.permissions-editor.search.placeholder'\n            | translate\n            | async\n        \"\n      >\n        <ax-clear-button></ax-clear-button>\n      </ax-search-box>\n    </div>\n\n    <div class=\"__body flex min-h-0 flex-1 overflow-hidden\">\n      @if (isSearchActive()) {\n        <!-- ----- Search results fill both columns ----- -->\n        <div\n          class=\"__permissions __permissions--search flex min-h-0 flex-1 flex-col overflow-hidden\"\n        >\n          @if (hasSearchResults()) {\n            <div class=\"__search-results flex min-h-0 flex-1 flex-col overflow-y-auto\">\n              @for (result of searchResultsGrouped(); track result.group.name) {\n                <section class=\"__search-group shrink-0\">\n                  <div\n                    class=\"__header shrink-0 p-4 border-b border-border-lightest\"\n                  >\n                    <span class=\"h6\">{{\n                      result.group.title | translate | async\n                    }}</span>\n                  </div>\n\n                  <div class=\"__content flex flex-col gap-4 p-4\">\n                    @for (section of result.sections; track section.name) {\n                      <section class=\"__section\">\n                        @if (section.title) {\n                          <div class=\"__section-header\">\n                            <span class=\"__section-title\">{{\n                              section.title | translate | async\n                            }}</span>\n                          </div>\n                        }\n                        <ul class=\"__list\">\n                          <ng-container\n                            *ngTemplateOutlet=\"\n                              recursiveList;\n                              context: { $implicit: section.items }\n                            \"\n                          ></ng-container>\n                        </ul>\n                      </section>\n                    }\n                  </div>\n                </section>\n              }\n            </div>\n          }\n          <!-- ----- Empty search results ----- -->\n          @else {\n            <div class=\"__empty flex flex-1 items-center justify-center p-8\">\n              <axp-state-message\n                icon=\"fa-light fa-search\"\n                [title]=\"\n                  '@security-management:permissions-feature.components.permissions-editor.empty-states.no-results.title'\n                \"\n                [description]=\"\n                  '@security-management:permissions-feature.components.permissions-editor.empty-states.no-results.description'\n                \"\n              >\n              </axp-state-message>\n            </div>\n          }\n        </div>\n      }\n      <!-- ----- Browse mode: groups nav + permissions panel ----- -->\n      @else {\n        <div class=\"__groups w-2/5\">\n          <ax-tabs location=\"start\" look=\"with-line-color\" class=\"__group-tabs\">\n            @for (group of groupsWithBadge(); track group.name) {\n              <ax-tab-item\n                [active]=\"group.name === selectedGroup()?.name\"\n                [key]=\"group.name\"\n                [text]=\"(group.title | translate | async)!\"\n                [headerTemplate]=\"groupTabHeader\"\n                (onClick)=\"handleMenuItemClick(group)\"\n              >\n              </ax-tab-item>\n            }\n          </ax-tabs>\n        </div>\n\n        <div class=\"__permissions flex w-3/5 flex-col overflow-hidden border-s border-border-lightest\">\n          <div class=\"__header shrink-0 p-4 border-b border-border-lightest font-semibold\">\n            <span>{{ $safeNavigationMigration(selectedGroup()?.title)! | translate | async }}</span>\n          </div>\n\n          <div class=\"__content flex flex-col gap-4 p-4\">\n            @for (section of selectedSections(); track section.name) {\n              <section class=\"__section\">\n                @if (section.title) {\n                  <div class=\"__section-header\">\n                    <span class=\"__section-title\">{{\n                      section.title | translate | async\n                    }}</span>\n                  </div>\n                }\n                <ul class=\"__list\">\n                  <ng-container\n                    *ngTemplateOutlet=\"\n                      recursiveList;\n                      context: { $implicit: section.items }\n                    \"\n                  ></ng-container>\n                </ul>\n              </section>\n            }\n          </div>\n        </div>\n      }\n    </div>\n  }\n</div>\n\n@if (isShowActions()) {\n  <!-- ----- Dialog footer actions ----- -->\n  <ax-footer>\n    <ax-suffix>\n      <ax-button\n        look=\"solid\"\n        [text]=\"'@general:actions.cancel.title' | translate | async\"\n        (onClick)=\"handleCancelClick()\"\n      ></ax-button>\n      <ax-button\n        look=\"solid\"\n        color=\"primary\"\n        [text]=\"'@general:actions.select.title' | translate | async\"\n        (onClick)=\"handleSelectClick()\"\n      >\n        <ax-prefix>\n          <i class=\"fa-solid fa-check\"></i>\n        </ax-prefix>\n      </ax-button>\n    </ax-suffix>\n  </ax-footer>\n}\n\n<!-- ----- Left-nav group tab: title + description + badge ----- -->\n<ng-template #groupTabHeader let-ctx>\n  @if (getGroupByKey(ctx.key); as group) {\n    <div class=\"__group-tab\">\n      <div class=\"__group-tab-main\">\n        <div class=\"__group-tab-title\">{{ ctx.text }}</div>\n        @if (group.description) {\n          <div class=\"__group-tab-description\">\n            {{ group.description | translate | async }}\n          </div>\n        }\n      </div>\n      @if (badgeToNumber(group.badge) > 0) {\n        <ax-badge\n          class=\"__group-tab-badge\"\n          [color]=\"'primary'\"\n          [look]=\"'twotone'\"\n          [text]=\"group.badge\"\n        ></ax-badge>\n      }\n    </div>\n  }\n</ng-template>\n\n<ng-template #recursiveList let-items>\n  @for (item of items; track $index) {\n    <li class=\"__item\">\n      <ax-check-box\n        [ngModel]=\"item.isSelected\"\n        [readonly]=\"isReadOnlyMode()\"\n        (onValueChanged)=\"onPermissionToggle(item, $event)\"\n      >\n        <ax-label>\n          <span class=\"__permission-label\">\n            <span class=\"__permission-title\">{{\n              item.title | translate | async\n            }}</span>\n            @if (item.description) {\n              <span class=\"__permission-description\">{{\n                item.description | translate | async\n              }}</span>\n            }\n          </span>\n        </ax-label>\n      </ax-check-box>\n\n      @if (item.children && item.children.length > 0) {\n        <ul class=\"__children p-2 mt-1 ms-1\">\n          <ng-container\n            *ngTemplateOutlet=\"\n              recursiveList;\n              context: { $implicit: item.children }\n            \"\n          ></ng-container>\n        </ul>\n      }\n    </li>\n  }\n</ng-template>\n", styles: ["@layer properties;.axm-permissions-editor{display:flex;height:100%;max-height:75vh;min-height:0px;flex-direction:column;overflow:hidden}.axm-permissions-editor.--fill-height{max-height:none}.axm-permissions-editor .__frame{display:flex;min-height:0px;flex:1;flex-direction:column;overflow:hidden;border-radius:var(--radius-md, .375rem);border-style:var(--tw-border-style);border-width:1px;border-color:var(--color-border-default);background-color:rgba(var(--ax-sys-color-lightest-surface))}.axm-permissions-editor .__search{flex-shrink:0}.axm-permissions-editor .__body{display:flex;min-height:0px;flex:1;overflow:hidden}.axm-permissions-editor .__groups{position:relative;display:flex;min-height:0px;flex-direction:column;overflow:hidden}.axm-permissions-editor .__groups ax-tabs.__group-tabs{height:100%;min-height:0px;width:100%;gap:0!important;overflow-x:hidden;overflow-y:auto;overscroll-behavior:contain;scrollbar-width:thin;scrollbar-color:rgba(var(--ax-sys-color-border-light-surface, 150 150 150),.7) transparent;scrollbar-gutter:auto}.axm-permissions-editor .__groups ax-tabs.__group-tabs::-webkit-scrollbar{width:6px}.axm-permissions-editor .__groups ax-tabs.__group-tabs::-webkit-scrollbar-track{background:transparent}.axm-permissions-editor .__groups ax-tabs.__group-tabs::-webkit-scrollbar-thumb{background-color:rgba(var(--ax-sys-color-border-light-surface, 150 150 150),.7);border-radius:999px;border:2px solid transparent;background-clip:content-box}.axm-permissions-editor .__groups ax-tabs.__group-tabs .ax-tabs-scroll-area{gap:0!important;width:100%;min-width:0;flex:none}.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-start,.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-end{align-items:stretch}.axm-permissions-editor .__groups ax-tabs.__group-tabs ax-tab-item{border-radius:0!important}.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-with-line.ax-start ax-tab-item,.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-with-line-color.ax-start ax-tab-item{align-items:flex-start;width:100%;padding-block:.375rem!important;padding-inline:.75rem!important}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab{position:relative;display:flex;width:100%;align-items:flex-start;padding-inline-end:1.75rem}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-main{display:flex;min-width:0px;flex:1;flex-direction:column;gap:calc(var(--spacing, .25rem) * .5)}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-title{font-size:var(--text-sm, .875rem);line-height:var(--tw-leading, var(--text-sm--line-height, calc(1.25 / .875)));--tw-leading: var(--leading-snug, 1.375);line-height:var(--leading-snug, 1.375);--tw-font-weight: var(--font-weight-medium, 500);font-weight:var(--font-weight-medium, 500)}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-description{font-size:var(--text-xs, .75rem);line-height:var(--tw-leading, var(--text-xs--line-height, calc(1 / .75)));--tw-leading: var(--leading-snug, 1.375);line-height:var(--leading-snug, 1.375);--tw-font-weight: var(--font-weight-normal, 400);font-weight:var(--font-weight-normal, 400);white-space:normal;color:rgba(var(--ax-sys-color-text-default))}@supports (color: color-mix(in lab,red,red)){.