@acorex-platform/module-security-management-client 0.0.37 → 0.0.38

package/fesm2022/acorex-platform-module-security-management-client-contracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-contracts.mjs","sources":["../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts","../../../../libs/modules/security-management/contracts/src/features.keys.ts","../../../../libs/modules/security-management/contracts/src/menu.keys.ts","../../../../libs/modules/security-management/contracts/src/permission.keys.ts","../../../../libs/modules/security-management/contracts/src/ROLE_PERMISSIONS_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/USER_ROLES_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/root-config.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_ACCESS_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/user-access-state.ts","../../../../libs/modules/security-management/contracts/src/user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/user-password-reset.ts","../../../../libs/modules/security-management/contracts/src/server-commands.ts","../../../../libs/modules/security-management/contracts/src/entities/device-sessions/device-sessions.types.ts","../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.types.ts","../../../../libs/modules/security-management/contracts/src/entities/policy/policy.types.ts","../../../../libs/modules/security-management/contracts/src/entities/role-permission/role-permission.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-role/user-role.types.ts","../../../../libs/modules/security-management/contracts/src/index.ts","../../../../libs/modules/security-management/contracts/src/acorex-platform-module-security-management-client-contracts.ts"],"sourcesContent":["import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';\n\n//#region ---- User context definitions ----\n\nexport const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[] = [\n  {\n    name: 'userDisplayName',\n    title: 'User display name',\n    description:\n      'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',\n    order: 11,\n    capabilities: ['ai'],\n  },\n];\n\n//#endregion\n","//#region ----   Feature Keys   ----\n\n/**\n * Security Management Module Feature Keys.\n * Defines all available features for the Security Management module.\n */\nexport const AXPSecurityManagementFeatureKeys = {\n  ManageRoles: 'SecurityManagement:Feature:ManageRoles',\n  ManageUsers: 'SecurityManagement:Feature:ManageUsers',\n  MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',\n  ManageSessions: 'SecurityManagement:Feature:ManageSessions',\n  ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',\n  /** Platform Console only — Identity Provider management menu + CRUD. */\n  ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',\n  /** Self-service account deletion on the profile page. Off unless the edition enables it. */\n  DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',\n} as const;\n\n//#endregion\n\n","export const AXPSecurityManagementMenuKeys = {\n  Root: 'SecurityManagement:Menu',\n  Users: 'SecurityManagement:Menu:Users',\n  Roles: 'SecurityManagement:Menu:Roles',\n  DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',\n  Policy: 'SecurityManagement:Menu:Policy',\n  IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',\n  MyProfile: 'SecurityManagement:Menu:MyProfile',\n} as const;\n","/**\n * Administration capabilities used by this module.\n * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).\n */\nexport const AXPAdministrationPermissionKeys = {\n  Access: 'Administration:Permission:Access',\n  /** Create and maintain users, roles, role assignments, and related security-access reports. */\n  MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',\n  ManageSessions: 'Administration:Permission:ManageSessions',\n  MaintainPolicies: 'Administration:Permission:MaintainPolicies',\n  ViewIntegrations: 'Administration:Permission:ViewIntegrations',\n  MaintainConnections: 'Administration:Permission:MaintainConnections',\n  ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',\n  MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',\n  ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',\n  ViewRules: 'Administration:Permission:ViewRules',\n  MaintainRules: 'Administration:Permission:MaintainRules',\n  ManageRuleActions: 'Administration:Permission:ManageRuleActions',\n  MaintainAi: 'Administration:Permission:MaintainAi',\n  UseAiAssist: 'Administration:Permission:UseAiAssist',\n  MaintainDashboards: 'Administration:Permission:MaintainDashboards',\n  ViewJobs: 'Administration:Permission:ViewJobs',\n  ManageJobActions: 'Administration:Permission:ManageJobActions',\n  ViewObservability: 'Administration:Permission:ViewObservability',\n  MaintainObservability: 'Administration:Permission:MaintainObservability',\n} as const;\n\n/**\n * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.\n * Legacy nested shape kept so existing imports compile during migration.\n */\nexport const AXPSecurityManagementPermissionKeys = {\n  User: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  Role: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  DeviceSession: {\n    Management: AXPAdministrationPermissionKeys.ManageSessions,\n    View: AXPAdministrationPermissionKeys.ManageSessions,\n    Terminate: AXPAdministrationPermissionKeys.ManageSessions,\n  },\n  Policy: {\n    Management: AXPAdministrationPermissionKeys.MaintainPolicies,\n    View: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Edit: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Delete: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Create: AXPAdministrationPermissionKeys.MaintainPolicies,\n  },\n} as const;\n","/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */\nexport const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = 'role-permissions-page';\n","export const USER_ROLES_PAGE_COMPONENT_KEY = 'user-roles-page';\n","const config = {\n  i18n: 'security-management',\n  profileEntity: 'Profile',\n};\nexport const RootConfig = {\n  config,\n  module: {\n    route: 'security-management',\n    name: 'SecurityManagement',\n    title: `@${config.i18n}:module.title`,\n    icon: 'fa-light fa-shield-halved',\n  },\n  entities: {\n    policy: {\n      name: 'Policy',\n      title: `@${config.i18n}:policies.entities.policy.title`,\n      titlePlural: `@${config.i18n}:policies.entities.policy.plural`,\n      icon: 'fa-light fa-clipboard-list',\n    },\n    deviceSessions: {\n      name: 'DeviceSessions',\n      title: `@${config.i18n}:sessions.entities.session.title`,\n      titlePlural: `@${config.i18n}:sessions.entities.session.plural`,\n      icon: 'fa-light fa-laptop',\n    },\n    users: {\n      name: 'User',\n      title: `@${config.i18n}:users.entities.user.title`,\n      titlePlural: `@${config.i18n}:users.entities.user.plural`,\n      icon: 'fa-light fa-users',\n    },\n    roles: {\n      name: 'Role',\n      title: `@${config.i18n}:roles.entities.role.title`,\n      titlePlural: `@${config.i18n}:roles.entities.role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    rolePermission: {\n      name: 'RolePermission',\n      title: `@${config.i18n}:role-permissions.entities.role-permission.title`,\n      titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,\n      icon: 'fa-light fa-key',\n    },\n    userRole: {\n      name: 'UserRole',\n      title: `@${config.i18n}:user-roles.entities.user-role.title`,\n      titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    profile: {\n      name: 'Profile',\n      title: `@${config.i18n}:profile.entities.profile.title`,\n      titlePlural: `@${config.i18n}:profile.entities.profile.plural`,\n      icon: 'fa-light fa-user',\n    },\n    identityProvider: {\n      name: 'IdentityProvider',\n      title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,\n      titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,\n      icon: 'fa-light fa-id-badge',\n    },\n  },\n  queries: {\n    reports: {\n      getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',\n      getUserEffectivePermissionsHistory:\n        'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',\n      getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',\n      getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',\n      getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',\n    },\n  },\n} as const;\n","/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */\nexport const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';\n","/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */\nexport const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';\n","//#region ---- User access state ----\n\n/**\n * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).