@acorex-platform/module-security-management-client 0.0.62 → 0.0.63

package/fesm2022/{acorex-platform-module-security-management-client-approve-join-request.command-BSvK59LV.mjs.map → acorex-platform-module-security-management-client-approve-join-request.command-pfC6Bixs.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-approve-join-request.command-BSvK59LV.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/approve-join-request.command.ts"],"sourcesContent":["import { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService, resolveMultiLanguageString } from '@acorex/core/translation';\nimport { AXPSessionService } from '@acorex-platform/framework-client/auth';\nimport {\n  AXPLayoutBuilderService,\n  resolveLayoutBuilderDialogResult,\n} from '@acorex-platform/framework-client/layout/builder';\nimport { AXPCommandService } from '@acorex-platform/framework-client/runtime';\nimport { AXPWidgetsList } from '@acorex-platform/framework-shared/core';\nimport type {\n  AXPCommand,\n  AXPCommandExecuteResultPromise,\n  AXPEntityActionCommandInput,\n} from '@acorex-platform/framework-shared/runtime';\nimport { resolveEntityActionCommandInput } from '@acorex-platform/framework-shared/runtime';\nimport {\n  AXM_JOIN_REQUEST_ERROR_CODES,\n  AXM_USER_APPROVE_JOIN_REQUEST_COMMAND,\n  AXMSecurityManagementServerCommands,\n  flattenInviteApplicationRoleAssignments,\n  normalizeInviteApplicationRoleAssignments,\n  type AXMListInviteAssignableRolesResult,\n  type AXMListTenantEntitledApplicationsResult,\n} from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\nimport { AXMUserRoleGrantService } from '../features/user-roles/user-role-grant.service';\nimport type { UserRoleOption } from '../features/user-roles/user-role-grant.types';\nimport {\n  resolveInvitationCommandTargets,\n  type AXPInvitationTargetCommandInput,\n} from './invitation-target.util';\n\nexport { AXM_USER_APPROVE_JOIN_REQUEST_COMMAND };\n\n//#region ----- Types -----\n\ninterface ApproveApplicationRoleRow {\n  id?: string;\n  applicationId?: string;\n  roleIds?: string[];\n}\n\ninterface ApproveFormResult {\n  applicationIds?: string[];\n  roleIds?: string[];\n  applicationRoleRows?: ApproveApplicationRoleRow[];\n}\n\ninterface EntitledApplicationOption {\n  id: string;\n  title: string;\n}\n\ninterface ApproveRoleOption {\n  id: string;\n  title: string;\n  applicationId: string;\n}\n\n/** TM edition feature — multi-app invite/approve (ADR-TEN-001 D-05). */\nconst INVITE_MULTI_APPLICATION_FEATURE = 'TenantManagement:Feature:InviteMultiApplication';\n\nconst TENANT_USER_ENTITY = 'TenantManagement.TenantUser';\nconst TENANT_USER_ENTITY_NAME = 'TenantUser';\n\n//#endregion\n\n//#region ---- AXPApproveJoinRequestCommand ----\n\n@Injectable({ providedIn: 'root' })\nexport class AXPApproveJoinRequestCommand implements AXPCommand {\n  private readonly layoutBuilder = inject(AXPLayoutBuilderService);\n  private readonly toastService = inject(AXToastService);\n  private readonly translationService = inject(AXTranslationService);\n  private readonly commandService = inject(AXPCommandService);\n  private readonly sessionService = inject(AXPSessionService);\n  private readonly userRoleGrantService = inject(AXMUserRoleGrantService);\n\n  async execute(input?: unknown): AXPCommandExecuteResultPromise {\n    const actionInput = resolveEntityActionCommandInput(input);\n    const data = (actionInput.data ?? {}) as AXPInvitationTargetCommandInput['data'];\n    const { tenantUserId, userId } = resolveInvitationCommandTargets({\n      data,\n      tenantUserId: (input as AXPInvitationTargetCommandInput | undefined)?.tenantUserId,\n      userId: (input as AXPInvitationTargetCommandInput | undefined)?.userId,\n    });\n    if (!tenantUserId && !userId) {\n      return { success: false, message: { text: 'Tenant user id is required.' } };\n    }\n\n    const form = await this.openApproveDialog(actionInput);\n    if (!form) {\n      return { success: true, kind: 'object', data: { outcome: 'cancelled' } };\n    }\n\n    const tenantMembershipApprove = this.allowsMultiApplicationApprove(actionInput);\n    const remotePayload = this.toRemotePayload(form, tenantMembershipApprove, tenantUserId, userId);\n\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.ApproveJoinRequest,\n      remotePayload,\n    );\n\n    if (result?.success) {\n      const [toastTitle, toastContent] = await Promise.all([\n        this.translationService\n          .translateAsync('@security-management:users.entities.user.actions.approve-join-request.success.title')\n          .catch(() => 'Approved'),\n        this.translationService\n          .translateAsync(\n            '@security-management:users.entities.user.actions.approve-join-request.success.description',\n          )\n          .catch(() => 'The membership request was approved.'),\n      ]);\n      this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });\n      return { success: true, kind: 'object', data: undefined };\n    }\n\n    const [toastTitle, fallback] = await Promise.all([\n      this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.approve-join-request.error.title')\n        .catch(() => 'Approve Failed'),\n      this.translationService\n        .translateAsync(\n          '@security-management:users.entities.user.actions.approve-join-request.error.description',\n        )\n        .catch(() => 'Failed to approve the membership request.'),\n    ]);\n    const code = typeof result?.message?.code === 'string' ? result.message.code : '';\n    const mapped =\n      code === AXM_JOIN_REQUEST_ERROR_CODES.NotPending\n        ? await this.translationService\n            .translateAsync(\n              '@security-management:users.entities.user.actions.approve-join-request.error.not-pending',\n            )\n            .catch(() => fallback)\n        : fallback;\n    this.toastService.show({ color: 'danger', title: toastTitle, content: mapped, timeOut: 4000 });\n    return { success: false };\n  }\n\n  private allowsMultiApplicationApprove(actionInput: AXPEntityActionCommandInput): boolean {\n    if (!this.sessionService.isFeatureEnabled(INVITE_MULTI_APPLICATION_FEATURE)) {\n      return false;\n    }\n    const entity = actionInput.entity ?? '';\n    const name = actionInput.entityInfo?.name ?? '';\n    return entity === TENANT_USER_ENTITY || name === TENANT_USER_ENTITY_NAME;\n  }\n\n  private toRemotePayload(\n    form: ApproveFormResult,\n    tenantMembershipApprove: boolean,\n    tenantUserId: string | undefined,\n    userId: string | undefined,\n  ): Record<string, unknown> {\n    const base = {\n      tenantUserId,\n      userId,\n      tenantMembershipApprove,\n    };\n\n    if (!tenantMembershipApprove) {\n      return {\n        ...base,\n        roleIds: form.roleIds,\n      };\n    }\n\n    const assignments = normalizeInviteApplicationRoleAssignments(form.applicationRoleRows);\n    const flat = flattenInviteApplicationRoleAssignments(assignments);\n    return {\n      ...base,\n      applicationIds: flat.applicationIds,\n      roleIds: flat.roleIds.length > 0 ? flat.roleIds : undefined,\n      applicationRoleAssignments: assignments,\n    };\n  }\n\n  private async loadEntitledApplicationOptions(): Promise<EntitledApplicationOption[]> {\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.ListTenantEntitledApplications,\n      {},\n    );\n    if (!result?.success) {\n      return [];\n    }\n    const payload = (result as { data?: AXMListTenantEntitledApplicationsResult })?.data;\n    const items = Array.isArray(payload?.items) ? payload.items : [];\n    const locale = this.translationService.getActiveLang?.() ?? 'en-US';\n    return items\n      .map((item) => {\n        const id = String(item?.id ?? '').trim();\n        if (!id) {\n          return null;\n        }\n        const title = resolveMultiLanguageString(item.title as never, locale).trim() || id;\n        return { id, title };\n      })\n      .filter((row): row is EntitledApplicationOption => row != null);\n  }\n\n  private async loadTenantUserInviteRoleOptions(applicationId?: string): Promise<ApproveRoleOption[]> {\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.ListInviteAssignableRoles,\n      applicationId ? { applicationId } : {},\n    );\n    if (!result?.success) {\n      return [];\n    }\n    const payload = (result as { data?: AXMListInviteAssignableRolesResult })?.data;\n    const items = Array.isArray(payload?.items) ? payload.items : [];\n    const locale = this.translationService.getActiveLang?.() ?? 'en-US';\n    return items\n      .map((item) => {\n        const id = String(item?.id ?? '').trim();\n        const applicationId = String(item?.applicationId ?? '').trim();\n        if (!id || !applicationId) {\n          return null;\n        }\n        const title = resolveMultiLanguageString(item.title as never, locale).trim() || id;\n        return { id, title, applicationId };\n      })\n      .filter((row): row is ApproveRoleOption => row != null);\n  }\n\n  private buildApplicationRoleRepeaterChildren(\n    entitledApps: EntitledApplicationOption[],\n    roleOptions: ApproveRoleOption[],\n  ): Record<string, unknown>[] {\n    return [\n      {\n        type: AXPWidgetsList.Layouts.FlexLayout,\n        mode: 'edit' as const,\n        options: {\n          flexDirection: 'row',\n          gap: '12px',\n          alignItems: 'flex-end',\n          wrap: 'nowrap',\n        },\n        children: [\n          {\n            type: AXPWidgetsList.Layouts.FlexItemLayout,\n            mode: 'edit' as const,\n            options: { grow: '1', shrink: '1', basis: '0' },\n            children: [\n              {\n                type: AXPWidgetsList.Layouts.FormField,\n                mode: 'edit' as const,\n                options: {\n                  label:\n                    '@security-management:users.entities.user.actions.approve-join-request.fields.application',\n                  showLabel: true,\n                },\n                children: [\n                  {\n                    type: AXPWidgetsList.Editors.SelectBox,\n                    mode: 'edit' as const,\n                    path: 'applicationId',\n                    name: 'applicationId',\n                    options: {\n                      dataSource: entitledApps,\n                      valueField: 'id',\n                      textField: 'title',\n                      allowSearch: true,\n                      validations: [{ rule: 'required' }],\n                    },\n                  },\n                ],\n              },\n            ],\n          },\n          {\n            type: AXPWidgetsList.Layouts.FlexItemLayout,\n            mode: 'edit' as const,\n            options: { grow: '1', shrink: '1', basis: '0' },\n            children: [\n              {\n                type: AXPWidgetsList.Layouts.FormField,\n                mode: 'edit' as const,\n                options: {\n                  label:\n                    '@security-management:users.entities.user.actions.approve-join-request.fields.roles',\n                  showLabel: true,\n                },\n                children: [\n                  {\n                    type: AXPWidgetsList.Editors.SelectBox,\n                    mode: 'edit' as const,\n                    path: 'roleIds',\n                    name: 'roleIds',\n                    options: {\n                      dataSource: roleOptions,\n                      valueField: 'id',\n                      textField: 'title',\n                      multiple: true,\n                      allowSearch: true,\n                      