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-description{color:color-mix(in oklab,rgba(var(--ax-sys-color-text-default)) 80%,transparent)}}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-badge{position:absolute;inset-inline-end:0;top:.125rem}.axm-permissions-editor .__permissions{display:flex;min-height:0px;flex-direction:column;overflow:hidden}.axm-permissions-editor .__permissions .__header{flex-shrink:0}.axm-permissions-editor .__permissions .__header .__title{font-size:1rem;font-weight:500;line-height:1rem}.axm-permissions-editor .__permissions .__content{min-height:0px;flex:1;overflow-y:auto;overscroll-behavior:contain;padding-inline-start:1.25rem}.axm-permissions-editor .__permissions .__content .__section{display:flex;flex-direction:column;gap:var(--spacing, .25rem)}.axm-permissions-editor .__permissions .__content .__section .__section-header{margin-bottom:var(--spacing, .25rem);border-bottom-style:var(--tw-border-style);border-bottom-width:1px;border-color:rgba(var(--ax-sys-color-border-lightest-surface));padding-bottom:var(--spacing, .25rem)}.axm-permissions-editor .__permissions .__content .__section .__section-header .__section-title{font-size:var(--text-sm, .875rem);line-height:var(--tw-leading, var(--text-sm--line-height, calc(1.25 / .875)));--tw-font-weight: var(--font-weight-semibold, 600);font-weight:var(--font-weight-semibold, 600);color:rgba(var(--ax-sys-color-text-default))}@supports (color: color-mix(in lab,red,red)){.axm-permissions-editor .__permissions .__content .__section .__section-header .__section-title{color:color-mix(in oklab,rgba(var(--ax-sys-color-text-default)) 80%,transparent)}}.axm-permissions-editor .__permissions .__content .__list{width:100%}.axm-permissions-editor .__permissions .__content .__list .__item{padding-block:var(--spacing, .25rem);padding-inline-start:var(--spacing, .25rem)}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box{display:block;width:100%}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box .ax-checkbox-label{align-items:flex-start;width:100%}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box .ax-checkbox-start-side{flex:none;align-self:flex-start;padding-top:4px}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box .ax-checkbox-end-side{min-width:0;flex:1}.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label{display:flex;flex-direction:column;gap:calc(var(--spacing, .25rem) * .5)}.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label .__permission-title{font-size:var(--text-sm, .875rem);line-height:var(--tw-leading, var(--text-sm--line-height, calc(1.25 / .875)));--tw-font-weight: var(--font-weight-medium, 500);font-weight:var(--font-weight-medium, 500);line-height:calc(var(--spacing, .25rem) * 5)}.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label .__permission-description{font-size:var(--text-xs, .75rem);line-height:var(--tw-leading, var(--text-xs--line-height, calc(1 / .75)));--tw-leading: var(--leading-snug, 1.375);line-height:var(--leading-snug, 1.375);--tw-font-weight: var(--font-weight-normal, 400);font-weight:var(--font-weight-normal, 400);white-space:normal;color:rgba(var(--ax-sys-color-text-default))}@supports (color: color-mix(in lab,red,red)){.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label .__permission-description{color:color-mix(in oklab,rgba(var(--ax-sys-color-text-default)) 80%,transparent)}}.axm-permissions-editor .__permissions .__content .__list .__item .__children{margin-inline-start:calc(var(--spacing, .25rem) * 2);margin-top:var(--spacing, .25rem);border-left-style:var(--tw-border-style);border-left-width:1px;--tw-border-style: dashed;border-style:dashed;border-color:rgba(var(--ax-sys-color-border-lighter-surface));padding-inline-start:calc(var(--spacing, .25rem) * 2)}.axm-permissions-editor .__permissions.__permissions--search{width:100%}.axm-permissions-editor .__permissions.__permissions--search .__search-results{min-height:0px;width:100%;flex:1;overflow-y:auto;overscroll-behavior:contain}.axm-permissions-editor .__permissions.__permissions--search .__search-group .__content{flex:none;overflow:visible;min-height:0}.axm-permissions-editor .__permissions.__permissions--search .__search-group:not(:last-child){border-bottom-style:var(--tw-border-style);border-bottom-width:1px;border-color:rgba(var(--ax-sys-color-lightest-surface))}@property --tw-border-style{syntax: \"*\"; inherits: false; initial-value: solid;}@property --tw-leading{syntax: \"*\"; inherits: false;}@property --tw-font-weight{syntax: \"*\"; inherits: false;}@layer properties{@supports ((-webkit-hyphens: none) and (not (margin-trim: inline))) or ((-moz-orient: inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-border-style: solid;--tw-leading: initial;--tw-font-weight: initial}}}\n/*! tailwindcss v4.3.3 | MIT License | https://tailwindcss.com */\n"], dependencies: [{ kind: "ngmodule", type: 
+                // Angular
+                CommonModule }, { kind: "directive", type: i1.NgTemplateOutlet, selector: "[ngTemplateOutlet]", inputs: ["ngTemplateOutletContext", "ngTemplateOutlet", "ngTemplateOutletInjector"] }, { kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i2.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i2.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "ngmodule", type: AXCommonModule }, { kind: "directive", type: i3.AXAutoFocusDirective, selector: "[axAutoFocus]", inputs: ["axAutoFocus", "axAutoFocusTime"] }, { kind: "ngmodule", type: 
+                // ACoreX
+                AXFormModule }, { kind: "ngmodule", type: AXTextBoxModule }, { kind: "ngmodule", type: AXButtonModule }, { kind: "component", type: i4.AXButtonComponent, selector: "ax-button", inputs: ["disabled", "size", "tabIndex", "color", "look", "text", "toggleable", "selected", "iconOnly", "type", "loadingText"], outputs: ["onBlur", "onFocus", "onClick", "selectedChange", "toggleableChange", "lookChange", "colorChange", "disabledChange", "loadingTextChange"] }, { kind: "ngmodule", type: AXLabelModule }, { kind: "component", type: i5.AXLabelComponent, selector: "ax-label", inputs: ["required", "for"], outputs: ["requiredChange"] }, { kind: "ngmodule", type: AXCheckBoxModule }, { kind: "component", type: i6.AXCheckBoxComponent, selector: "ax-check-box", inputs: ["disabled", "tabIndex", "readonly", "color", "value", "name", "id", "isLoading", "indeterminate"], outputs: ["onBlur", "onFocus", "valueChange", "onValueChanged"] }, { kind: "ngmodule", type: AXTabsModule }, { kind: "component", type: i7.AXTabsComponent, selector: "ax-tabs", inputs: ["look", "location", "fitParent", "minWidth", "content"], outputs: ["onActiveTabChanged"] }, { kind: "component", type: i7.AXTabItemComponent, selector: "ax-tab-item", inputs: ["disabled", "text", "key", "headerTemplate", "active"], outputs: ["disabledChange", "onClick", "onBlur", "onFocus", "activeChange"] }, { kind: "ngmodule", type: AXDecoratorModule }, { kind: "component", type: i8.AXDecoratorClearButtonComponent, selector: "ax-clear-button", inputs: ["icon"] }, { kind: "component", type: i8.AXDecoratorGenericComponent, selector: "ax-footer, ax-header, ax-content, ax-divider, ax-form-hint, ax-prefix, ax-suffix, ax-text, ax-title, ax-subtitle, ax-placeholder, ax-overlay" }, { kind: "ngmodule", type: AXTranslationModule }, { kind: "ngmodule", type: AXBadgeModule }, { kind: "component", type: i9.AXBadgeComponent, selector: "ax-badge", inputs: ["color", "look", "text"] }, { kind: "ngmodule", type: AXTooltipModule }, { kind: "ngmodule", type: AXSkeletonModule }, { kind: "component", type: i10.AXSkeletonComponent, selector: "ax-skeleton", inputs: ["animated"] }, { kind: "ngmodule", type: AXSearchBoxModule }, { kind: "component", type: i11.AXSearchBoxComponent, selector: "ax-search-box", inputs: ["disabled", "readonly", "tabIndex", "placeholder", "value", "state", "name", "id", "look", "class", "delayTime", "type", "autoSearch"], outputs: ["valueChange", "stateChange", "onValueChanged", "onBlur", "onFocus", "readonlyChange", "disabledChange", "onKeyDown", "onKeyUp", "onKeyPress"] }, { kind: "component", type: AXPStateMessageComponent, selector: "axp-state-message", inputs: ["mode", "icon", "title", "description", "titleParams", "descriptionParams", "look"] }, { kind: "pipe", type: i1.AsyncPipe, name: "async" }, { kind: "pipe", type: i12.AXTranslatorPipe, name: "translate" }], changeDetection: i0.ChangeDetectionStrategy.Eager, encapsulation: i0.ViewEncapsulation.None }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsEditorComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'axm-permissions-editor', imports: [
+                        // Angular
+                        CommonModule,
+                        FormsModule,
+                        AXCommonModule,
+                        // ACoreX
+                        AXFormModule,
+                        AXTextBoxModule,
+                        AXButtonModule,
+                        AXLabelModule,
+                        AXCheckBoxModule,
+                        AXTabsModule,
+                        AXDecoratorModule,
+                        AXTranslationModule,
+                        AXBadgeModule,
+                        AXCheckBoxModule,
+                        AXTooltipModule,
+                        AXSkeletonModule,