\n * Persisted as the enum string value (e.g. `allowed`).\n */\nexport enum AXMUserAccessState {\n  Allowed = 'allowed',\n  Blocked = 'blocked',\n  Expired = 'expired',\n}\n\n//#endregion\n","//#region ---- User effective (unified) state ----\n\n/**\n * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).\n */\nexport enum AXMUserEffectiveState {\n  Pending = 'pending',\n  Active = 'active',\n  Suspended = 'suspended',\n  Inactive = 'inactive',\n  Archived = 'archived',\n  SignInBlocked = 'sign-in-blocked',\n  CredentialExpired = 'credential-expired',\n}\n\n//#endregion\n","import { AXMUserAccessState } from './user-access-state';\nimport { AXMUserEffectiveState } from './user-effective-state';\n\n//#region ---- Resolve effective state ----\n\nconst AccountLifecycleState = {\n  Active: 'active',\n  Archived: 'archived',\n  Pending: 'pending',\n  Inactive: 'inactive',\n  Suspended: 'suspended',\n} as const;\n\n/**\n * Derives the unified operational state from account lifecycle and sign-in gate.\n * Used for persisted `effectiveState` on SecurityManagement.User.\n */\nexport function resolveAXMUserEffectiveState(input: {\n  accountState: string | undefined;\n  accessState: AXMUserAccessState | string | undefined;\n}): AXMUserEffectiveState {\n  const lifecycle = input.accountState;\n  const auth = (input.accessState ?? AXMUserAccessState.Allowed) as string;\n\n  if (lifecycle === AccountLifecycleState.Archived) {\n    return AXMUserEffectiveState.Archived;\n  }\n  if (lifecycle === AccountLifecycleState.Pending) {\n    return AXMUserEffectiveState.Pending;\n  }\n  if (lifecycle === AccountLifecycleState.Inactive) {\n    return AXMUserEffectiveState.Inactive;\n  }\n  if (lifecycle === AccountLifecycleState.Suspended) {\n    return AXMUserEffectiveState.Suspended;\n  }\n  if (auth === AXMUserAccessState.Expired) {\n    return AXMUserEffectiveState.CredentialExpired;\n  }\n  if (auth === AXMUserAccessState.Blocked) {\n    return AXMUserEffectiveState.SignInBlocked;\n  }\n  if (lifecycle === AccountLifecycleState.Active) {\n    return AXMUserEffectiveState.Active;\n  }\n  return AXMUserEffectiveState.Active;\n}\n\n//#endregion\n","//#region ---- Password reset payload on User ----\n\n/**\n * One-time password-reset token state stored as JSON on SecurityManagement.User.\n * The raw token is never persisted — only a SHA-256 hash.\n */\nexport interface AXMUserPasswordResetInfo {\n  tokenHash: string;\n  expiresAt: string;\n  sentAt: string;\n}\n\n//#endregion\n","//#region ---- Security management server command keys ----\n\nexport const AXMSecurityManagementServerCommands = {\n  SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',\n  CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',\n  ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',\n} as const;\n\n/** Stable codes for self-service password change (client maps to i18n). */\nexport const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {\n  NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',\n  IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',\n  SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',\n  InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',\n} as const;\n\n/** Client/UI action key (confirm dialog → server send). */\nexport const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';\n\nexport interface AXMSendPasswordResetEmailInput {\n  /** Admin path: target user id. */\n  userId?: string;\n  /** Forgot path: email or username. */\n  login?: string;\n  /** Optional absolute web origin for reset link (defaults to env / localhost). */\n  webOrigin?: string;\n}\n\nexport interface AXMCompletePasswordResetInput {\n  token: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordInput {\n  currentPassword: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordResult {\n  passwordChangedAt: string;\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport enum AXMSessionStatusTypes {\n  revoked = 'revoked',\n  expired = 'expired',\n  active = 'active',\n}\n\nexport interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<string> {\n  clientName: string;\n  ipAddress: string;\n  userAgent: string;\n  authorizationId: string;\n  status: string;\n  userId: string;\n  user: {\n    id: string;\n    name: string;\n  };\n  applicationId: string;\n  application: {\n    id: string;\n    name: string;\n  };\n  tenantId: string;\n  tenant: {\n    id: string;\n    name: string;\n  };\n  /** True only for the caller's current login (`sid`); stamped on read. */\n  isActiveSession: boolean;\n  /** Login/session id matching access-token `sid`. */\n  sessionId?: string;\n  /** Stable per-device fingerprint (one active row per user+device). */\n  deviceKey?: string;\n\n  deviceName: string;\n  operatingSystem: string;\n  browser: string;\n  location: string;\n  lastLoginDate: Date;\n  /** When the session was revoked / logged out (null while still active). */\n  loggedOutAt?: Date | string | null;\n}\n","//#region ---- Identity provider entity model ----\n\n/**\n * Platform login IdP row (SecurityManagement.IdentityProvider).\n * Active/inactive uses the disable plugin field `isDisabled`.\n * Broker routing uses `key` as OAuth `acr_values`.\n */\nexport interface AXMIdentityProviderEntityModel {\n  id: string;\n  /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */\n  key: string;\n  title: string;\n  icon?: string | null;\n  /** External IdP authorize URL (e.g. Google accounts endpoint). */\n  authorizationUrl?: string | null;\n  /** External IdP token URL. */\n  tokenUrl?: string | null;\n  /** Optional userinfo URL when id_token is absent. */\n  userInfoUrl?: string | null;\n  /** Space-separated scopes requested from the external IdP. */\n  scopes?: string | null;\n  issuerUrl?: string | null;\n  clientId?: string | null;\n  /** Platform broker client secret (admin / seed). */\n  clientSecret?: string | null;\n  /** From disable plugin — `true` means not offered on login. */\n  isDisabled?: boolean;\n  priority: number;\n}\n\n//#endregion\n","import { AXPExpression } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {\n  name: string;\n  title: string;\n  description?: string;\n\n  rules: {\n    conditions: AXPExpression;\n    effects: AXMPolicyEffectRule[]; // list of effect rules\n  }[];\n\n  permission: string; // related permission\n  scope: AXMPolicyScope;\n\n  resource: {\n    type: string;\n    target: string;\n  };\n}\n\nexport type AXMPolicyScope = 'system' | 'tenant' | 'user';\n\nexport type AXMPolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';\n\nexport interface AXMPolicyEffectRule {\n  effect: AXMPolicyEffect;\n  target: string;\n}\n\n// const glocbal_readonly_policy = {\n//   name: 'readonly',\n//   resource: {\n//     reference: '*',\n//     type: 'entity',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ isHidden==true }}',\n//       effects: [\n//         {\n//           target: '*',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n\n// const readonly_file_by_role_policy = {\n//   name: 'readonly_file_by_role_policy',\n//   resource: {\n//     type: 'entity',\n//     reference: 'COntentManagement.Promotion',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ createdDate > 2025-01-01 && user.role!