disabled: \"{{ !context.eval('>applicationId') }}\",\n                      filter: {\n                        field: 'applicationId',\n                        operator: { type: 'equal' },\n                        value: \"{{ context.eval('>applicationId') }}\",\n                      },\n                    },\n                    triggers: [\n                      {\n                        event: \"{{ events.context('>applicationId') }}\",\n                        action: '{{ widget.setValue([]); widget.refresh(); }}',\n                      },\n                    ],\n                  },\n                ],\n              },\n            ],\n          },\n        ],\n      },\n    ];\n  }\n\n  private async openApproveDialog(\n    actionInput: AXPEntityActionCommandInput,\n  ): Promise<ApproveFormResult | null> {\n    const multiApp = this.allowsMultiApplicationApprove(actionInput);\n    const [entitledApps, inviteRoleOptions, roleOptions] = await Promise.all([\n      multiApp ? this.loadEntitledApplicationOptions() : Promise.resolve([] as EntitledApplicationOption[]),\n      multiApp ? this.loadTenantUserInviteRoleOptions() : Promise.resolve([] as ApproveRoleOption[]),\n      multiApp\n        ? Promise.resolve([] as UserRoleOption[])\n        : this.userRoleGrantService.listInviteRoleOptions('application'),\n    ]);\n    const appsWithRoles = new Set(inviteRoleOptions.map((row) => row.applicationId));\n    const selectableApps =\n      appsWithRoles.size > 0\n        ? entitledApps.filter((app) => appsWithRoles.has(app.id))\n        : entitledApps;\n\n    const result = await this.layoutBuilder\n      .create()\n      .dialog<ApproveFormResult | null>((dialog) => {\n        dialog\n          .setTitle('@security-management:users.entities.user.actions.approve-join-request.dialog.title')\n          .setSize(multiApp ? 'lg' : 'md')\n          .setCloseButton(true)\n          .setContext(\n            multiApp\n              ? { applicationRoleRows: [{ applicationId: '', roleIds: [] }] }\n              : { roleIds: [] },\n          )\n          .content((flex) => {\n            flex.setDirection('column').setGap('12px');\n\n            if (multiApp) {\n              flex.formField(\n                '@security-management:users.entities.user.actions.approve-join-request.fields.application-roles',\n                (field) => {\n                  field.path('applicationRoleRows');\n                  field.setShowLabel(true);\n                  field.customWidget(AXPWidgetsList.Layouts.RepeaterLayout, {\n                    hasControls: true,\n                    inlineAddControl: true,\n                    defaultItem: { applicationId: '', roleIds: [] },\n                    children: this.buildApplicationRoleRepeaterChildren(selectableApps, inviteRoleOptions),\n                  });\n                },\n              );\n            } else {\n              flex.formField(\n                '@security-management:users.entities.user.actions.approve-join-request.fields.roles',\n                (field) => {\n                  field.path('roleIds');\n                  field.selectBox({\n                    dataSource: roleOptions as UserRoleOption[],\n                    valueField: 'id',\n                    textField: 'title',\n                    multiple: true,\n                  });\n                },\n              );\n            }\n          })\n          .setActions((actions) => {\n            actions.cancel('@general:actions.cancel.title');\n            actions.submit(\n              '@security-management:users.entities.user.actions.approve-join-request.dialog.submit',\n            );\n          })\n          .onAction(async (dialogRef) => {\n            if (dialogRef.action() === 'cancel') {\n              return null;\n            }\n            const ctx = dialogRef.context() as ApproveFormResult;\n\n            if (multiApp) {\n              const assignments = normalizeInviteApplicationRoleAssignments(ctx.applicationRoleRows);\n              if (assignments.length === 0) {\n                throw new Error(\n                  '@security-management:users.entities.user.actions.approve-join-request.errors.application-required',\n                );\n              }\n              if (assignments.some((row) => row.roleIds.length === 0)) {\n                throw new Error(\n                  '@security-management:users.entities.user.actions.approve-join-request.errors.roles-required',\n                );\n              }\n              return { applicationRoleRows: assignments };\n            }\n\n            const roleIds = Array.isArray(ctx.roleIds)\n              ? [...new Set(ctx.roleIds.map((id) => String(id).trim()).filter(Boolean))]\n              : [];\n            if (roleIds.length === 0) {\n              throw new Error(\n                '@security-management:users.entities.user.actions.approve-join-request.errors.roles-required',\n              );\n            }\n            return { roleIds };\n          });\n      })\n      .show();\n\n    return resolveLayoutBuilderDialogResult<ApproveFormResult>(result);\n  }\n}\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;;;;;;AA2DA;AACA,MAAM,gCAAgC,GAAG,iDAAiD;AAE1F,MAAM,kBAAkB,GAAG,6BAA6B;AACxD,MAAM,uBAAuB,GAAG,YAAY;AAE5C;AAEA;MAGa,4BAA4B,CAAA;AADzC,IAAA,WAAA,GAAA;AAEmB,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,uBAAuB,CAAC;AAC/C,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACjD,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,oBAAoB,GAAG,MAAM,CAAC,uBAAuB,CAAC;AA2VxE,IAAA;IAzVC,MAAM,OAAO,CAAC,KAAe,EAAA;AAC3B,QAAA,MAAM,WAAW,GAAG,+BAA+B,CAAC,KAAK,CAAC;QAC1D,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAA4C;AAChF,QAAA,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,+BAA+B,CAAC;YAC/D,IAAI;YACJ,YAAY,EAAG,KAAqD,EAAE,YAAY;YAClF,MAAM,EAAG,KAAqD,EAAE,MAAM;AACvE,SAAA,CAAC;AACF,QAAA,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE;AAC5B,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE;QAC7E;QAEA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE;AACT,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;QAC1E;QAEA,MAAM,uBAAuB,GAAG,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC;AAC/E,QAAA,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,CAAC;AAE/F,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,kBAAkB,EACtD,aAAa,CACd;AAED,QAAA,IAAI,MAAM,EAAE,OAAO,EAAE;YACnB,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACnD,gBAAA,IAAI,CAAC;qBACF,cAAc,CAAC,qFAAqF;AACpG,qBAAA,KAAK,CAAC,MAAM,UAAU,CAAC;AAC1B,gBAAA,IAAI,CAAC;qBACF,cAAc,CACb,2FAA2F;AAE5F,qBAAA,KAAK,CAAC,MAAM,sCAAsC,CAAC;AACvD,aAAA,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrG,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3D;QAEA,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC/C,YAAA,IAAI,CAAC;iBACF,cAAc,CAAC,mFAAmF;AAClG,iBAAA,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAChC,YAAA,IAAI,CAAC;iBACF,cAAc,CACb,yFAAyF;AAE1F,iBAAA,KAAK,CAAC,MAAM,2CAA2C,CAAC;AAC5D,SAAA,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE;AACjF,QAAA,MAAM,MAAM,GACV,IAAI,KAAK,4BAA4B,CAAC;AACpC,cAAE,MAAM,IAAI,CAAC;iBACR,cAAc,CACb,yFAAyF;AAE1F,iBAAA,KAAK,CAAC,MAAM,QAAQ;cACvB,QAAQ;QACd,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9F,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;AAEQ,IAAA,6BAA6B,CAAC,WAAwC,EAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE;AAC3E,YAAA,OAAO,KAAK;QACd;AACA,QAAA,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE;AAC/C,QAAA,OAAO,MAAM,KAAK,kBAAkB,IAAI,IAAI,KAAK,uBAAuB;IAC1E;AAEQ,IAAA,eAAe,CACrB,IAAuB,EACvB,uBAAgC,EAChC,YAAgC,EAChC,MAA0B,EAAA;AAE1B,QAAA,MAAM,IAAI,GAAG;YACX,YAAY;YACZ,MAAM;YACN,uBAAuB;SACxB;QAED,IAAI,CAAC,uBAAuB,EAAE;YAC5B,OAAO;AACL,gBAAA,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;QACH;QAEA,MAAM,WAAW,GAAG,yCAAyC,CAAC,IAAI,CAAC,mBAAmB,CAAC;AACvF,QAAA,MAAM,IAAI,GAAG,uCAAuC,CAAC,WAAW,CAAC;QACjE,OAAO;AACL,YAAA,GAAG,IAAI;YACP,cAAc,EAAE,IAAI,CAAC,cAAc;AACnC,YAAA,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS;AAC3D,YAAA,0BAA0B,EAAE,WAAW;SACxC;IACH;AAEQ,IAAA,MAAM,8BAA8B,GAAA;AAC1C,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,8BAA8B,EAClE,EAAE,CACH;AACD,QAAA,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;AACpB,YAAA,OAAO,EAAE;QACX;AACA,QAAA,MAAM,OAAO,GAAI,MAA6D,EAAE,IAAI;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,IAAI,IAAI,OAAO;AACnE,QAAA,OAAO;AACJ,aAAA,GAAG,CAAC,CAAC,IAAI,KAAI;AACZ,YAAA,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACxC,IAAI,CAAC,EAAE,EAAE;AACP,gBAAA,OAAO,IAAI;YACb;AACA,YAAA,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE;AAClF,YAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE;AACtB,QAAA,CAAC;aACA,MAAM,CAAC,CAAC,GAAG,KAAuC,GAAG,IAAI,IAAI,CAAC;IACnE;IAEQ,MAAM,+BAA+B,CAAC,aAAsB,EAAA;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,yBAAyB,EAC7D,aAAa,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CACvC;AACD,QAAA,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;AACpB,YAAA,OAAO,EAAE;QACX;AACA,QAAA,MAAM,OAAO,GAAI,MAAwD,EAAE,IAAI;QAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,IAAI,IAAI,OAAO;AACnE,QAAA,OAAO;AACJ,aAAA,GAAG,CAAC,CAAC,IAAI,KAAI;AACZ,YAAA,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;AACxC,YAAA,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;AAC9D,YAAA,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE;AACzB,gBAAA,OAAO,IAAI;YACb;AACA,YAAA,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE;AAClF,YAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;AACrC,QAAA,CAAC;aACA,MAAM,CAAC,CAAC,GAAG,KAA+B,GAAG,IAAI,IAAI,CAAC;IAC3D;IAEQ,oCAAoC,CAC1C,YAAyC,EACzC,WAAgC,EAAA;QAEhC,OAAO;AACL,YAAA;AACE,gBAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU;AACvC,gBAAA,IAAI,EAAE,MAAe;AACrB,gBAAA,OAAO,EAAE;AACP,oBAAA,aAAa,EAAE,KAAK;AACpB,oBAAA,GAAG,EAAE,MAAM;AACX,oBAAA,UAAU,EAAE,UAAU;AACtB,oBAAA,IAAI,EAAE,QAAQ;AACf,iBAAA;AACD,gBAAA,QAAQ,EAAE;AACR,oBAAA;AACE,wBAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,cAAc;AAC3C,wBAAA,IAAI,EAAE,MAAe;AACrB,wBAAA,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;AAC/C,wBAAA,QAAQ,EAAE;AACR,4BAAA;AACE,gCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,gCAAA,IAAI,EAAE,MAAe;AACrB,gCAAA,OAAO,EAAE;AACP,oCAAA,KAAK,EACH,0FAA0F;AAC5F,oCAAA,SAAS,EAAE,IAAI;AAChB,iCAAA;AACD,gCAAA,QAAQ,EAAE;AACR,oCAAA;AACE,wCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,wCAAA,IAAI,EAAE,MAAe;AACrB,wCAAA,IAAI,EAAE,eAAe;AACrB,wCAAA,IAAI,EAAE,eAAe;AACrB,wCAAA,OAAO,EAAE;AACP,4CAAA,UAAU,EAAE,YAAY;AACxB,4CAAA,UAAU,EAAE,IAAI;AAChB,4CAAA,SAAS,EAAE,OAAO;AAClB,4CAAA,WAAW,EAAE,IAAI;AACjB,4CAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,yCAAA;AACF,qCAAA;AACF,iCAAA;AACF,6BAAA;AACF,yBAAA;AACF,qBAAA;AACD,oBAAA;AACE,wBAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,cAAc;AAC3C,wBAAA,IAAI,EAAE,MAAe;AACrB,wBAAA,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;AAC/C,wBAAA,QAAQ,EAAE;AACR,4BAAA;AACE,gCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,gCAAA,IAAI,EAAE,MAAe;AACrB,gCAAA,OAAO,EAAE;AACP,oCAAA,KAAK,EACH,oFAAoF;AACtF,oCAAA,SAAS,EAAE,IAAI;AAChB,iCAAA;AACD,gCAAA,QAAQ,EAAE;AACR,oCAAA;AACE,wCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,wCAAA,IAAI,EAAE,MAAe;AACrB,wCAAA,IAAI,EAAE,SAAS;AACf,wCAAA,IAAI,EAAE,SAAS;AACf,wCAAA,OAAO,EAAE;AACP,4CAAA,UAAU,EAAE,WAAW;AACvB,4CAAA,UAAU,EAAE,IAAI;AAChB,4CAAA,SAAS,EAAE,OAAO;AAClB,4CAAA,QAAQ,EAAE,IAAI;AACd,4CAAA,WAAW,EAAE,IAAI;AACjB,4CAAA,QAAQ,EAAE,uCAAuC;AACjD,4CAAA,MAAM,EAAE;AACN,gDAAA,KAAK,EAAE,eAAe;AACtB,gDAAA,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;AAC3B,gDAAA,KAAK,EAAE,sCAAsC;AAC9C,6CAAA;AACF,yCAAA;AACD,wCAAA,QAAQ,EAAE;AACR,4CAAA;AACE,gDAAA,KAAK,EAAE,wCAAwC;AAC/C,gDAAA,MAAM,EAAE,8CAA8C;AACvD,6CAAA;AACF,yCAAA;AACF,qCAAA;AACF,iCAAA;AACF,6BAAA;AACF,yBAAA;AACF,qBAAA;AACF,iBAAA;AACF,aAAA;SACF;IACH;IAEQ,MAAM,iBAAiB,CAC7B,WAAwC,EAAA;QAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC;AAChE,QAAA,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACvE,YAAA,QAAQ,GAAG,IAAI,CAAC,8BAA8B,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAiC,CAAC;AACrG,YAAA,QAAQ,GAAG,IAAI,CAAC,+BAA+B,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAyB,CAAC;YAC9F;AACE,kBAAE,OAAO,CAAC,OAAO,CAAC,EAAsB;kBACtC,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,aAAa,CAAC;AACnE,SAAA,CAAC;AACF,QAAA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC,CAAC;AAChF,QAAA,MAAM,cAAc,GAClB,aAAa,CAAC,IAAI,GAAG;AACnB,cAAE,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;cACtD,YAAY;AAElB,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;AACvB,aAAA,MAAM;AACN,aAAA,MAAM,CAA2B,CAAC,MAAM,KAAI;YAC3C;iBACG,QAAQ,CAAC,oFAAoF;iBAC7F,OAAO,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI;iBAC9B,cAAc,CAAC,IAAI;AACnB,iBAAA,UAAU,CACT;AACE,kBAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC7D,kBAAE,EAAE,OAAO,EAAE,EAAE,EAAE;AAEpB,iBAAA,OAAO,CAAC,CAAC,IAAI,KAAI;gBAChB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBAE1C,IAAI,QAAQ,EAAE;oBACZ,IAAI,CAAC,SAAS,CACZ,gGAAgG,EAChG,CAAC,KAAK,KAAI;AACR,wBAAA,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;AACjC,wBAAA,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;wBACxB,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE;AACxD,4BAAA,WAAW,EAAE,IAAI;AACjB,4BAAA,gBAAgB,EAAE,IAAI;4BACtB,WAAW,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;4BAC/C,QAAQ,EAAE,IAAI,CAAC,oCAAoC,CAAC,cAAc,EAAE,iBAAiB,CAAC;AACvF,yBAAA,CAAC;AACJ,oBAAA,CAAC,CACF;gBACH;qBAAO;oBACL,IAAI,CAAC,SAAS,CACZ,oFAAoF,EACpF,CAAC,KAAK,KAAI;AACR,wBAAA,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,KAAK,CAAC,SAAS,CAAC;AACd,4BAAA,UAAU,EAAE,WAA+B;AAC3C,4BAAA,UAAU,EAAE,IAAI;AAChB,4BAAA,SAAS,EAAE,OAAO;AAClB,4BAAA,QAAQ,EAAE,IAAI;AACf,yBAAA,CAAC;AACJ,oBAAA,CAAC,CACF;gBACH;AACF,YAAA,CAAC;AACA,iBAAA,UAAU,CAAC,CAAC,OAAO,KAAI;AACtB,gBAAA,OAAO,CAAC,MAAM,CAAC,+BAA+B,CAAC;AAC/C,gBAAA,OAAO,CAAC,MAAM,CACZ,qFAAqF,CACtF;AACH,YAAA,CAAC;AACA,iBAAA,QAAQ,CAAC,OAAO,SAAS,KAAI;AAC5B,gBAAA,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,QAAQ,EAAE;AACnC,oBAAA,OAAO,IAAI;gBACb;AACA,gBAAA,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAuB;gBAEpD,IAAI,QAAQ,EAAE;oBACZ,MAAM,WAAW,GAAG,yCAAyC,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACtF,oBAAA,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5B,wBAAA,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG;oBACH;AACA,oBAAA,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE;AACvD,wBAAA,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F;oBACH;AACA,oBAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE;gBAC7C;gBAEA,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;AACvC,sBAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;sBACvE,EAAE;AACN,gBAAA,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AACxB,oBAAA,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F;gBACH;gBACA,OAAO,EAAE,OAAO,EAAE;AACpB,YAAA,CAAC,CAAC;AACN,QAAA,CAAC;AACA,aAAA,IAAI,EAAE;AAET,QAAA,OAAO,gCAAgC,CAAoB,MAAM,CAAC;IACpE;8GAhWW,4BAA4B,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAA5B,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,4BAA4B,cADf,MAAM,EAAA,CAAA,CAAA;;2FACnB,4BAA4B,EAAA,UAAA,EAAA,CAAA;kBADxC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;"}
+{"version":3,"file":"acorex-platform-module-security-management-client-approve-join-request.command-pfC6Bixs.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/approve-join-request.command.ts"],"sourcesContent":["import { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService, resolveMultiLanguageString } from '@acorex/core/translation';\nimport { AXPSessionService } from '@acorex-platform/framework-client/auth';\nimport {\n  AXPLayoutBuilderService,\n  resolveLayoutBuilderDialogResult,\n} from '@acorex-platform/framework-client/layout/builder';\nimport { AXPCommandService } from '@acorex-platform/framework-client/runtime';\nimport { AXPWidgetsList } from '@acorex-platform/framework-shared/core';\nimport type {\n  AXPCommand,\n  AXPCommandExecuteResultPromise,\n  AXPEntityActionCommandInput,\n} from '@acorex-platform/framework-shared/runtime';\nimport { resolveEntityActionCommandInput } from '@acorex-platform/framework-shared/runtime';\nimport {\n  AXM_JOIN_REQUEST_ERROR_CODES,\n  AXM_USER_APPROVE_JOIN_REQUEST_COMMAND,\n  AXMSecurityManagementServerCommands,\n  flattenInviteApplicationRoleAssignments,\n  normalizeInviteApplicationRoleAssignments,\n  type AXMListInviteAssignableRolesResult,\n  type AXMListTenantEntitledApplicationsResult,\n} from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\nimport { AXMUserRoleGrantService } from '../features/user-roles/user-role-grant.service';\nimport type { UserRoleOption } from '../features/user-roles/user-role-grant.types';\nimport {\n  resolveInvitationCommandTargets,\n  type AXPInvitationTargetCommandInput,\n} from './invitation-target.util';\n\nexport { AXM_USER_APPROVE_JOIN_REQUEST_COMMAND };\n\n//#region ----- Types -----\n\ninterface ApproveApplicationRoleRow {\n  id?: string;\n  applicationId?: string;\n  roleIds?: string[];\n}\n\ninterface ApproveFormResult {\n  applicationIds?: string[];\n  roleIds?: string[];\n  applicationRoleRows?: ApproveApplicationRoleRow[];\n}\n\ninterface EntitledApplicationOption {\n  id: string;\n  title: string;\n}\n\ninterface ApproveRoleOption {\n  id: string;\n  title: string;\n  applicationId: string;\n}\n\n/** TM edition feature — multi-app invite/approve (ADR-TEN-001 D-05). */\nconst INVITE_MULTI_APPLICATION_FEATURE = 'TenantManagement:Feature:InviteMultiApplication';\n\nconst