+                        AXSearchBoxModule,
+                        AXPStateMessageComponent,
+                    ], encapsulation: ViewEncapsulation.None, changeDetection: ChangeDetectionStrategy.Eager, host: {
+                        '[class]': 'hostClass()',
+                        '[attr.aria-busy]': 'isEditorLoading() ? "true" : null',
+                    }, template: "<div class=\"__frame\">\n  @if (isEditorLoading()) {\n    <!-- ----- Skeleton while permission groups load ----- -->\n    <div class=\"__body flex min-h-0 flex-1 overflow-hidden\">\n      <div class=\"__groups p-4 w-2/5\" aria-hidden=\"true\">\n        <div class=\"flex flex-col gap-3 h-full\">\n          @for (widthClass of groupSkeletonPlaceholders(); track $index) {\n            <div class=\"flex items-center py-2\">\n              <div class=\"h-5 rounded-md overflow-hidden\" [class]=\"widthClass\">\n                <ax-skeleton\n                  [animated]=\"true\"\n                  style=\"display: block; width: 100%; height: 100%\"\n                ></ax-skeleton>\n              </div>\n            </div>\n          }\n        </div>\n      </div>\n\n      <div\n        class=\"__permissions flex w-3/5 flex-col overflow-hidden border-s\"\n        aria-hidden=\"true\"\n      >\n        <div class=\"__header p-4 border-b border-lightest\">\n          <div class=\"h-6 w-48 rounded-md overflow-hidden\">\n            <ax-skeleton\n              [animated]=\"true\"\n              style=\"display: block; width: 100%; height: 100%\"\n            ></ax-skeleton>\n          </div>\n        </div>\n\n        <div class=\"__content flex flex-col gap-1 p-4\">\n          @for (group of permissionGroupSkeletonPlaceholders(); track $index) {\n            <div class=\"__skeleton-permission-group\">\n              <div class=\"flex items-center gap-2 py-1\">\n                <div class=\"h-4 w-4 shrink-0 rounded-sm overflow-hidden\">\n                  <ax-skeleton\n                    [animated]=\"true\"\n                    style=\"display: block; width: 100%; height: 100%\"\n                  ></ax-skeleton>\n                </div>\n                <div class=\"h-4 w-40 max-w-full rounded-md overflow-hidden\">\n                  <ax-skeleton\n                    [animated]=\"true\"\n                    style=\"display: block; width: 100%; height: 100%\"\n                  ></ax-skeleton>\n                </div>\n                <div class=\"h-3 w-3 shrink-0 rounded-full overflow-hidden\">\n                  <ax-skeleton\n                    [animated]=\"true\"\n                    style=\"display: block; width: 100%; height: 100%\"\n                  ></ax-skeleton>\n                </div>\n              </div>\n\n              <div class=\"__children p-2 mt-1 ms-1\">\n                @for (\n                  childIndex of childSkeletonPlaceholders(group.childCount);\n                  track childIndex\n                ) {\n                  <div class=\"flex items-center gap-2 py-1 ps-2\">\n                    <div class=\"h-4 w-4 shrink-0 rounded-sm overflow-hidden\">\n                      <ax-skeleton\n                        [animated]=\"true\"\n                        style=\"display: block; width: 100%; height: 100%\"\n                      ></ax-skeleton>\n                    </div>\n                    <div class=\"h-4 w-32 max-w-full rounded-md overflow-hidden\">\n                      <ax-skeleton\n                        [animated]=\"true\"\n                        style=\"display: block; width: 100%; height: 100%\"\n                      ></ax-skeleton>\n                    </div>\n                    <div class=\"h-3 w-3 shrink-0 rounded-full overflow-hidden\">\n                      <ax-skeleton\n                        [animated]=\"true\"\n                        style=\"display: block; width: 100%; height: 100%\"\n                      ></ax-skeleton>\n                    </div>\n                  </div>\n                }\n              </div>\n            </div>\n          }\n        </div>\n      </div>\n    </div>\n  }\n  <!-- ----- Loaded editor: search + group/permission columns ----- -->\n  @else {\n    <div class=\"__search px-4 pt-4 pb-3 border-b border-border-lightest\">\n      <ax-search-box\n        [axAutoFocus]\n        [ngModel]=\"searchQuery()\"\n        (onValueChanged)=\"handleSearchChanged($event)\"\n        [placeholder]=\"\n          '@security-management:permissions-feature.components.permissions-editor.search.placeholder'\n            | translate\n            | async\n        \"\n      >\n        <ax-clear-button></ax-clear-button>\n      </ax-search-box>\n    </div>\n\n    <div class=\"__body flex min-h-0 flex-1 overflow-hidden\">\n      @if (isSearchActive()) {\n        <!-- ----- Search results fill both columns ----- -->\n        <div\n          class=\"__permissions __permissions--search flex min-h-0 flex-1 flex-col overflow-hidden\"\n        >\n          @if (hasSearchResults()) {\n            <div class=\"__search-results flex min-h-0 flex-1 flex-col overflow-y-auto\">\n              @for (result of searchResultsGrouped(); track result.group.name) {\n                <section class=\"__search-group shrink-0\">\n                  <div\n                    class=\"__header shrink-0 p-4 border-b border-border-lightest\"\n                  >\n                    <span class=\"h6\">{{\n                      result.group.title | translate | async\n                    }}</span>\n                  </div>\n\n                  <div class=\"__content flex flex-col gap-4 p-4\">\n                    @for (section of result.sections; track section.name) {\n                      <section class=\"__section\">\n                        @if (section.title) {\n                          <div class=\"__section-header\">\n                            <span class=\"__section-title\">{{\n                              section.title | translate | async\n                            }}</span>\n                          </div>\n                        }\n                        <ul class=\"__list\">\n                          <ng-container\n                            *ngTemplateOutlet=\"\n                              recursiveList;\n                              context: { $implicit: section.items }\n                            \"\n                          ></ng-container>\n                        </ul>\n                      </section>\n                    }\n                  </div>\n                </section>\n              }\n            </div>\n          }\n          <!-- ----- Empty search results ----- -->\n          @else {\n            <div class=\"__empty flex flex-1 items-center justify-center p-8\">\n              <axp-state-message\n                icon=\"fa-light fa-search\"\n                [title]=\"\n                  '@security-management:permissions-feature.components.permissions-editor.empty-states.no-results.title'\n                \"\n                [description]=\"\n                  '@security-management:permissions-feature.components.permissions-editor.empty-states.no-results.description'\n                \"\n              >\n              </axp-state-message>\n            </div>\n          }\n        </div>\n      }\n      <!-- ----- Browse mode: groups nav + permissions panel ----- -->\n      @else {\n        <div class=\"__groups w-2/5\">\n          <ax-tabs location=\"start\" look=\"with-line-color\" class=\"__group-tabs\">\n            @for (group of groupsWithBadge(); track group.name) {\n              <ax-tab-item\n                [active]=\"group.name === selectedGroup()?.name\"\n                [key]=\"group.name\"\n                [text]=\"(group.title | translate | async)!\"\n                [headerTemplate]=\"groupTabHeader\"\n                (onClick)=\"handleMenuItemClick(group)\"\n              >\n              </ax-tab-item>\n            }\n          </ax-tabs>\n        </div>\n\n        <div class=\"__permissions flex w-3/5 flex-col overflow-hidden border-s border-border-lightest\">\n          <div class=\"__header shrink-0 p-4 border-b border-border-lightest font-semibold\">\n            <span>{{ $safeNavigationMigration(selectedGroup()?.title)! | translate | async }}</span>\n          </div>\n\n          <div class=\"__content flex flex-col gap-4 p-4\">\n            @for (section of selectedSections(); track section.name) {\n              <section class=\"__section\">\n                @if (section.title) {\n                  <div class=\"__section-header\">\n                    <span class=\"__section-title\">{{\n                      section.title | translate | async\n                    }}</span>\n                  </div>\n                }\n                <ul class=\"__list\">\n                  <ng-container\n                    *ngTemplateOutlet=\"\n                      recursiveList;\n                      context: { $implicit: section.items }\n                    \"\n                  ></ng-container>\n                </ul>\n              </section>\n            }\n          </div>\n        </div>\n      }\n    </div>\n  }\n</div>\n\n@if (isShowActions()) {\n  <!-- ----- Dialog footer actions ----- -->\n  <ax-footer>\n    <ax-suffix>\n      <ax-button\n        look=\"solid\"\n        [text]=\"'@general:actions.cancel.title' | translate | async\"\n        (onClick)=\"handleCancelClick()\"\n      ></ax-button>\n      <ax-button\n        look=\"solid\"\n        color=\"primary\"\n        [text]=\"'@general:actions.select.title' | translate | async\"\n        (onClick)=\"handleSelectClick()\"\n      >\n        <ax-prefix>\n          <i class=\"fa-solid fa-check\"></i>\n        </ax-prefix>\n      </ax-button>\n    </ax-suffix>\n  </ax-footer>\n}\n\n<!