=\"admin\"}}',\n//       effects: [\n//         {\n//           target: 'imageId',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n","//#region ----- RolePermission types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped permission grants for a Role.\n * Role rows are identity-only; all capability keys live here.\n */\nexport interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.Role} id. */\n  roleId: string;\n  /** Capability keys granted for this scope. */\n  permissions: string[];\n}\n\n//#endregion\n","//#region ----- UserRole types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped role assignments for a User.\n * User rows are identity-only for roles; all role memberships live here.\n */\nexport interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.User} id. */\n  userId: string;\n  /** Role ids granted for this scope. */\n  roleIds: string[];\n}\n\n//#endregion\n","//#region ---- Contracts barrel ----\n\nexport * from './lib/context.definitions';\nexport * from './features.keys';\nexport * from './menu.keys';\nexport * from './permission.keys';\nexport * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';\nexport * from './USER_ROLES_PAGE_COMPONENT_KEY';\n\nexport * from './root-config';\n\nexport * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';\nexport * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';\nexport * from './user-access-state';\nexport * from './user-effective-state';\nexport * from './resolve-user-effective-state';\nexport * from './user-password-reset';\nexport * from './server-commands';\n//#endregion\n\nexport * from './entities';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":"AAEA;AAEO,MAAM,gCAAgC,GAA2B;AACtE,IAAA;AACE,QAAA,IAAI,EAAE,iBAAiB;AACvB,QAAA,KAAK,EAAE,mBAAmB;AAC1B,QAAA,WAAW,EACT,0GAA0G;AAC5G,QAAA,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;AACrB,KAAA;;AAGH;;ACfA;AAEA;;;AAGG;AACI,MAAM,gCAAgC,GAAG;AAC9C,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,aAAa,EAAE,0CAA0C;AACzD,IAAA,cAAc,EAAE,2CAA2C;AAC3D,IAAA,cAAc,EAAE,2CAA2C;;AAE3D,IAAA,uBAAuB,EAAE,oDAAoD;;AAE7E,IAAA,aAAa,EAAE,0CAA0C;;AAG3D;;AClBO,MAAM,6BAA6B,GAAG;AAC3C,IAAA,IAAI,EAAE,yBAAyB;AAC/B,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,cAAc,EAAE,wCAAwC;AACxD,IAAA,MAAM,EAAE,gCAAgC;AACxC,IAAA,iBAAiB,EAAE,2CAA2C;AAC9D,IAAA,SAAS,EAAE,mCAAmC;;;ACPhD;;;AAGG;AACI,MAAM,+BAA+B,GAAG;AAC7C,IAAA,MAAM,EAAE,kCAAkC;;AAE1C,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,cAAc,EAAE,0CAA0C;AAC1D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,SAAS,EAAE,qCAAqC;AAChD,IAAA,aAAa,EAAE,yCAAyC;AACxD,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,WAAW,EAAE,uCAAuC;AACpD,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,QAAQ,EAAE,oCAAoC;AAC9C,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;;AAG1E;;;AAGG;AACI,MAAM,mCAAmC,GAAG;AACjD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,aAAa,EAAE;QACb,UAAU,EAAE,+BAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,+BAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,+BAA+B,CAAC,cAAc;AAC1D,KAAA;AACD,IAAA,MAAM,EAAE;QACN,UAAU,EAAE,+BAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;AACzD,KAAA;;;ACzDH;AACO,MAAM,mCAAmC,GAAG;;ACD5C,MAAM,6BAA6B,GAAG;;ACA7C,MAAM,MAAM,GAAG;AACb,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,aAAa,EAAE,SAAS;CACzB;AACM,MAAM,UAAU,GAAG;IACxB,MAAM;AACN,IAAA,MAAM,EAAE;AACN,QAAA,KAAK,EAAE,qBAAqB;AAC5B,QAAA,IAAI,EAAE,oBAAoB;AAC1B,QAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,aAAA,CAAe;AACrC,QAAA,IAAI,EAAE,2BAA2B;AAClC,KAAA;AACD,IAAA,QAAQ,EAAE;AACR,QAAA,MAAM,EAAE;AACN,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AACxD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iCAAA,CAAmC;AAC/D,YAAA,IAAI,EAAE,oBAAoB;AAC3B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,mBAAmB;AAC1B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AACxE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iDAAA,CAAmD;AAC/E,YAAA,IAAI,EAAE,iBAAiB;AACxB,SAAA;AACD,QAAA,QAAQ,EAAE;AACR,YAAA,IAAI,EAAE,UAAU;AAChB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oCAAA,CAAsC;AAC5D,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qCAAA,CAAuC;AACnE,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,SAAS;AACf,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,kBAAkB;AACzB,SAAA;AACD,QAAA,gBAAgB,EAAE;AAChB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oDAAA,CAAsD;AAC5E,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qDAAA,CAAuD;AACnF,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACF,KAAA;AACD,IAAA,OAAO,EAAE;AACP,QAAA,OAAO,EAAE;AACP,YAAA,4BAA4B,EAAE,yDAAyD;AACvF,YAAA,kCAAkC,EAChC,+DAA+D;AACjE,YAAA,qBAAqB,EAAE,kDAAkD;AACzE,YAAA,2BAA2B,EAAE,wDAAwD;AACrF,YAAA,4BAA4B,EAAE,yDAAyD;AACxF,SAAA;AACF,KAAA;;;ACvEH;AACO,MAAM,oCAAoC,GAAG;;ACDpD;AACO,MAAM,uCAAuC,GAAG;;ACDvD;AAEA;;;AAGG;IACS;AAAZ,CAAA,UAAY,kBAAkB,EAAA;AAC5B,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,GAAA,EAAA,CAAA,CAAA;AAM9B;;ACZA;AAEA;;AAEG;IACS;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACjB,IAAA,qBAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,eAAA,CAAA,GAAA,iBAAiC;AACjC,IAAA,qBAAA,CAAA,mBAAA,CAAA,GAAA,oBAAwC;AAC1C,CAAC,EARW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;AAUjC;;ACZA;AAEA,MAAM,qBAAqB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,OAAO,EAAE,SAAS;AAClB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,SAAS,EAAE,WAAW;CACd;AAEV;;;AAGG;AACG,SAAU,4BAA4B,CAAC,KAG5C,EAAA;AACC,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;IACpC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAW;AAExE,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE;QAC/C,OAAO,qBAAqB,CAAC,OAAO;IACtC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE;QACjD,OAAO,qBAAqB,CAAC,SAAS;IACxC;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,iBAAiB;IAChD;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,aAAa;IAC5C;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE;QAC9C,OAAO,qBAAqB,CAAC,MAAM;IACrC;IACA,OAAO,qBAAqB,CAAC,MAAM;AACrC;AAEA;;AChDA;AAYA;;ACZA;AAEO,MAAM,mCAAmC,GAAG;AACjD,IAAA,sBAAsB,EAAE,kDAAkD;AAC1E,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,iBAAiB,EAAE,6CAA6C;;AAGlE;AACO,MAAM,mCAAmC,GAAG;AACjD,IAAA,WAAW,EAAE,mCAAmC;AAChD,IAAA,gBAAgB,EAAE,uCAAuC;AACzD,IAAA,aAAa,EAAE,qCAAqC;AACpD,IAAA,YAAY,EAAE,mCAAmC;;AAGnD;AACO,MAAM,oCAAoC,GAAG;AAyBpD;;ICzCY;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;;ACDjC;AA8BA;;ACAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACtEA;AAeA;;ACfA;AAeA;;ACfA;;ACAA;;AAEG;;"}