TENANT_USER_ENTITY = 'TenantManagement.TenantUser';\nconst TENANT_USER_ENTITY_NAME = 'TenantUser';\n\n//#endregion\n\n//#region ---- AXPApproveJoinRequestCommand ----\n\n@Injectable({ providedIn: 'root' })\nexport class AXPApproveJoinRequestCommand implements AXPCommand {\n  private readonly layoutBuilder = inject(AXPLayoutBuilderService);\n  private readonly toastService = inject(AXToastService);\n  private readonly translationService = inject(AXTranslationService);\n  private readonly commandService = inject(AXPCommandService);\n  private readonly sessionService = inject(AXPSessionService);\n  private readonly userRoleGrantService = inject(AXMUserRoleGrantService);\n\n  async execute(input?: unknown): AXPCommandExecuteResultPromise {\n    const actionInput = resolveEntityActionCommandInput(input);\n    const data = (actionInput.data ?? {}) as AXPInvitationTargetCommandInput['data'];\n    const { tenantUserId, userId } = resolveInvitationCommandTargets({\n      data,\n      tenantUserId: (input as AXPInvitationTargetCommandInput | undefined)?.tenantUserId,\n      userId: (input as AXPInvitationTargetCommandInput | undefined)?.userId,\n    });\n    if (!tenantUserId && !userId) {\n      return { success: false, message: { text: 'Tenant user id is required.' } };\n    }\n\n    const form = await this.openApproveDialog(actionInput);\n    if (!form) {\n      return { success: true, kind: 'object', data: { outcome: 'cancelled' } };\n    }\n\n    const tenantMembershipApprove = this.allowsMultiApplicationApprove(actionInput);\n    const remotePayload = this.toRemotePayload(form, tenantMembershipApprove, tenantUserId, userId);\n\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.ApproveJoinRequest,\n      remotePayload,\n    );\n\n    if (result?.success) {\n      const [toastTitle, toastContent] = await Promise.all([\n        this.translationService\n          .translateAsync('@security-management:users.entities.user.actions.approve-join-request.success.title')\n          .catch(() => 'Approved'),\n        this.translationService\n          .translateAsync(\n            '@security-management:users.entities.user.actions.approve-join-request.success.description',\n          )\n          .catch(() => 'The membership request was approved.'),\n      ]);\n      this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });\n      return { success: true, kind: 'object', data: undefined };\n    }\n\n    const [toastTitle, fallback] = await Promise.all([\n      this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.approve-join-request.error.title')\n        .catch(() => 'Approve Failed'),\n      this.translationService\n        .translateAsync(\n          '@security-management:users.entities.user.actions.approve-join-request.error.description',\n        )\n        .catch(() => 'Failed to approve the membership request.'),\n    ]);\n    const code = typeof result?.message?.code === 'string' ? result.message.code : '';\n    const mapped =\n      code === AXM_JOIN_REQUEST_ERROR_CODES.NotPending\n        ? await this.translationService\n            .translateAsync(\n              '@security-management:users.entities.user.actions.approve-join-request.error.not-pending',\n            )\n            .catch(() => fallback)\n        : fallback;\n    this.toastService.show({ color: 'danger', title: toastTitle, content: mapped, timeOut: 4000 });\n    return { success: false };\n  }\n\n  private allowsMultiApplicationApprove(actionInput: AXPEntityActionCommandInput): boolean {\n    if (!this.sessionService.isFeatureEnabled(INVITE_MULTI_APPLICATION_FEATURE)) {\n      return false;\n    }\n    const entity = actionInput.entity ?? '';\n    const name = actionInput.entityInfo?.name ?? '';\n    return entity === TENANT_USER_ENTITY || name === TENANT_USER_ENTITY_NAME;\n  }\n\n  private toRemotePayload(\n    form: ApproveFormResult,\n    tenantMembershipApprove: boolean,\n    tenantUserId: string | undefined,\n    userId: string | undefined,\n  ): Record<string, unknown> {\n    const base = {\n      tenantUserId,\n      userId,\n      tenantMembershipApprove,\n    };\n\n    if (!tenantMembershipApprove) {\n      return {\n        ...base,\n        roleIds: form.roleIds,\n      };\n    }\n\n    const assignments = normalizeInviteApplicationRoleAssignments(form.applicationRoleRows);\n    const flat = flattenInviteApplicationRoleAssignments(assignments);\n    return {\n      ...base,\n      applicationIds: flat.applicationIds,\n      roleIds: flat.roleIds.length > 0 ? flat.roleIds : undefined,\n      applicationRoleAssignments: assignments,\n    };\n  }\n\n  private async loadEntitledApplicationOptions(): Promise<EntitledApplicationOption[]> {\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.ListTenantEntitledApplications,\n      {},\n    );\n    if (!result?.success) {\n      return [];\n    }\n    const payload = (result as { data?: AXMListTenantEntitledApplicationsResult })?.data;\n    const items = Array.isArray(payload?.items) ? payload.items : [];\n    const locale = this.translationService.getActiveLang?.() ?? 'en-US';\n    return items\n      .map((item) => {\n        const id = String(item?.id ?? '').trim();\n        if (!id) {\n          return null;\n        }\n        const title = resolveMultiLanguageString(item.title as never, locale).trim() || id;\n        return { id, title };\n      })\n      .filter((row): row is EntitledApplicationOption => row != null);\n  }\n\n  private async loadTenantUserInviteRoleOptions(applicationId?: string): Promise<ApproveRoleOption[]> {\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.ListInviteAssignableRoles,\n      applicationId ? { applicationId } : {},\n    );\n    if (!result?.success) {\n      return [];\n    }\n    const payload = (result as { data?: AXMListInviteAssignableRolesResult })?.data;\n    const items = Array.isArray(payload?.items) ? payload.items : [];\n    const locale = this.translationService.getActiveLang?.