-- ----- Left-nav group tab: title + description + badge ----- -->\n<ng-template #groupTabHeader let-ctx>\n  @if (getGroupByKey(ctx.key); as group) {\n    <div class=\"__group-tab\">\n      <div class=\"__group-tab-main\">\n        <div class=\"__group-tab-title\">{{ ctx.text }}</div>\n        @if (group.description) {\n          <div class=\"__group-tab-description\">\n            {{ group.description | translate | async }}\n          </div>\n        }\n      </div>\n      @if (badgeToNumber(group.badge) > 0) {\n        <ax-badge\n          class=\"__group-tab-badge\"\n          [color]=\"'primary'\"\n          [look]=\"'twotone'\"\n          [text]=\"group.badge\"\n        ></ax-badge>\n      }\n    </div>\n  }\n</ng-template>\n\n<ng-template #recursiveList let-items>\n  @for (item of items; track $index) {\n    <li class=\"__item\">\n      <ax-check-box\n        [ngModel]=\"item.isSelected\"\n        [readonly]=\"isReadOnlyMode()\"\n        (onValueChanged)=\"onPermissionToggle(item, $event)\"\n      >\n        <ax-label>\n          <span class=\"__permission-label\">\n            <span class=\"__permission-title\">{{\n              item.title | translate | async\n            }}</span>\n            @if (item.description) {\n              <span class=\"__permission-description\">{{\n                item.description | translate | async\n              }}</span>\n            }\n          </span>\n        </ax-label>\n      </ax-check-box>\n\n      @if (item.children && item.children.length > 0) {\n        <ul class=\"__children p-2 mt-1 ms-1\">\n          <ng-container\n            *ngTemplateOutlet=\"\n              recursiveList;\n              context: { $implicit: item.children }\n            \"\n          ></ng-container>\n        </ul>\n      }\n    </li>\n  }\n</ng-template>\n", styles: ["@layer properties;.axm-permissions-editor{display:flex;height:100%;max-height:75vh;min-height:0px;flex-direction:column;overflow:hidden}.axm-permissions-editor.--fill-height{max-height:none}.axm-permissions-editor .__frame{display:flex;min-height:0px;flex:1;flex-direction:column;overflow:hidden;border-radius:var(--radius-md, .375rem);border-style:var(--tw-border-style);border-width:1px;border-color:var(--color-border-default);background-color:rgba(var(--ax-sys-color-lightest-surface))}.axm-permissions-editor .__search{flex-shrink:0}.axm-permissions-editor .__body{display:flex;min-height:0px;flex:1;overflow:hidden}.axm-permissions-editor .__groups{position:relative;display:flex;min-height:0px;flex-direction:column;overflow:hidden}.axm-permissions-editor .__groups ax-tabs.__group-tabs{height:100%;min-height:0px;width:100%;gap:0!important;overflow-x:hidden;overflow-y:auto;overscroll-behavior:contain;scrollbar-width:thin;scrollbar-color:rgba(var(--ax-sys-color-border-light-surface, 150 150 150),.7) transparent;scrollbar-gutter:auto}.axm-permissions-editor .__groups ax-tabs.__group-tabs::-webkit-scrollbar{width:6px}.axm-permissions-editor .__groups ax-tabs.__group-tabs::-webkit-scrollbar-track{background:transparent}.axm-permissions-editor .__groups ax-tabs.__group-tabs::-webkit-scrollbar-thumb{background-color:rgba(var(--ax-sys-color-border-light-surface, 150 150 150),.7);border-radius:999px;border:2px solid transparent;background-clip:content-box}.axm-permissions-editor .__groups ax-tabs.__group-tabs .ax-tabs-scroll-area{gap:0!important;width:100%;min-width:0;flex:none}.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-start,.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-end{align-items:stretch}.axm-permissions-editor .__groups ax-tabs.__group-tabs ax-tab-item{border-radius:0!important}.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-with-line.ax-start ax-tab-item,.axm-permissions-editor .__groups ax-tabs.__group-tabs.ax-with-line-color.ax-start ax-tab-item{align-items:flex-start;width:100%;padding-block:.375rem!important;padding-inline:.75rem!important}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab{position:relative;display:flex;width:100%;align-items:flex-start;padding-inline-end:1.75rem}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-main{display:flex;min-width:0px;flex:1;flex-direction:column;gap:calc(var(--spacing, .25rem) * .5)}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-title{font-size:var(--text-sm, .875rem);line-height:var(--tw-leading, var(--text-sm--line-height, calc(1.25 / .875)));--tw-leading: var(--leading-snug, 1.375);line-height:var(--leading-snug, 1.375);--tw-font-weight: var(--font-weight-medium, 500);font-weight:var(--font-weight-medium, 500)}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-description{font-size:var(--text-xs, .75rem);line-height:var(--tw-leading, var(--text-xs--line-height, calc(1 / .75)));--tw-leading: var(--leading-snug, 1.375);line-height:var(--leading-snug, 1.375);--tw-font-weight: var(--font-weight-normal, 400);font-weight:var(--font-weight-normal, 400);white-space:normal;color:rgba(var(--ax-sys-color-text-default))}@supports (color: color-mix(in lab,red,red)){.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-description{color:color-mix(in oklab,rgba(var(--ax-sys-color-text-default)) 80%,transparent)}}.axm-permissions-editor .__groups ax-tabs.__group-tabs .__group-tab .__group-tab-badge{position:absolute;inset-inline-end:0;top:.125rem}.axm-permissions-editor .__permissions{display:flex;min-height:0px;flex-direction:column;overflow:hidden}.axm-permissions-editor .__permissions .__header{flex-shrink:0}.axm-permissions-editor .__permissions .__header .__title{font-size:1rem;font-weight:500;line-height:1rem}.axm-permissions-editor .__permissions .__content{min-height:0px;flex:1;overflow-y:auto;overscroll-behavior:contain;padding-inline-start:1.25rem}.axm-permissions-editor .__permissions .__content .__section{display:flex;flex-direction:column;gap:var(--spacing, .25rem)}.axm-permissions-editor .__permissions .__content .__section .__section-header{margin-bottom:var(--spacing, .25rem);border-bottom-style:var(--tw-border-style);border-bottom-width:1px;border-color:rgba(var(--ax-sys-color-border-lightest-surface));padding-bottom:var(--spacing, .25rem)}.axm-permissions-editor .__permissions .__content .__section .__section-header .__section-title{font-size:var(--text-sm, .875rem);line-height:var(--tw-leading, var(--text-sm--line-height, calc(1.25 / .875)));--tw-font-weight: var(--font-weight-semibold, 600);font-weight:var(--font-weight-semibold, 600);color:rgba(var(--ax-sys-color-text-default))}@supports (color: color-mix(in lab,red,red)){.axm-permissions-editor .__permissions .__content .__section .__section-header .__section-title{color:color-mix(in oklab,rgba(var(--ax-sys-color-text-default)) 80%,transparent)}}.axm-permissions-editor .__permissions .__content .__list{width:100%}.axm-permissions-editor .__permissions .__content .__list .__item{padding-block:var(--spacing, .25rem);padding-inline-start:var(--spacing, .25rem)}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box{display:block;width:100%}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box .ax-checkbox-label{align-items:flex-start;width:100%}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box .ax-checkbox-start-side{flex:none;align-self:flex-start;padding-top:4px}.axm-permissions-editor .__permissions .__content .__list .__item ax-check-box .ax-checkbox-end-side{min-width:0;flex:1}.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label{display:flex;flex-direction:column;gap:calc(var(--spacing, .25rem) * .5)}.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label .__permission-title{font-size:var(--text-sm, .875rem);line-height:var(--tw-leading, var(--text-sm--line-height, calc(1.25 / .875)));--tw-font-weight: var(--font-weight-medium, 500);font-weight:var(--font-weight-medium, 500);line-height:calc(var(--spacing, .25rem) * 5)}.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label .__permission-description{font-size:var(--text-xs, .75rem);line-height:var(--tw-leading, var(--text-xs--line-height, calc(1 / .75)));--tw-leading: var(--leading-snug, 1.375);line-height:var(--leading-snug, 1.375);--tw-font-weight: var(--font-weight-normal, 400);font-weight:var(--font-weight-normal, 400);white-space:normal;color:rgba(var(--ax-sys-color-text-default))}@supports (color: color-mix(in lab,red,red)){.axm-permissions-editor .__permissions .__content .__list .__item .__permission-label .__permission-description{color:color-mix(in oklab,rgba(var(--ax-sys-color-text-default)) 80%,transparent)}}.axm-permissions-editor .__permissions .__content .__list .__item .__children{margin-inline-start:calc(var(--spacing, .25rem) * 2);margin-top:var(--spacing, .25rem);border-left-style:var(--tw-border-style);border-left-width:1px;--tw-border-style: dashed;border-style:dashed;border-color:rgba(var(--ax-sys-color-border-lighter-surface));padding-inline-start:calc(var(--spacing, .25rem) * 2)}.axm-permissions-editor .__permissions.__permissions--search{width:100%}.axm-permissions-editor .__permissions.__permissions--search .__search-results{min-height:0px;width:100%;flex:1;overflow-y:auto;overscroll-behavior:contain}.axm-permissions-editor .__permissions.__permissions--search .__search-group .__content{flex:none;overflow:visible;min-height:0}.axm-permissions-editor .__permissions.__permissions--search .__search-group:not(:last-child){border-bottom-style:var(--tw-border-style);border-bottom-width:1px;border-color:rgba(var(--ax-sys-color-lightest-surface))}@property --tw-border-style{syntax: \"*\"; inherits: false; initial-value: solid;}@property --tw-leading{syntax: \"*\"; inherits: false;}@property --tw-font-weight{syntax: \"*\"; inherits: false;}@layer properties{@supports ((-webkit-hyphens: none) and (not (margin-trim: inline))) or ((-moz-orient: inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-border-style: solid;--tw-leading: initial;--tw-font-weight: initial}}}\n/*! tailwindcss v4.3.3 | MIT License | https://tailwindcss.com */\n"] }]