+{"version":3,"file":"acorex-platform-module-security-management-client-contracts.mjs","sources":["../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts","../../../../libs/modules/security-management/contracts/src/features.keys.ts","../../../../libs/modules/security-management/contracts/src/menu.keys.ts","../../../../libs/modules/security-management/contracts/src/permission.keys.ts","../../../../libs/modules/security-management/contracts/src/ROLE_PERMISSIONS_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/USER_ROLES_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/root-config.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_ACCESS_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/user-access-state.ts","../../../../libs/modules/security-management/contracts/src/user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/user-password-reset.ts","../../../../libs/modules/security-management/contracts/src/server-commands.ts","../../../../libs/modules/security-management/contracts/src/entities/device-sessions/device-sessions.types.ts","../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.types.ts","../../../../libs/modules/security-management/contracts/src/entities/policy/policy.types.ts","../../../../libs/modules/security-management/contracts/src/entities/role-permission/role-permission.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-role/user-role.types.ts","../../../../libs/modules/security-management/contracts/src/index.ts","../../../../libs/modules/security-management/contracts/src/acorex-platform-module-security-management-client-contracts.ts"],"sourcesContent":["import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';\n\n//#region ---- User context definitions ----\n\nexport const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[] = [\n  {\n    name: 'userDisplayName',\n    title: 'User display name',\n    description:\n      'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',\n    order: 11,\n    capabilities: ['ai'],\n  },\n];\n\n//#endregion\n","//#region ----   Feature Keys   ----\n\n/**\n * Security Management Module Feature Keys.\n * Defines all available features for the Security Management module.\n */\nexport const AXPSecurityManagementFeatureKeys = {\n  ManageRoles: 'SecurityManagement:Feature:ManageRoles',\n  ManageUsers: 'SecurityManagement:Feature:ManageUsers',\n  MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',\n  ManageSessions: 'SecurityManagement:Feature:ManageSessions',\n  ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',\n  /** Platform Console only — Identity Provider management menu + CRUD. */\n  ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',\n  /** Self-service account deletion on the profile page. Off unless the edition enables it. */\n  DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',\n} as const;\n\n//#endregion\n\n","export const AXPSecurityManagementMenuKeys = {\n  Root: 'SecurityManagement:Menu',\n  Users: 'SecurityManagement:Menu:Users',\n  Roles: 'SecurityManagement:Menu:Roles',\n  DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',\n  Policy: 'SecurityManagement:Menu:Policy',\n  IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',\n  MyProfile: 'SecurityManagement:Menu:MyProfile',\n} as const;\n","/**\n * Administration capabilities used by this module.\n * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).\n */\nexport const AXPAdministrationPermissionKeys = {\n  Access: 'Administration:Permission:Access',\n  /** Create and maintain users, roles, role assignments, and related security-access reports. */\n  MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',\n  ManageSessions: 'Administration:Permission:ManageSessions',\n  MaintainPolicies: 'Administration:Permission:MaintainPolicies',\n  ViewIntegrations: 'Administration:Permission:ViewIntegrations',\n  MaintainConnections: 'Administration:Permission:MaintainConnections',\n  ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',\n  MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',\n  ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',\n  ViewRules: 'Administration:Permission:ViewRules',\n  MaintainRules: 'Administration:Permission:MaintainRules',\n  ManageRuleActions: 'Administration:Permission:ManageRuleActions',\n  MaintainAi: 'Administration:Permission:MaintainAi',\n  UseAiAssist: 'Administration:Permission:UseAiAssist',\n  MaintainDashboards: 'Administration:Permission:MaintainDashboards',\n  ViewJobs: 'Administration:Permission:ViewJobs',\n  ManageJobActions: 'Administration:Permission:ManageJobActions',\n  ViewObservability: 'Administration:Permission:ViewObservability',\n  MaintainObservability: 'Administration:Permission:MaintainObservability',\n} as const;\n\n/**\n * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.\n * Legacy nested shape kept so existing imports compile during migration.\n */\nexport const AXPSecurityManagementPermissionKeys = {\n  User: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  Role: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  DeviceSession: {\n    Management: AXPAdministrationPermissionKeys.ManageSessions,\n    View: AXPAdministrationPermissionKeys.ManageSessions,\n    Terminate: AXPAdministrationPermissionKeys.ManageSessions,\n  },\n  Policy: {\n    Management: AXPAdministrationPermissionKeys.MaintainPolicies,\n    View: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Edit: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Delete: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Create: AXPAdministrationPermissionKeys.MaintainPolicies,\n  },\n} as const;\n","/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */\nexport const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = 'role-permissions-page';\n","export const USER_ROLES_PAGE_COMPONENT_KEY = 'user-roles-page';\n","const config = {\n  i18n: 'security-management',\n  profileEntity: 'Profile',\n};\nexport const RootConfig = {\n  config,\n  module: {\n    route: 'security-management',\n    name: 'SecurityManagement',\n    title: `@${config.i18n}:module.title`,\n    icon: 'fa-light fa-shield-halved',\n  },\n  entities: {\n    policy: {\n      name: 'Policy',\n      title: `@${config.i18n}:policies.entities.policy.title`,\n      titlePlural: `@${config.i18n}:policies.entities.policy.plural`,\n      icon: 'fa-light fa-clipboard-list',\n    },\n    deviceSessions: {\n      name: 'DeviceSessions',\n      title: `@${config.i18n}:sessions.entities.session.title`,\n      titlePlural: `@${config.i18n}:sessions.entities.session.plural`,\n      icon: 'fa-light fa-laptop',\n    },\n    users: {\n      name: 'User',\n      title: `@${config.i18n}:users.entities.user.title`,\n      titlePlural: `@${config.i18n}:users.entities.user.plural`,\n      icon: 'fa-light fa-users',\n    },\n    roles: {\n      name: 'Role',\n      title: `@${config.i18n}:roles.entities.role.title`,\n      titlePlural: `@${config.i18n}:roles.entities.role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    rolePermission: {\n      name: 'RolePermission',\n      title: `@${config.i18n}:role-permissions.entities.role-permission.title`,\n      titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,\n      icon: 'fa-light fa-key',\n    },\n    userRole: {\n      name: 'UserRole',\n      title: `@${config.i18n}:user-roles.entities.user-role.title`,\n      titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    profile: {\n      name: 'Profile',\n      title: `@${config.i18n}:profile.entities.profile.title`,\n      titlePlural: `@${config.i18n}:profile.entities.profile.plural`,\n      icon: 'fa-light fa-user',\n    },\n    identityProvider: {\n      name: 'IdentityProvider',\n      title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,\n      titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,\n      icon: 'fa-light fa-id-badge',\n    },\n  },\n  queries: {\n    reports: {\n      getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',\n      getUserEffectivePermissionsHistory:\n        'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',\n      getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',\n      getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',\n      getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',\n    },\n  },\n} as const;\n","/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */\nexport const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';\n","/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */\nexport const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';\n","//#region ---- User access state ----\n\n/**\n * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).\n * Persisted as the enum string value (e.g. `allowed`).