() ?? 'en-US';\n    return items\n      .map((item) => {\n        const id = String(item?.id ?? '').trim();\n        const applicationId = String(item?.applicationId ?? '').trim();\n        if (!id || !applicationId) {\n          return null;\n        }\n        const title = resolveMultiLanguageString(item.title as never, locale).trim() || id;\n        return { id, title, applicationId };\n      })\n      .filter((row): row is ApproveRoleOption => row != null);\n  }\n\n  private buildApplicationRoleRepeaterChildren(\n    entitledApps: EntitledApplicationOption[],\n    roleOptions: ApproveRoleOption[],\n  ): Record<string, unknown>[] {\n    return [\n      {\n        type: AXPWidgetsList.Layouts.FlexLayout,\n        mode: 'edit' as const,\n        options: {\n          flexDirection: 'row',\n          gap: '12px',\n          alignItems: 'flex-end',\n          wrap: 'nowrap',\n        },\n        children: [\n          {\n            type: AXPWidgetsList.Layouts.FlexItemLayout,\n            mode: 'edit' as const,\n            options: { grow: '1', shrink: '1', basis: '0' },\n            children: [\n              {\n                type: AXPWidgetsList.Layouts.FormField,\n                mode: 'edit' as const,\n                options: {\n                  label:\n                    '@security-management:users.entities.user.actions.approve-join-request.fields.application',\n                  showLabel: true,\n                },\n                children: [\n                  {\n                    type: AXPWidgetsList.Editors.SelectBox,\n                    mode: 'edit' as const,\n                    path: 'applicationId',\n                    name: 'applicationId',\n                    options: {\n                      dataSource: entitledApps,\n                      valueField: 'id',\n                      textField: 'title',\n                      allowSearch: true,\n                      validations: [{ rule: 'required' }],\n                    },\n                  },\n                ],\n              },\n            ],\n          },\n          {\n            type: AXPWidgetsList.Layouts.FlexItemLayout,\n            mode: 'edit' as const,\n            options: { grow: '1', shrink: '1', basis: '0' },\n            children: [\n              {\n                type: AXPWidgetsList.Layouts.FormField,\n                mode: 'edit' as const,\n                options: {\n                  label:\n                    '@security-management:users.entities.user.actions.approve-join-request.fields.roles',\n                  showLabel: true,\n                },\n                children: [\n                  {\n                    type: AXPWidgetsList.Editors.SelectBox,\n                    mode: 'edit' as const,\n                    path: 'roleIds',\n                    name: 'roleIds',\n                    options: {\n                      dataSource: roleOptions,\n                      valueField: 'id',\n                      textField: 'title',\n                      multiple: true,\n                      allowSearch: true,\n                      disabled: \"{{ !context.eval('>applicationId') }}\",\n                      filter: {\n                        field: 'applicationId',\n                        operator: { type: 'equal' },\n                        value: \"{{ context.eval('>applicationId') }}\",\n                      },\n                    },\n                    triggers: [\n                      {\n                        event: \"{{ events.context('>applicationId') }}\",\n                        action: '{{ widget.setValue([]); widget.refresh(); }}',\n                      },\n                    ],\n                  },\n                ],\n              },\n            ],\n          },\n        ],\n      },\n    ];\n  }\n\n  private async openApproveDialog(\n    actionInput: AXPEntityActionCommandInput,\n  ): Promise<ApproveFormResult | null> {\n    const multiApp = this.allowsMultiApplicationApprove(actionInput);\n    const [entitledApps, inviteRoleOptions, roleOptions] = await Promise.all([\n      multiApp ? this.loadEntitledApplicationOptions() : Promise.resolve([] as EntitledApplicationOption[]),\n      multiApp ? this.loadTenantUserInviteRoleOptions() : Promise.resolve([] as ApproveRoleOption[]),\n      multiApp\n        ? Promise.resolve([] as UserRoleOption[])\n        : this.userRoleGrantService.listInviteRoleOptions('application'),\n    ]);\n    const appsWithRoles = new Set(inviteRoleOptions.map((row) => row.applicationId));\n    const selectableApps =\n      appsWithRoles.size > 0\n        ? entitledApps.filter((app) => appsWithRoles.has(app.id))\n        : entitledApps;\n\n    const result = await this.layoutBuilder\n      .create()\n      .dialog<ApproveFormResult | null>((dialog) => {\n        dialog\n          .setTitle('@security-management:users.entities.user.actions.approve-join-request.dialog.title')\n          .setSize(multiApp ? 