+        }], ctorParameters: () => [], propDecorators: { initialPermissions: [{ type: i0.Input, args: [{ isSignal: true, alias: "initialPermissions", required: false }] }], readOnly: [{ type: i0.Input, args: [{ isSignal: true, alias: "readOnly", required: false }] }], showActions: [{ type: i0.Input, args: [{ isSignal: true, alias: "showActions", required: false }] }], fillHeight: [{ type: i0.Input, args: [{ isSignal: true, alias: "fillHeight", required: false }] }], permissionsChanged: [{ type: i0.Output, args: ["permissionsChanged"] }], permissionsSelected: [{ type: i0.Output, args: ["permissionsSelected"] }] } });
+
+var permissionsEditor_component = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXPPermissionsEditorComponent: AXPPermissionsEditorComponent
+});
+
+//#region ----- Imports -----
+//#endregion
+//#region ----- Service -----
+/**
+ * Loads and persists scoped RolePermission grants for a role.
+ * Shared by the Assign Permissions dialog and the Role permissions detail page.
+ */
+class AXMRolePermissionGrantService {
+    constructor() {
+        //#region ----- Services & Dependencies -----
+        this.entityRegistry = inject(AXPEntityDefinitionRegistryService);
+        this.entityService = inject(AXPEntityService);
+        this.sessionService = inject(AXPSessionService);
+        this.entityEvents = inject(AXPEntityBroadcastService);
+    }
+    //#endregion
+    //#region ----- Scope -----
+    resolveSessionScope() {
+        const tenantId = this.sessionService.tenant?.id;
+        if (!tenantId) {
+            return null;
+        }
+        return {
+            tenantId,
+            applicationId: this.sessionService.application?.id,
+        };
+    }
+    //#endregion
+    //#region ----- Query -----
+    rolePermissionData() {
+        return this.entityService
+            .withEntity(RootConfig.module.name, RootConfig.entities.rolePermission.name)
+            .data();
+    }
+    async findGrant(roleId, tenantId, applicationId) {
+        const result = await this.rolePermissionData().query({
+            skip: 0,
+            take: 50,
+            filter: {
+                logic: 'and',
+                filters: [
+                    { field: 'roleId', operator: { type: 'equal' }, value: roleId },
+                    { field: 'scopeInfo.tenantId', operator: { type: 'equal' }, value: tenantId },
+                ],
+            },
+        });
+        const items = (result?.items ?? []);
+        if (items.length === 0) {
+            return null;
+        }
+        if (applicationId) {
+            const appMatch = items.find((item) => item.scopeInfo?.applicationId === applicationId);
+            if (appMatch) {
+                return appMatch;
+            }
+        }
+        const tenantWide = items.find((item) => !item.scopeInfo?.applicationId);
+        return tenantWide ?? items[0] ?? null;
+    }
+    //#endregion
+    //#region ----- Persist -----
+    async saveGrant(options) {
+        const existingState = options.existing?.stateInfo;
+        if (existingState?.isSystem === true || existingState?.isImmutable === true) {
+            throw new Error('System role permission grants are readonly.');
+        }
+        const entityKey = `${RootConfig.module.name}.${RootConfig.entities.rolePermission.name}`;
+        const [moduleName, entityName] = entityKey.split('.');
+        const entityRef = await this.entityRegistry.resolve(moduleName, entityName);
+        const scopeInfo = {
+            tenantId: options.tenantId,
+            ...(options.existing?.scopeInfo?.applicationId
+                ? { applicationId: options.existing.scopeInfo.applicationId }
+                : options.applicationId
+                    ? { applicationId: options.applicationId }
+                    : {}),
+        };
+        if (options.existing?.id) {
+            const updatePayload = {
+                ...options.existing,
+                roleId: options.roleId,
+                permissions: options.permissions,
+                scopeInfo,
+            };
+            return (entityRef.commands?.update?.execute)(updatePayload);
+        }
+        const createPayload = {
+            roleId: options.roleId,
+            permissions: options.permissions,
+            scopeInfo,
+        };
+        return (entityRef.commands?.create?.execute)(createPayload);
+    }
+    notifyGrantModified(saved) {
+        const entityKey = `${RootConfig.module.name}.${RootConfig.entities.rolePermission.name}`;
+        dispatchEntityModifiedSideEffects(this.entityEvents, entityKey, saved);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionGrantService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionGrantService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionGrantService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+//#endregion
+//#region ----- Command -----
+class AXMAssignPermissionsCommand {
+    constructor() {
+        //#region ----- Services & Dependencies -----
+        this.popupService = inject(AXPopupService);
+        this.translationService = inject(AXTranslationService);
+        this.toastService = inject(AXToastService);
+        this.settingsService = inject(AXPSettingsService);
+        this.grantService = inject(AXMRolePermissionGrantService);
+    }
+    //#endregion
+    //#region ----- Execute -----
+    async execute(input) {
+        try {
+            const role = input.data;
+            if (!role || !isString(role['id']) || isEmpty(role['id'])) {
+                return {
+                    success: false,
+                    message: {
+                        text: await this.translationService.translateAsync('@general:messages.entity.invalid-data'),
+                    },
+                };
+            }
+            const roleId = role['id'];
+            const scope = this.grantService.resolveSessionScope();
+            if (!scope) {
+                return {
+                    success: false,
+                    message: {
+                        text: await this.translationService.translateAsync('@general:messages.entity.invalid-data'),
+                    },
+                };
+            }
+            const existingGrant = await this.grantService.findGrant(roleId, scope.tenantId, scope.applicationId);
+            const grantReadonly = existingGrant?.stateInfo?.isSystem === true || existingGrant?.stateInfo?.isImmutable === true;
+            const component = await Promise.resolve().then(function () { return permissionsEditor_component; }).then((m) => m.AXPPermissionsEditorComponent);
+            const editorTitle = await this.translationService.translateAsync('@security-management:permissions-feature.terms.permissions-editor');
+            const roleTitle = this.resolveRoleTitle(role['title']);
+            const initialPermissions = existingGrant?.permissions ?? [];
+            const popupResult = await this.popupService.open(component, {
+                title: roleTitle ? `${editorTitle} - ${roleTitle}` : editorTitle,
+                size: 'md',
+                data: {
+                    initialPermissions,
+                    showActions: !grantReadonly,
+                    readOnly: grantReadonly,
+                },
+            });
+            const permissions = popupResult?.data;
+            if (!isArray(permissions) || grantReadonly) {
+                return { success: true, kind: 'object', data: null, metadata: { refresh: false } };
+            }
+            const saved = await this.grantService.saveGrant({
+                existing: existingGrant,
+                roleId,
+                permissions: permissions,
+                tenantId: scope.tenantId,
+                applicationId: scope.applicationId,
+            });
+            await this.showSuccessToast();
+            this.grantService.notifyGrantModified(saved);
+            return {
+                success: true,
+                kind: 'object',
+                data: permissions,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Failed to assign permissions.';
+            return {
+                success: false,
+                message: { text: message },
+            };
+        }
+    }
+    //#endregion
+    //#region ----- Utility Methods -----
+    resolveRoleTitle(title) {
+        if (!title) {
+            return '';
+        }
+        const locale = this.translationService.getActiveLang?.() ?? 'en-US';
+        if (isString(title)) {
+            return resolveMultiLanguageString(title, locale).trim();
+        }
+        return resolveMultiLanguageString(String(title), locale).trim();
+    }
+    async showSuccessToast() {
+        const enableOperationToasts = await this.settingsService.get(AXPCommonSettings.EnableOperationToasts);
+        if (!enableOperationToasts) {
+            return;
+        }
+        this.toastService.show({
+            color: 'success',
+            title: await this.translationService.translateAsync('@general:workflow.entity-modified-title'),
+            content: await this.translationService.translateAsync('@general:workflow.entity-modified-body'),
+        });
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMAssignPermissionsCommand, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMAssignPermissionsCommand }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMAssignPermissionsCommand, decorators: [{
+            type: Injectable
+        }] });
+
+var assignPermissions_command = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXMAssignPermissionsCommand: AXMAssignPermissionsCommand
+});
+
+/**
+ * Resolves a persisted host entity id from wizard/details context (supports id, _id, string or number).