\n */\nexport enum AXMUserAccessState {\n  Allowed = 'allowed',\n  Blocked = 'blocked',\n  Expired = 'expired',\n}\n\n//#endregion\n","//#region ---- User effective (unified) state ----\n\n/**\n * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).\n */\nexport enum AXMUserEffectiveState {\n  Pending = 'pending',\n  Active = 'active',\n  Suspended = 'suspended',\n  Inactive = 'inactive',\n  Archived = 'archived',\n  SignInBlocked = 'sign-in-blocked',\n  CredentialExpired = 'credential-expired',\n}\n\n//#endregion\n","import { AXMUserAccessState } from './user-access-state';\nimport { AXMUserEffectiveState } from './user-effective-state';\n\n//#region ---- Resolve effective state ----\n\nconst AccountLifecycleState = {\n  Active: 'active',\n  Archived: 'archived',\n  Pending: 'pending',\n  Inactive: 'inactive',\n  Suspended: 'suspended',\n} as const;\n\n/**\n * Derives the unified operational state from account lifecycle and sign-in gate.\n * Used for persisted `effectiveState` on SecurityManagement.User.\n */\nexport function resolveAXMUserEffectiveState(input: {\n  accountState: string | undefined;\n  accessState: AXMUserAccessState | string | undefined;\n}): AXMUserEffectiveState {\n  const lifecycle = input.accountState;\n  const auth = (input.accessState ?? AXMUserAccessState.Allowed) as string;\n\n  if (lifecycle === AccountLifecycleState.Archived) {\n    return AXMUserEffectiveState.Archived;\n  }\n  if (lifecycle === AccountLifecycleState.Pending) {\n    return AXMUserEffectiveState.Pending;\n  }\n  if (lifecycle === AccountLifecycleState.Inactive) {\n    return AXMUserEffectiveState.Inactive;\n  }\n  if (lifecycle === AccountLifecycleState.Suspended) {\n    return AXMUserEffectiveState.Suspended;\n  }\n  if (auth === AXMUserAccessState.Expired) {\n    return AXMUserEffectiveState.CredentialExpired;\n  }\n  if (auth === AXMUserAccessState.Blocked) {\n    return AXMUserEffectiveState.SignInBlocked;\n  }\n  if (lifecycle === AccountLifecycleState.Active) {\n    return AXMUserEffectiveState.Active;\n  }\n  return AXMUserEffectiveState.Active;\n}\n\n//#endregion\n","//#region ---- Password reset payload on User ----\n\n/**\n * One-time password-reset token state stored as JSON on SecurityManagement.User.\n * The raw token is never persisted — only a SHA-256 hash.\n */\nexport interface AXMUserPasswordResetInfo {\n  tokenHash: string;\n  expiresAt: string;\n  sentAt: string;\n}\n\n//#endregion\n","//#region ---- Security management server command keys ----\n\nexport const AXMSecurityManagementServerCommands = {\n  SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',\n  CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',\n  ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',\n} as const;\n\n/** Stable codes for self-service password change (client maps to i18n). */\nexport const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {\n  NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',\n  IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',\n  SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',\n  InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',\n} as const;\n\n/** Client/UI action key (confirm dialog → server send). */\nexport const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';\n\nexport interface AXMSendPasswordResetEmailInput {\n  /** Admin path: target user id. */\n  userId?: string;\n  /** Forgot path: email or username. */\n  login?: string;\n  /** Optional absolute web origin for reset link (defaults to env / localhost). */\n  webOrigin?: string;\n}\n\nexport interface AXMCompletePasswordResetInput {\n  token: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordInput {\n  currentPassword: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordResult {\n  passwordChangedAt: string;\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport enum AXMSessionStatusTypes {\n  revoked = 'revoked',\n  expired = 'expired',\n  active = 'active',\n}\n\nexport interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<string> {\n  clientName: string;\n  ipAddress: string;\n  userAgent: string;\n  authorizationId: string;\n  status: string;\n  userId: string;\n  user: {\n    id: string;\n    name: string;\n  };\n  applicationId: string;\n  application: {\n    id: string;\n    name: string;\n  };\n  tenantId: string;\n  tenant: {\n    id: string;\n    name: string;\n  };\n  /** True only for the caller's current login (`sid`); stamped on read. */\n  isActiveSession: boolean;\n  /** Login/session id matching access-token `sid`. */\n  sessionId?: string;\n  /** Stable per-device fingerprint (one active row per user+device). */\n  deviceKey?: string;\n\n  deviceName: string;\n  operatingSystem: string;\n  browser: string;\n  location: string;\n  lastLoginDate: Date;\n  /** When the session was revoked / logged out (null while still active). */\n  loggedOutAt?: Date | string | null;\n}\n","//#region ---- Identity provider entity model ----\n\n/**\n * Login protocol for {@link AXMIdentityProviderEntityModel}.\n * `directory` covers LDAP, Active Directory, and similar bind-based directories.\n */\nexport const AXM_IDENTITY_PROVIDER_PROTOCOL = {\n  Oidc: 'oidc',\n  Directory: 'directory',\n} as const;\n\nexport type AXMIdentityProviderProtocol =\n  (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];\n\n/**\n * Platform login IdP row (SecurityManagement.IdentityProvider).\n * Active/inactive uses the disable plugin field `isDisabled`.\n * Broker routing uses `key` as OAuth `acr_values` (OIDC only).\n */\nexport interface AXMIdentityProviderEntityModel {\n  id: string;\n  /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */\n  key: string;\n  title: string;\n  icon?: string | null;\n  /**\n   * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.\n   * Missing/legacy rows are treated as `oidc`.\n   */\n  protocol?: AXMIdentityProviderProtocol | null;\n  /** External IdP authorize URL (OIDC). */\n  authorizationUrl?: string | null;\n  /** External IdP token URL (OIDC). */\n  tokenUrl?: string | null;\n  /** Optional userinfo URL when id_token is absent (OIDC). */\n  userInfoUrl?: string | null;\n  /** Space-separated scopes requested from the external IdP (OIDC). */\n  scopes?: string | null;\n  /**\n   * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.\n   */\n  issuerUrl?: string | null;\n  /**\n   * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.\n   */\n  clientId?: string | null;\n  /**\n   * OAuth client secret (OIDC), or directory Bind Password when using search bind.\n   */\n  clientSecret?: string | null;\n  /** Directory server URL, e.g. `ldap://directory.example.com:389`. */\n  directoryUrl?: string | null;\n  /** Directory search base DN, e.g. `DC=example,DC=com`. */\n  directoryBaseDn?: string | null;\n  /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */\n  directoryUserDnTemplate?: string | null;\n  /** Optional search filter with `{{username}}` when using a service bind account. */\n  directoryUserSearchFilter?: string | null;\n  /** Start TLS when connecting to the directory server. */\n  directoryUseTls?: boolean | null;\n  /** Reject connections when the directory TLS certificate is untrusted. */\n  directoryTlsRejectUnauthorized?: boolean | null;\n  /** From disable plugin — `true` means not offered on login. */\n  isDisabled?: boolean;\n  priority: number;\n}\n\n//#endregion\n","import { AXPExpression } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {\n  name: string;\n  title: string;\n  description?: string;\n\n  rules: {\n    conditions: AXPExpression;\n    effects: AXMPolicyEffectRule[]; // list of effect rules\n  }[];\n\n  permission: string; // related permission\n  scope: AXMPolicyScope;\n\n  resource: {\n    type: string;\n    target: string;\n  };\n}\n\nexport type AXMPolicyScope = 'system' | 'tenant' | 'user';\n\nexport type AXMPolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';\n\nexport interface AXMPolicyEffectRule {\n  effect: AXMPolicyEffect;\n  target: string;\n}\n\n// const glocbal_readonly_policy = {\n//   name: 'readonly',\n//   resource: {\n//     reference: '*',\n//     type: 'entity',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ isHidden==true }}',\n//       effects: [\n//         {\n//           target: '*',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n\n// const readonly_file_by_role_policy = {\n//   name: 'readonly_file_by_role_policy',\n//   resource: {\n//     type: 'entity',\n//     reference: 'COntentManagement.Promotion',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ createdDate > 2025-01-01 && user.role!