+ */
+function resolvePersistedEntityId(ctx) {
+    if (!ctx) {
+        return undefined;
+    }
+    const raw = ctx['id'] ?? ctx['_id'];
+    if (typeof raw === 'string' && raw.length > 0) {
+        return raw;
+    }
+    if (typeof raw === 'number' && !Number.isNaN(raw)) {
+        return String(raw);
+    }
+    return undefined;
+}
+
+//#endregion
+//#region ----- Constants -----
+/** Local command handled in execute(); reverts permissions to the loaded grant baseline. */
+const ROLE_PERMISSIONS_DISCARD_COMMAND = 'Role:Permissions:Discard';
+/** Local command handled in execute(); persists the scoped RolePermission grant. */
+const ROLE_PERMISSIONS_SAVE_COMMAND = 'Role:Permissions:Save';
+//#endregion
+//#region ----- Component -----
+/**
+ * Role detail/create wizard page that edits scoped RolePermission grants.
+ * Extends AXPPageLayoutBaseComponent for Save/Discard footer actions and dirty tracking.
+ */
+class AXMRolePermissionsPageComponent extends AXPPageLayoutBaseComponent {
+    //#endregion
+    //#region ----- Lifecycle -----
+    constructor() {
+        super();
+        //#region ----- Inputs -----
+        this.rootContext = input(/* @ts-ignore */
+        ...(ngDevMode ? [undefined, { debugName: "rootContext" }] : /* istanbul ignore next */ []));
+        /** Optional page config set by the page-component-renderer. */
+        this.pageConfig = input(/* @ts-ignore */
+        ...(ngDevMode ? [undefined, { debugName: "pageConfig" }] : /* istanbul ignore next */ []));
+        //#endregion
+        //#region ----- Services & Dependencies -----
+        this.grantService = inject(AXMRolePermissionGrantService);
+        this.hostPageLayout = inject(AXPPageLayoutBase, { optional: true, skipSelf: true });
+        //#endregion
+        //#region ----- State Signals -----
+        this.loadedRoleId = signal(undefined, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "loadedRoleId" }] : /* istanbul ignore next */ []));
+        this.existingGrant = signal(null, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "existingGrant" }] : /* istanbul ignore next */ []));
+        this.baselinePermissions = signal([], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "baselinePermissions" }] : /* istanbul ignore next */ []));
+        this.currentPermissions = signal([], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "currentPermissions" }] : /* istanbul ignore next */ []));
+        this.isLoading = signal(true, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isLoading" }] : /* istanbul ignore next */ []));
+        /** Bumps when the editor should remount with a new initialPermissions snapshot (e.g. after discard). */
+        this.editorResetToken = signal(0, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "editorResetToken" }] : /* istanbul ignore next */ []));
+        //#endregion
+        //#region ----- Computed Properties -----
+        this.roleId = computed(() => resolvePersistedEntityId(this.rootContext()), /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "roleId" }] : /* istanbul ignore next */ []));
+        this.editorPermissions = computed(() => {
+            // Depend on reset token so discard remounts the editor with baseline values.
+            this.editorResetToken();
+            return [...this.currentPermissions()];
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "editorPermissions" }] : /* istanbul ignore next */ []));
+        this.isDirty = computed(() => {
+            return !this.arePermissionSetsEqual(this.baselinePermissions(), this.currentPermissions());
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isDirty" }] : /* istanbul ignore next */ []));
+        /** System RolePermission grants are seeded and not editable in product/platform UI. */
+        this.isGrantReadonly = computed(() => {
+            const state = this.existingGrant()?.stateInfo;
+            return state?.isSystem === true || state?.isImmutable === true;
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isGrantReadonly" }] : /* istanbul ignore next */ []));
+        effect(() => {
+            const id = this.roleId();
+            // Avoid re-running when loadGrantForRole mutates its own loading/baseline signals.
+            untracked(() => {
+                void this.loadGrantForRole(id);
+            });
+        });
+    }
+    //#endregion
+    //#region ----- Unsaved Changes -----
+    hasUnsavedChanges() {
+        return this.isDirty();
+    }
+    //#endregion
+    //#region ----- Page Actions -----
+    async getPrimaryMenuItems() {
+        const discardTitle = (await this.translateService.translateAsync('@general:actions.discard.title')) || 'Discard';
+        const saveTitle = (await this.translateService.translateAsync('@general:actions.save.title')) || 'Save';
+        const canEdit = !!this.roleId() && !this.isLoading() && !this.isGrantReadonly();
+        const discardAction = {
+            title: discardTitle,
+            icon: 'fa-light fa-rotate-left',
+            zone: 'footer',
+            priority: 'secondary',
+            color: 'default',
+            visible: canEdit && this.isDirty(),
+            command: {
+                name: ROLE_PERMISSIONS_DISCARD_COMMAND,
+                options: {},
+            },
+        };
+        const saveAction = {
+            title: saveTitle,
+            icon: 'fa-light fa-floppy-disk',
+            zone: 'footer',
+            priority: 'primary',
+            color: 'primary',
+            visible: canEdit && this.isDirty(),
+            command: {
+                name: ROLE_PERMISSIONS_SAVE_COMMAND,
+                options: {},
+            },
+        };
+        return [discardAction, saveAction];
+    }
+    //#endregion
+    //#region ----- Command Handling -----
+    execute(command) {
+        if (command.name === ROLE_PERMISSIONS_DISCARD_COMMAND) {
+            this.handleDiscard();
+            return;
+        }
+        if (command.name !== ROLE_PERMISSIONS_SAVE_COMMAND) {
+            return;
+        }
+        return this.handleSaveExecute();
+    }
+    async handleSaveExecute() {
+        const roleId = this.roleId();
+        const scope = this.grantService.resolveSessionScope();
+        if (!roleId || !scope) {
+            return {
+                success: false,
+                message: {
+                    text: await this.translateService.translateAsync('@general:messages.entity.invalid-data'),
+                },
+            };
+        }
+        try {
+            const permissions = [...this.currentPermissions()];
+            const saved = await this.grantService.saveGrant({
+                existing: this.existingGrant(),
+                roleId,
+                permissions,
+                tenantId: scope.tenantId,
+                applicationId: scope.applicationId,
+            });
+            const nextGrant = {
+                id: String(saved['id'] ?? this.existingGrant()?.id ?? ''),
+                roleId,
+                permissions,
+                scopeInfo: saved['scopeInfo'] ?? this.existingGrant()?.scopeInfo,
+            };
+            this.existingGrant.set(nextGrant.id ? nextGrant : this.existingGrant());
+            this.baselinePermissions.set([...permissions]);
+            this.currentPermissions.set([...permissions]);
+            this.grantService.notifyGrantModified(saved);
+            this.recompute();
+            return {
+                success: true,
+                kind: 'object',
+                data: permissions,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Failed to save permissions.';
+            return {
+                success: false,
+                message: { text: message },
+            };
+        }
+    }
+    //#endregion
+    //#region ----- Event Handlers -----
+    onPermissionsChanged(permissions) {
+        if (this.arePermissionSetsEqual(this.currentPermissions(), permissions)) {
+            return;
+        }
+        this.currentPermissions.set([...permissions]);
+        this.recompute();
+    }
+    handleDiscard() {
+        const baseline = [...this.baselinePermissions()];
+        this.currentPermissions.set(baseline);
+        this.editorResetToken.update((token) => token + 1);
+        this.recompute();
+    }
+    //#endregion
+    //#region ----- Wizard step context -----
+    /**
+     * Do not merge permissions into the Role create/update payload.
+     * Grants live on SecurityManagement.RolePermission only.
+     */
+    getWizardStepContext() {
+        return null;
+    }
+    //#endregion
+    //#region ----- Data Loading -----
+    async loadGrantForRole(roleId) {
+        if (!roleId) {
+            this.loadedRoleId.set(undefined);
+            this.existingGrant.set(null);
+            this.baselinePermissions.set([]);
+            this.currentPermissions.set([]);
+            this.isLoading.set(false);
+            this.recompute();
+            return;
+        }
+        if (roleId === this.loadedRoleId() && !this.isLoading()) {
+            return;
+        }
+        this.isLoading.set(true);
+        this.recompute();
+        const scope = this.grantService.resolveSessionScope();
+        if (!scope) {
+            this.loadedRoleId.set(roleId);
+            this.existingGrant.set(null);
+            this.baselinePermissions.set([]);
+            this.currentPermissions.set([]);
+            this.isLoading.set(false);
+            this.recompute();
+            return;
+        }
+        try {
+            const grant = await this.grantService.findGrant(roleId, scope.tenantId, scope.applicationId);
+            const permissions = [...(grant?.permissions ?? [])];
+            this.loadedRoleId.set(roleId);
+            this.existingGrant.set(grant);
+            this.baselinePermissions.set(permissions);
+            this.currentPermissions.set([...permissions]);
+            this.editorResetToken.update((token) => token + 1);
+        }
+        catch {
+            this.loadedRoleId.set(roleId);
+            this.existingGrant.set(null);
+            this.baselinePermissions.set([]);
+            this.currentPermissions.set([]);
+        }
+        finally {
+            this.isLoading.set(false);
+            this.recompute();
+        }
+    }
+    //#endregion
+    //#region ----- Utility Methods -----
+    arePermissionSetsEqual(a, b) {
+        return isEqual([...a].sort(), [...b].sort());
+    }
+    recompute() {
+        super.recompute();
+        const maybeLayout = this.hostPageLayout;
+        maybeLayout?.recompute?.();
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionsPageComponent, deps: [], target: i0.ɵɵFactoryTarget.Component }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.0.8", type: AXMRolePermissionsPageComponent, isStandalone: true, selector: "axm-role-permissions-page", inputs: { rootContext: { classPropertyName: "rootContext", publicName: "rootContext", isSignal: true, isRequired: false, transformFunction: null }, pageConfig: { classPropertyName: "pageConfig", publicName: "pageConfig", isSignal: true, isRequired: false, transformFunction: null } }, host: { classAttribute: "flex h-full min-h-0 flex-1 flex-col overflow-hidden" }, providers: [
+            {
+                provide: AXPPageLayoutBase,
+                useExisting: AXMRolePermissionsPageComponent,
+            },
+        ], usesInheritance: true, ngImport: i0, template: "@if (isLoading()) {\n  <!-- ----- Loading grant while role permissions are fetched ----- -->\n  <div class=\"flex h-full min-h-[20rem] items-center justify-center p-6\">\n    <ax-loading></ax-loading>\n  </div>\n}\n<!-- ----- Role must be persisted before grants can be edited ----- -->\n@else if (!roleId()) {\n  <div class=\"flex h-full min-h-[20rem] items-center justify-center p-6\">\n    <axp-state-message\n      [title]=\"'@security-management:roles.entities.role.pages.permissions.save-role-first.title'\"\n      [description]=\"'@security-management:roles.entities.role.pages.permissions.save-role-first.description'\"\n    ></axp-state-message>\n  </div>\n}\n<!-- ----- Full-page permissions editor for the scoped RolePermission grant ----- -->\n@else {\n  <div class=\"flex h-full min-h-0 flex-1 flex-col overflow-hidden p-4\">\n    <!-- ----- Remount editor when discard/load resets the selection baseline ----- -->\n    @for (token of [editorResetToken()]; track token) {\n      <axm-permissions-editor\n        [initialPermissions]=\"editorPermissions()\"\n        [readOnly]=\"isGrantReadonly()\"\n        [fillHeight]=\"true\"\n        (permissionsChanged)=\"onPermissionsChanged($event)\"\n      ></axm-permissions-editor>\n    }\n  </div>\n}\n", dependencies: [{ kind: "component", type: AXPPermissionsEditorComponent, selector: "axm-permissions-editor", inputs: ["initialPermissions", "readOnly", "showActions", "fillHeight"], outputs: ["permissionsChanged", "permissionsSelected"] }, { kind: "component", type: AXPStateMessageComponent, selector: "axp-state-message", inputs: ["mode", "icon", "title", "description", "titleParams", "descriptionParams", "look"] }, { kind: "ngmodule", type: AXLoadingModule }, { kind: "component", type: i1$1.AXLoadingComponent, selector: "ax-loading", inputs: ["visible", "type", "context"], outputs: ["visibleChange"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionsPageComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'axm-role-permissions-page', standalone: true, imports: [AXPPermissionsEditorComponent, AXPStateMessageComponent, AXLoadingModule], changeDetection: ChangeDetectionStrategy.OnPush, providers: [
+                        {
+                            provide: AXPPageLayoutBase,
+                            useExisting: AXMRolePermissionsPageComponent,
+                        },
+                    ], host: {
+                        class: 'flex h-full min-h-0 flex-1 flex-col overflow-hidden',
+                    }, template: "@if (isLoading()) {\n  <!-- ----- Loading grant while role permissions are fetched ----- -->\n  <div class=\"flex h-full min-h-[20rem] items-center justify-center p-6\">\n    <ax-loading></ax-loading>\n  </div>\n}\n<!-- ----- Role must be persisted before grants can be edited ----- -->\n@else if (!roleId()) {\n  <div class=\"flex h-full min-h-[20rem] items-center justify-center p-6\">\n    <axp-state-message\n      [title]=\"'@security-management:roles.entities.role.pages.permissions.save-role-first.title'\"\n      [description]=\"'@security-management:roles.entities.role.pages.permissions.save-role-first.description'\"\n    ></axp-state-message>\n  </div>\n}\n<!-- ----- Full-page permissions editor for the scoped RolePermission grant ----- -->\n@else {\n  <div class=\"flex h-full min-h-0 flex-1 flex-col overflow-hidden p-4\">\n    <!-- ----- Remount editor when discard/load resets the selection baseline ----- -->\n    @for (token of [editorResetToken()]; track token) {\n      <axm-permissions-editor\n        [initialPermissions]=\"editorPermissions()\"\n        [readOnly]=\"isGrantReadonly()\"\n        [fillHeight]=\"true\"\n        (permissionsChanged)=\"onPermissionsChanged($event)\"\n      ></axm-permissions-editor>\n    }\n  </div>\n}\n" }]
+        }], ctorParameters: () => [], propDecorators: { rootContext: [{ type: i0.Input, args: [{ isSignal: true, alias: "rootContext", required: false }] }], pageConfig: [{ type: i0.Input, args: [{ isSignal: true, alias: "pageConfig", required: false }] }] } });
+
+var rolePermissionsPage_component = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXMRolePermissionsPageComponent: AXMRolePermissionsPageComponent
+});
+
+//#endregion
+//#region ----- Provider -----
+class AXMRolePermissionsPageComponentProvider {
+    async components() {
+        return [
+            {
+                key: ROLE_PERMISSIONS_PAGE_COMPONENT_KEY,
+                loader: () => Promise.resolve().then(function () { return rolePermissionsPage_component; }).then((m) => m.AXMRolePermissionsPageComponent),
+            },
+        ];
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionsPageComponentProvider, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionsPageComponentProvider }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXMRolePermissionsPageComponentProvider, decorators: [{
+            type: Injectable
+        }] });
+
+var index = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXMRolePermissionsPageComponent: AXMRolePermissionsPageComponent,
+    AXMRolePermissionsPageComponentProvider: AXMRolePermissionsPageComponentProvider
+});
+
+class AXPPermissionsWidgetViewComponent extends AXPValueWidgetComponent {
+    constructor() {
+        super(...arguments);
+        this.permissionService = inject(AXPPermissionDefinitionService);
+        this.commandService = inject(AXPCommandService);
+        this.groups = signal([], /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "groups" }] : /* istanbul ignore next */ []));
+        this.loadGroupsEffect = effect(async () => {
+            // Load groups when component initializes
+            if (this.groups().length === 0) {
+                const groupsData = await this.permissionService.getGroups();
+                this.groups.set(groupsData);
+            }
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "loadGroupsEffect" }] : /* istanbul ignore next */ []));
+        this.selectedPermissionsByGroup = computed(() => {
+            const selected = new Set(this.getValue() ?? []);
+            const result = {};
+            for (const group of this.groups()) {
+                const permPaths = [];
+                const findPermissionPaths = (items, path = []) => {
+                    for (const item of items) {
+                        const currentPath = [...path, item];
+                        if (selected.has(item.name)) {