=\"admin\"}}',\n//       effects: [\n//         {\n//           target: 'imageId',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n","//#region ----- RolePermission types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped permission grants for a Role.\n * Role rows are identity-only; all capability keys live here.\n */\nexport interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.Role} id. */\n  roleId: string;\n  /** Capability keys granted for this scope. */\n  permissions: string[];\n}\n\n//#endregion\n","//#region ----- UserRole types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped role assignments for a User.\n * User rows are identity-only for roles; all role memberships live here.\n */\nexport interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.User} id. */\n  userId: string;\n  /** Role ids granted for this scope. */\n  roleIds: string[];\n}\n\n//#endregion\n","//#region ---- Contracts barrel ----\n\nexport * from './lib/context.definitions';\nexport * from './features.keys';\nexport * from './menu.keys';\nexport * from './permission.keys';\nexport * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';\nexport * from './USER_ROLES_PAGE_COMPONENT_KEY';\n\nexport * from './root-config';\n\nexport * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';\nexport * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';\nexport * from './user-access-state';\nexport * from './user-effective-state';\nexport * from './resolve-user-effective-state';\nexport * from './user-password-reset';\nexport * from './server-commands';\n//#endregion\n\nexport * from './entities';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":"AAEA;AAEO,MAAM,gCAAgC,GAA2B;AACtE,IAAA;AACE,QAAA,IAAI,EAAE,iBAAiB;AACvB,QAAA,KAAK,EAAE,mBAAmB;AAC1B,QAAA,WAAW,EACT,0GAA0G;AAC5G,QAAA,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;AACrB,KAAA;;AAGH;;ACfA;AAEA;;;AAGG;AACI,MAAM,gCAAgC,GAAG;AAC9C,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,aAAa,EAAE,0CAA0C;AACzD,IAAA,cAAc,EAAE,2CAA2C;AAC3D,IAAA,cAAc,EAAE,2CAA2C;;AAE3D,IAAA,uBAAuB,EAAE,oDAAoD;;AAE7E,IAAA,aAAa,EAAE,0CAA0C;;AAG3D;;AClBO,MAAM,6BAA6B,GAAG;AAC3C,IAAA,IAAI,EAAE,yBAAyB;AAC/B,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,cAAc,EAAE,wCAAwC;AACxD,IAAA,MAAM,EAAE,gCAAgC;AACxC,IAAA,iBAAiB,EAAE,2CAA2C;AAC9D,IAAA,SAAS,EAAE,mCAAmC;;;ACPhD;;;AAGG;AACI,MAAM,+BAA+B,GAAG;AAC7C,IAAA,MAAM,EAAE,kCAAkC;;AAE1C,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,cAAc,EAAE,0CAA0C;AAC1D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,SAAS,EAAE,qCAAqC;AAChD,IAAA,aAAa,EAAE,yCAAyC;AACxD,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,WAAW,EAAE,uCAAuC;AACpD,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,QAAQ,EAAE,oCAAoC;AAC9C,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;;AAG1E;;;AAGG;AACI,MAAM,mCAAmC,GAAG;AACjD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,aAAa,EAAE;QACb,UAAU,EAAE,+BAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,+BAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,+BAA+B,CAAC,cAAc;AAC1D,KAAA;AACD,IAAA,MAAM,EAAE;QACN,UAAU,EAAE,+BAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;AACzD,KAAA;;;ACzDH;AACO,MAAM,mCAAmC,GAAG;;ACD5C,MAAM,6BAA6B,GAAG;;ACA7C,MAAM,MAAM,GAAG;AACb,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,aAAa,EAAE,SAAS;CACzB;AACM,MAAM,UAAU,GAAG;IACxB,MAAM;AACN,IAAA,MAAM,EAAE;AACN,QAAA,KAAK,EAAE,qBAAqB;AAC5B,QAAA,IAAI,EAAE,oBAAoB;AAC1B,QAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,aAAA,CAAe;AACrC,QAAA,IAAI,EAAE,2BAA2B;AAClC,KAAA;AACD,IAAA,QAAQ,EAAE;AACR,QAAA,MAAM,EAAE;AACN,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AACxD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iCAAA,CAAmC;AAC/D,YAAA,IAAI,EAAE,oBAAoB;AAC3B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,mBAAmB;AAC1B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AACxE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iDAAA,CAAmD;AAC/E,YAAA,IAAI,EAAE,iBAAiB;AACxB,SAAA;AACD,QAAA,QAAQ,EAAE;AACR,YAAA,IAAI,EAAE,UAAU;AAChB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oCAAA,CAAsC;AAC5D,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qCAAA,CAAuC;AACnE,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,SAAS;AACf,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,kBAAkB;AACzB,SAAA;AACD,QAAA,gBAAgB,EAAE;AAChB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oDAAA,CAAsD;AAC5E,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qDAAA,CAAuD;AACnF,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACF,KAAA;AACD,IAAA,OAAO,EAAE;AACP,QAAA,OAAO,EAAE;AACP,YAAA,4BAA4B,EAAE,yDAAyD;AACvF,YAAA,kCAAkC,EAChC,+DAA+D;AACjE,YAAA,qBAAqB,EAAE,kDAAkD;AACzE,YAAA,2BAA2B,EAAE,wDAAwD;AACrF,YAAA,4BAA4B,EAAE,yDAAyD;AACxF,SAAA;AACF,KAAA;;;ACvEH;AACO,MAAM,oCAAoC,GAAG;;ACDpD;AACO,MAAM,uCAAuC,GAAG;;ACDvD;AAEA;;;AAGG;IACS;AAAZ,CAAA,UAAY,kBAAkB,EAAA;AAC5B,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,GAAA,EAAA,CAAA,CAAA;AAM9B;;ACZA;AAEA;;AAEG;IACS;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACjB,IAAA,qBAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,eAAA,CAAA,GAAA,iBAAiC;AACjC,IAAA,qBAAA,CAAA,mBAAA,CAAA,GAAA,oBAAwC;AAC1C,CAAC,EARW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;AAUjC;;ACZA;AAEA,MAAM,qBAAqB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,OAAO,EAAE,SAAS;AAClB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,SAAS,EAAE,WAAW;CACd;AAEV;;;AAGG;AACG,SAAU,4BAA4B,CAAC,KAG5C,EAAA;AACC,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;IACpC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAW;AAExE,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE;QAC/C,OAAO,qBAAqB,CAAC,OAAO;IACtC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE;QACjD,OAAO,qBAAqB,CAAC,SAAS;IACxC;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,iBAAiB;IAChD;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,aAAa;IAC5C;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE;QAC9C,OAAO,qBAAqB,CAAC,MAAM;IACrC;IACA,OAAO,qBAAqB,CAAC,MAAM;AACrC;AAEA;;AChDA;AAYA;;ACZA;AAEO,MAAM,mCAAmC,GAAG;AACjD,IAAA,sBAAsB,EAAE,kDAAkD;AAC1E,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,iBAAiB,EAAE,6CAA6C;;AAGlE;AACO,MAAM,mCAAmC,GAAG;AACjD,IAAA,WAAW,EAAE,mCAAmC;AAChD,IAAA,gBAAgB,EAAE,uCAAuC;AACzD,IAAA,aAAa,EAAE,qCAAqC;AACpD,IAAA,YAAY,EAAE,mCAAmC;;AAGnD;AACO,MAAM,oCAAoC,GAAG;AAyBpD;;ICzCY;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;;ACDjC;AAEA;;;AAGG;AACI,MAAM,8BAA8B,GAAG;AAC5C,IAAA,IAAI,EAAE,MAAM;AACZ,IAAA,SAAS,EAAE,WAAW;;AA2DxB;;ACrCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACtEA;AAeA;;ACfA;AAeA;;ACfA;;ACAA;;AAEG;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acorex-platform/module-security-management-client",
-  "version": "0.0.37",
+  "version": "0.0.38",
   "sideEffects": false,
   "peerDependencies": {
     "@angular/common": "^21.0.0 || ^22.0.0",

package/types/acorex-platform-module-security-management-client-contracts.d.ts

@@ -288,10 +288,19 @@ interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<
     loggedOutAt?: Date | string | null;
 }
 
+/**
+ * Login protocol for {@link AXMIdentityProviderEntityModel}.