+                            const displayPath = currentPath.map(p => p.title).join(' > ');
+                            permPaths.push({
+                                group,
+                                path: currentPath,
+                                displayPath
+                            });
+                        }
+                        if (item.children?.length) {
+                            findPermissionPaths(item.children, currentPath);
+                        }
+                    }
+                };
+                findPermissionPaths(group.permissions);
+                result[group.name] = permPaths;
+            }
+            return result;
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "selectedPermissionsByGroup" }] : /* istanbul ignore next */ []));
+        this.isEmpty = computed(() => {
+            return Object.values(this.selectedPermissionsByGroup()).every(arr => !arr.length);
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isEmpty" }] : /* istanbul ignore next */ []));
+    }
+    async openPermissionsEditor() {
+        await this.commandService.execute('assign-permissions', {
+            data: this.contextService.data(),
+            entity: `${RootConfig.module.name}.${RootConfig.entities.roles.name}`,
+        });
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetViewComponent, deps: null, target: i0.ɵɵFactoryTarget.Component }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.0.8", type: AXPPermissionsWidgetViewComponent, isStandalone: true, selector: "axm-permissions-widget-view", usesInheritance: true, ngImport: i0, template: `
+    <!-- <axm-permissions-editor
+    [initialPermissions]="getValue() || []"
+    [readOnly]="true">
+    </axm-permissions-editor> -->
+    <div class="flex flex-col gap-2">
+      @for (group of groups(); track group.name) {
+        @if (selectedPermissionsByGroup()[group.name]?.length) {
+          <div>
+            <div class="text-xs font-semibold mb-2 text-muted">{{ group.title }}</div>
+            <div class="flex gap-1 flex-wrap">
+              @for (permPath of selectedPermissionsByGroup()[group.name]; track permPath.path[permPath.path.length - 1].name) {
+                <ax-badge [text]="permPath.displayPath" color="primary" size="sm"></ax-badge>
+              }
+            </div>
+          </div>
+        }
+      }
+      @if (isEmpty()) {
+        <axp-state-message
+          icon="fa-light fa-shield-check"
+          [title]="'@security-management:permissions-feature.components.permissions-editor.empty-states.no-permissions.title'"
+          [description]="'@security-management:permissions-feature.components.permissions-editor.empty-states.no-permissions.description'">
+        </axp-state-message>
+      }
+    </div>
+    `, isInline: true, dependencies: [{ kind: "ngmodule", type: AXBadgeModule }, { kind: "component", type: i9.AXBadgeComponent, selector: "ax-badge", inputs: ["color", "look", "text"] }, { kind: "ngmodule", type: AXTranslationModule }, { kind: "component", type: AXPStateMessageComponent, selector: "axp-state-message", inputs: ["mode", "icon", "title", "description", "titleParams", "descriptionParams", "look"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetViewComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'axm-permissions-widget-view',
+                    template: `
+    <!-- <axm-permissions-editor
+    [initialPermissions]="getValue() || []"
+    [readOnly]="true">
+    </axm-permissions-editor> -->
+    <div class="flex flex-col gap-2">
+      @for (group of groups(); track group.name) {
+        @if (selectedPermissionsByGroup()[group.name]?.length) {
+          <div>
+            <div class="text-xs font-semibold mb-2 text-muted">{{ group.title }}</div>
+            <div class="flex gap-1 flex-wrap">
+              @for (permPath of selectedPermissionsByGroup()[group.name]; track permPath.path[permPath.path.length - 1].name) {
+                <ax-badge [text]="permPath.displayPath" color="primary" size="sm"></ax-badge>
+              }
+            </div>
+          </div>
+        }
+      }
+      @if (isEmpty()) {
+        <axp-state-message
+          icon="fa-light fa-shield-check"
+          [title]="'@security-management:permissions-feature.components.permissions-editor.empty-states.no-permissions.title'"
+          [description]="'@security-management:permissions-feature.components.permissions-editor.empty-states.no-permissions.description'">
+        </axp-state-message>
+      }
+    </div>
+    `,
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    imports: [AXBadgeModule, AXTranslationModule, AXPStateMessageComponent]
+                }]
+        }] });
+
+var permissionsWidgetView_component = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXPPermissionsWidgetViewComponent: AXPPermissionsWidgetViewComponent
+});
+
+class AXPPermissionsWidgetEditComponent extends AXPValueWidgetComponent {
+    // #region ----------------   UI Handlers   ----------------
+    /**
+     * Handles permissions changes from the editor.
+     */
+    onPermissionsChanged(permissions) {
+        this.setValue(permissions);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetEditComponent, deps: null, target: i0.ɵɵFactoryTarget.Component }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.0.8", type: AXPPermissionsWidgetEditComponent, isStandalone: true, selector: "axm-permissions-widget-edit", usesInheritance: true, ngImport: i0, template: `
+    <axm-permissions-editor
+      [initialPermissions]="getValue() || []"
+      [readOnly]="false"
+      (permissionsChanged)="onPermissionsChanged($event)">
+    </axm-permissions-editor>
+  `, isInline: true, dependencies: [{ kind: "component", type: AXPPermissionsEditorComponent, selector: "axm-permissions-editor", inputs: ["initialPermissions", "readOnly", "showActions", "fillHeight"], outputs: ["permissionsChanged", "permissionsSelected"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetEditComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'axm-permissions-widget-edit',
+                    template: `
+    <axm-permissions-editor
+      [initialPermissions]="getValue() || []"
+      [readOnly]="false"
+      (permissionsChanged)="onPermissionsChanged($event)">
+    </axm-permissions-editor>
+  `,
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    imports: [
+                        AXPPermissionsEditorComponent
+                    ]
+                }]
+        }] });
+
+var permissionsWidgetEdit_component = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXPPermissionsWidgetEditComponent: AXPPermissionsWidgetEditComponent
+});
+
+class AXPPermissionsWidgetColumnComponent extends AXPColumnWidgetComponent {
+    constructor() {
+        super(...arguments);
+        this.count = computed(() => castArray(this.rawValue).length, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "count" }] : /* istanbul ignore next */ []));
+        this.commandService = inject(AXPCommandService);
+    }
+    async openPermissionsEditor() {
+        await this.commandService.execute('assign-permissions', {
+            data: this.rowData,
+            entity: `${RootConfig.module.name}.${RootConfig.entities.roles.name}`,
+        });
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetColumnComponent, deps: null, target: i0.ɵɵFactoryTarget.Component }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.0.8", type: AXPPermissionsWidgetColumnComponent, isStandalone: true, selector: "axm-permissions-widget-column", inputs: { rawValue: "rawValue", rowData: "rowData" }, usesInheritance: true, ngImport: i0, template: `
+    <span class="cursor-pointer text-primary underline" (click)="openPermissionsEditor()">{{count()}}  {{'@security-management:permissions-feature.terms.permissions' | translate | async}}</span>
+  `, isInline: true, dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "ngmodule", type: AXTranslationModule }, { kind: "pipe", type: i1.AsyncPipe, name: "async" }, { kind: "pipe", type: i12.AXTranslatorPipe, name: "translate" }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionsWidgetColumnComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'axm-permissions-widget-column',
+                    template: `
+    <span class="cursor-pointer text-primary underline" (click)="openPermissionsEditor()">{{count()}}  {{'@security-management:permissions-feature.terms.permissions' | translate | async}}</span>
+  `,
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    imports: [CommonModule, AXTranslationModule],
+                    inputs: ['rawValue', 'rowData']
+                }]
+        }] });
+
+var permissionsWidgetColumn_component = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    AXPPermissionsWidgetColumnComponent: AXPPermissionsWidgetColumnComponent
+});
+
+// Permission Editor Components
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AXMAssignPermissionsCommand as A, AXMDeviceSessionsService as a, AXMPermissionsModule as b, AXMRolePermissionGrantService as c, AXMRolePermissionsPageComponent as d, AXMRolePermissionsPageComponentProvider as e, AXMSecurityManagementModule as f, AXPPermissionsEditorComponent as g, AXPPermissionsWidget as h, AXPPermissionsWidgetColumnComponent as i, AXPPermissionsWidgetEditComponent as j, AXPPermissionsWidgetViewComponent as k, resolvePersistedEntityId as r };
+//# sourceMappingURL=acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-jSDkyMMZ.mjs.map