+ * `directory` covers LDAP, Active Directory, and similar bind-based directories.
+ */
+declare const AXM_IDENTITY_PROVIDER_PROTOCOL: {
+    readonly Oidc: "oidc";
+    readonly Directory: "directory";
+};
+type AXMIdentityProviderProtocol = (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];
 /**
  * Platform login IdP row (SecurityManagement.IdentityProvider).
  * Active/inactive uses the disable plugin field `isDisabled`.
- * Broker routing uses `key` as OAuth `acr_values`.
+ * Broker routing uses `key` as OAuth `acr_values` (OIDC only).
  */
 interface AXMIdentityProviderEntityModel {
     id: string;
@@ -299,18 +308,43 @@ interface AXMIdentityProviderEntityModel {
     key: string;
     title: string;
     icon?: string | null;
-    /** External IdP authorize URL (e.g. Google accounts endpoint). */
+    /**
+     * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.
+     * Missing/legacy rows are treated as `oidc`.
+     */
+    protocol?: AXMIdentityProviderProtocol | null;
+    /** External IdP authorize URL (OIDC). */
     authorizationUrl?: string | null;
-    /** External IdP token URL. */
+    /** External IdP token URL (OIDC). */
     tokenUrl?: string | null;
-    /** Optional userinfo URL when id_token is absent. */
+    /** Optional userinfo URL when id_token is absent (OIDC). */
     userInfoUrl?: string | null;
-    /** Space-separated scopes requested from the external IdP. */
+    /** Space-separated scopes requested from the external IdP (OIDC). */
     scopes?: string | null;
+    /**
+     * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.
+     */
     issuerUrl?: string | null;
+    /**
+     * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.
+     */
     clientId?: string | null;
-    /** Platform broker client secret (admin / seed). */
+    /**
+     * OAuth client secret (OIDC), or directory Bind Password when using search bind.
+     */
     clientSecret?: string | null;
+    /** Directory server URL, e.g. `ldap://directory.example.com:389`. */
+    directoryUrl?: string | null;
+    /** Directory search base DN, e.g. `DC=example,DC=com`. */
+    directoryBaseDn?: string | null;
+    /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */
+    directoryUserDnTemplate?: string | null;
+    /** Optional search filter with `{{username}}` when using a service bind account. */
+    directoryUserSearchFilter?: string | null;
+    /** Start TLS when connecting to the directory server. */
+    directoryUseTls?: boolean | null;
+    /** Reject connections when the directory TLS certificate is untrusted. */
+    directoryTlsRejectUnauthorized?: boolean | null;
     /** From disable plugin — `true` means not offered on login. */
     isDisabled?: boolean;
     priority: number;
@@ -414,5 +448,5 @@ interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     passwordReset?: AXMUserPasswordResetInfo | null;
 }
 
-export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState };
-export type { AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMIdentityProviderEntityModel, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMUserPasswordResetInfo };
+export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState };
+export type { AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMIdentityProviderEntityModel, AXMIdentityProviderProtocol, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMUserPasswordResetInfo };

package/fesm2022/acorex-platform-module-security-management-client-contracts-entity-catalog-identity-provider.entity-6LBD6MuU.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-contracts-entity-catalog-identity-provider.entity-6LBD6MuU.mjs","sources":["../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.entity.ts"],"sourcesContent":["//#region ---- Imports ----\n\nimport { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';\nimport { AXPEntity, createAllQueryView, entityMasterCrudActions, entityMasterRecordActions } from '@acorex-platform/framework-shared/entity';\nimport { RootConfig } from '../../root-config';\n\n//#endregion\n\n//#region ---- Constants ----\n\nconst SECTION_LAYOUT = { positions: { lg: { colSpan: 12 } } } as const;\n\nconst MASTER_SECTIONS = [\n  { id: 'basic-info', layout: SECTION_LAYOUT },\n  { id: 'endpoints', layout: SECTION_LAYOUT },\n  { id: 'credentials', layout: SECTION_LAYOUT },\n];\n\nconst MASTER_PROPERTIES = [\n  { name: 'key', layout: { positions: { lg: { colSpan: 6, order: 1 } } } },\n  { name: 'title', layout: { positions: { lg: { colSpan: 6, order: 2 } } } },\n  { name: 'icon', layout: { positions: { lg: { colSpan: 6, order: 3 } } } },\n  { name: 'priority', layout: { positions: { lg: { colSpan: 6, order: 4 } } } },\n  { name: 'authorizationUrl', layout: { positions: { lg: { colSpan: 12, order: 5 } } } },\n  { name: 'tokenUrl', layout: { positions: { lg: { colSpan: 12, order: 6 } } } },\n  { name: 'userInfoUrl', layout: { positions: { lg: { colSpan: 12, order: 7 } } } },\n  { name: 'scopes', layout: { positions: { lg: { colSpan: 12, order: 8 } } } },\n  { name: 'issuerUrl', layout: { positions: { lg: { colSpan: 12, order: 9 } } } },\n  { name: 'clientId', layout: { positions: { lg: { colSpan: 6, order: 10 } } } },\n  { name: 'clientSecret', layout: { positions: { lg: { colSpan: 6, order: 11 } } } },\n];\n\n//#endregion\n\n//#region ---- Entity factory ----\n\nexport async function identityProviderFactory(): Promise<AXPEntity | null> {\n  const i18n = RootConfig.config.i18n;\n  const entityI18n = `@${i18n}:identity-providers.entities.identity-provider`;\n\n  const entityDef: AXPEntity = {\n    module: RootConfig.module.name,\n    name: RootConfig.entities.identityProvider.name,\n    title: RootConfig.entities.identityProvider.title,\n    icon: RootConfig.entities.identityProvider.icon,\n    formats: {\n      individual: RootConfig.entities.identityProvider.title,\n      plural: RootConfig.entities.identityProvider.titlePlural,\n      searchResult: {\n        title: '{{ title }}',\n        description: RootConfig.module.title,\n      },\n    },\n    plugins: [\n      { name: 'history' },\n      { name: 'disable' },\n      { name: 'unique-fields', options: { fields: 'key', scope: 'global' } },\n    ],\n    relatedEntities: [],\n    groups: [\n      {\n        id: 'basic-info',\n        title: `@general:terms.interface.basic-info`,\n      },\n      {\n        id: 'endpoints',\n        title: `${entityI18n}.groups.endpoints`,\n      },\n      {\n        id: 'credentials',\n        title: `${entityI18n}.groups.credentials`,\n      },\n    ],\n    properties: [\n      {\n        name: 'key',\n        title: `${entityI18n}.fields.key.title`,\n        groupId: 'basic-info',\n        options: {\n          sort: { enabled: true },\n          filter: { advance: { enabled: true }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'title',\n        title: '@general:terms.common.title',\n        groupId: 'basic-info',\n        options: {\n          sort: { enabled: true },\n          filter: { advance: { enabled: true }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'icon',\n        title: `${entityI18n}.fields.icon.title`,\n        groupId: 'basic-info',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'priority',\n        title: `${entityI18n}.fields.priority.title`,\n        groupId: 'basic-info',\n        options: {\n          sort: { enabled: true },\n          filter: { advance: { enabled: true }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'number',\n          defaultValue: 100,\n          interface: { type: AXPWidgetsCatalog.number },\n        },\n      },\n      {\n        name: 'authorizationUrl',\n        title: `${entityI18n}.fields.authorization-url.title`,\n        groupId: 'endpoints',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'tokenUrl',\n        title: `${entityI18n}.fields.token-url.title`,\n        groupId: 'endpoints',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'userInfoUrl',\n        title: `${entityI18n}.fields.user-info-url.title`,\n        groupId: 'endpoints',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'scopes',\n        title: `${entityI18n}.fields.scopes.title`,\n        groupId: 'endpoints',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          defaultValue: 'openid email profile',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'issuerUrl',\n        title: `${entityI18n}.fields.issuer-url.title`,\n        groupId: 'endpoints',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'clientId',\n        title: `${entityI18n}.fields.client-id.title`,\n        groupId: 'credentials',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.text },\n        },\n      },\n      {\n        name: 'clientSecret',\n        title: `${entityI18n}.fields.client-secret.title`,\n        groupId: 'credentials',\n        options: {\n          sort: { enabled: false },\n          filter: { advance: { enabled: false }, inline: { enabled: false } },\n        },\n        schema: {\n          dataType: 'string',\n          interface: { type: AXPWidgetsCatalog.password },\n        },\n      },\n    ],\n    columns: [{ name: 'key' }, { name: 'title' }, { name: 'priority' }],\n    interfaces: {\n      master: {\n        create: {\n          sections: [...MASTER_SECTIONS],\n          properties: [...MASTER_PROPERTIES],\n        },\n        update: {\n          sections: [...MASTER_SECTIONS],\n          properties: [...MASTER_PROPERTIES],\n        },\n        single: {\n          title: '{{title}}',\n          sections: [...MASTER_SECTIONS],\n          properties: [...MASTER_PROPERTIES],\n          actions: [...entityMasterRecordActions()],\n        },\n        list: {\n          actions: [...entityMasterCrudActions()],\n          views: [\n            createAllQueryView({\n              sorts: [\n                { name: 'priority', dir: 'asc' },\n                { name: 'title', dir: 'asc' },\n              ],\n            }),\n          ],\n        },\n      },\n    },\n  };\n\n  return entityDef;\n}\n\n//#endregion\n"],"names":[],"mappings":";;;;AAAA;AAMA;AAEA;AAEA,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAW;AAEtE,MAAM,eAAe,GAAG;AACtB,IAAA,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE;AAC5C,IAAA,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE;AAC3C,IAAA,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE;CAC9C;AAED,MAAM,iBAAiB,GAAG;IACxB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IACxE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IAC1E,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IACzE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IAC7E,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IACtF,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IAC9E,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IACjF,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IAC5E,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IAC/E,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CACnF;AAED;AAEA;AAEO,eAAe,uBAAuB,GAAA;AAC3C,IAAA,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI;AACnC,IAAA,MAAM,UAAU,GAAG,CAAA,CAAA,EAAI,IAAI,gDAAgD;AAE3E,IAAA,MAAM,SAAS,GAAc;AAC3B,QAAA,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC9B,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI;AAC/C,QAAA,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK;AACjD,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI;AAC/C,QAAA,OAAO,EAAE;AACP,YAAA,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK;AACtD,YAAA,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW;AACxD,YAAA,YAAY,EAAE;AACZ,gBAAA,KAAK,EAAE,aAAa;AACpB,gBAAA,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AACrC,aAAA;AACF,SAAA;AACD,QAAA,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,SAAS,EAAE;YACnB,EAAE,IAAI,EAAE,SAAS,EAAE;AACnB,YAAA,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;AACvE,SAAA;AACD,QAAA,eAAe,EAAE,EAAE;AACnB,QAAA,MAAM,EAAE;AACN,YAAA;AACE,gBAAA,EAAE,EAAE,YAAY;AAChB,gBAAA,KAAK,EAAE,CAAA,mCAAA,CAAqC;AAC7C,aAAA;AACD,YAAA;AACE,gBAAA,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,iBAAA,CAAmB;AACxC,aAAA;AACD,YAAA;AACE,gBAAA,EAAE,EAAE,aAAa;gBACjB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,mBAAA,CAAqB;AAC1C,aAAA;AACF,SAAA;AACD,QAAA,UAAU,EAAE;AACV,YAAA;AACE,gBAAA,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,iBAAA,CAAmB;AACvC,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;AACvB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACnE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,OAAO;AACb,gBAAA,KAAK,EAAE,6BAA6B;AACpC,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;AACvB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACnE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,kBAAA,CAAoB;AACxC,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,sBAAA,CAAwB;AAC5C,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;AACvB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACnE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,YAAY,EAAE,GAAG;AACjB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE;AAC9C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,+BAAA,CAAiC;AACrD,gBAAA,OAAO,EAAE,WAAW;AACpB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,uBAAA,CAAyB;AAC7C,gBAAA,OAAO,EAAE,WAAW;AACpB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,2BAAA,CAA6B;AACjD,gBAAA,OAAO,EAAE,WAAW;AACpB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,oBAAA,CAAsB;AAC1C,gBAAA,OAAO,EAAE,WAAW;AACpB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,YAAY,EAAE,sBAAsB;AACpC,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,wBAAA,CAA0B;AAC9C,gBAAA,OAAO,EAAE,WAAW;AACpB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,uBAAA,CAAyB;AAC7C,gBAAA,OAAO,EAAE,aAAa;AACtB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;AAC5C,iBAAA;AACF,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,CAAA,EAAG,UAAU,CAAA,2BAAA,CAA6B;AACjD,gBAAA,OAAO,EAAE,aAAa;AACtB,gBAAA,OAAO,EAAE;AACP,oBAAA,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;AACxB,oBAAA,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;AACpE,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;AAChD,iBAAA;AACF,aAAA;AACF,SAAA;AACD,QAAA,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnE,QAAA,UAAU,EAAE;AACV,YAAA,MAAM,EAAE;AACN,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,CAAC,GAAG,eAAe,CAAC;AAC9B,oBAAA,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC;AACnC,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,CAAC,GAAG,eAAe,CAAC;AAC9B,oBAAA,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC;AACnC,iBAAA;AACD,gBAAA,MAAM,EAAE;AACN,oBAAA,KAAK,EAAE,WAAW;AAClB,oBAAA,QAAQ,EAAE,CAAC,GAAG,eAAe,CAAC;AAC9B,oBAAA,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC;AAClC,oBAAA,OAAO,EAAE,CAAC,GAAG,yBAAyB,EAAE,CAAC;AAC1C,iBAAA;AACD,gBAAA,IAAI,EAAE;AACJ,oBAAA,OAAO,EAAE,CAAC,GAAG,uBAAuB,EAAE,CAAC;AACvC,oBAAA,KAAK,EAAE;AACL,wBAAA,kBAAkB,CAAC;AACjB,4BAAA,KAAK,EAAE;AACL,gCAAA,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE;AAChC,gCAAA,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;AAC9B,6BAAA;yBACF,CAAC;AACH,qBAAA;AACF,iBAAA;AACF,aAAA;AACF,SAAA;KACF;AAED,IAAA,OAAO,SAAS;AAClB;AAEA;;"}