'lg' : 'md')\n          .setCloseButton(true)\n          .setContext(\n            multiApp\n              ? { applicationRoleRows: [{ applicationId: '', roleIds: [] }] }\n              : { roleIds: [] },\n          )\n          .content((flex) => {\n            flex.setDirection('column').setGap('12px');\n\n            if (multiApp) {\n              flex.formField(\n                '@security-management:users.entities.user.actions.approve-join-request.fields.application-roles',\n                (field) => {\n                  field.path('applicationRoleRows');\n                  field.setShowLabel(true);\n                  field.customWidget(AXPWidgetsList.Layouts.RepeaterLayout, {\n                    hasControls: true,\n                    inlineAddControl: true,\n                    defaultItem: { applicationId: '', roleIds: [] },\n                    children: this.buildApplicationRoleRepeaterChildren(selectableApps, inviteRoleOptions),\n                  });\n                },\n              );\n            } else {\n              flex.formField(\n                '@security-management:users.entities.user.actions.approve-join-request.fields.roles',\n                (field) => {\n                  field.path('roleIds');\n                  field.selectBox({\n                    dataSource: roleOptions as UserRoleOption[],\n                    valueField: 'id',\n                    textField: 'title',\n                    multiple: true,\n                  });\n                },\n              );\n            }\n          })\n          .setActions((actions) => {\n            actions.cancel('@general:actions.cancel.title');\n            actions.submit(\n              '@security-management:users.entities.user.actions.approve-join-request.dialog.submit',\n            );\n          })\n          .onAction(async (dialogRef) => {\n            if (dialogRef.action() === 'cancel') {\n              return null;\n            }\n            const ctx = dialogRef.context() as ApproveFormResult;\n\n            if (multiApp) {\n              const assignments = normalizeInviteApplicationRoleAssignments(ctx.applicationRoleRows);\n              if (assignments.length === 0) {\n                throw new Error(\n                  '@security-management:users.entities.user.actions.approve-join-request.errors.application-required',\n                );\n              }\n              if (assignments.some((row) => row.roleIds.length === 0)) {\n                throw new Error(\n                  '@security-management:users.entities.user.actions.approve-join-request.errors.roles-required',\n                );\n              }\n              return { applicationRoleRows: assignments };\n            }\n\n            const roleIds = Array.isArray(ctx.roleIds)\n              ? [...new Set(ctx.roleIds.map((id) => String(id).trim()).filter(Boolean))]\n              : [];\n            if (roleIds.length === 0) {\n              throw new Error(\n                '@security-management:users.entities.user.actions.approve-join-request.errors.roles-required',\n              );\n            }\n            return { roleIds };\n          });\n      })\n      .show();\n\n    return resolveLayoutBuilderDialogResult<ApproveFormResult>(result);\n  }\n}\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;;;;;;AA2DA;AACA,MAAM,gCAAgC,GAAG,iDAAiD;AAE1F,MAAM,kBAAkB,GAAG,6BAA6B;AACxD,MAAM,uBAAuB,GAAG,YAAY;AAE5C;AAEA;MAGa,4BAA4B,CAAA;AADzC,IAAA,WAAA,GAAA;AAEmB,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,uBAAuB,CAAC;AAC/C,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACjD,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,oBAAoB,GAAG,MAAM,CAAC,uBAAuB,CAAC;AA2VxE,IAAA;IAzVC,MAAM,OAAO,CAAC,KAAe,EAAA;AAC3B,QAAA,MAAM,WAAW,GAAG,+BAA+B,CAAC,KAAK,CAAC;QAC1D,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAA4C;AAChF,QAAA,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,+BAA+B,CAAC;YAC/D,IAAI;YACJ,YAAY,EAAG,KAAqD,EAAE,YAAY;YAClF,MAAM,EAAG,KAAqD,EAAE,MAAM;AACvE,SAAA,CAAC;AACF,QAAA,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE;AAC5B,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE;QAC7E;QAEA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE;AACT,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;QAC1E;QAEA,MAAM,uBAAuB,GAAG,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC;AAC/E,QAAA,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,CAAC;AAE/F,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,kBAAkB,EACtD,aAAa,CACd;AAED,QAAA,IAAI,MAAM,EAAE,OAAO,EAAE;YACnB,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACnD,gBAAA,IAAI,CAAC;qBACF,cAAc,CAAC,qFAAqF;AACpG,qBAAA,KAAK,CAAC,MAAM,UAAU,CAAC;AAC1B,gBAAA,IAAI,CAAC;qBACF,cAAc,CACb,2FAA2F;AAE5F,qBAAA,KAAK,CAAC,MAAM,sCAAsC,CAAC;AACvD,aAAA,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrG,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3D;QAEA,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC/C,YAAA,IAAI,CAAC;iBACF,cAAc,CAAC,mFAAmF;AAClG,iBAAA,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAChC,YAAA,IAAI,CAAC;iBACF,cAAc,CACb,yFAAyF;AAE1F,iBAAA,KAAK,CAAC,MAAM,2CAA2C,CAAC;AAC5D,SAAA,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE;AACjF,QAAA,MAAM,MAAM,GACV,IAAI,KAAK,4BAA4B,CAAC;AACpC,cAAE,MAAM,IAAI,CAAC;iBACR,cAAc,CACb,yFAAyF;AAE1F,iBAAA,KAAK,CAAC,MAAM,QAAQ;cACvB,QAAQ;QACd,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9F,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;AAEQ,IAAA,6BAA6B,CAAC,WAAwC,EAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE;AAC3E,YAAA,OAAO,KAAK;QACd;AACA,QAAA,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE;AAC/C,QAAA,OAAO,MAAM,KAAK,kBAAkB,IAAI,IAAI,KAAK,uBAAuB;IAC1E;AAEQ,IAAA,eAAe,CACrB,IAAuB,EACvB,uBAAgC,EAChC,YAAgC,EAChC,MAA0B,EAAA;AAE1B,QAAA,MAAM,IAAI,GAAG;YACX,YAAY;YACZ,MAAM;YACN,uBAAuB;SACxB;QAED,IAAI,CAAC,uBAAuB,EAAE;YAC5B,OAAO;AACL,gBAAA,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;QACH;QAEA,MAAM,WAAW,GAAG,yCAAyC,CAAC,IAAI,CAAC,mBAAmB,CAAC;AACvF,QAAA,MAAM,IAAI,GAAG,uCAAuC,CAAC,WAAW,CAAC;QACjE,OAAO;AACL,YAAA,GAAG,IAAI;YACP,cAAc,EAAE,IAAI,CAAC,cAAc;AACnC,YAAA,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS;AAC3D,YAAA,0BAA0B,EAAE,WAAW;SACxC;IACH;AAEQ,IAAA,MAAM,8BAA8B,GAAA;AAC1C,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,8BAA8B,EAClE,EAAE,CACH;AACD,QAAA,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;AACpB,YAAA,OAAO,EAAE;QACX;AACA,QAAA,MAAM,OAAO,GAAI,MAA6D,EAAE,IAAI;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,IAAI,IAAI,OAAO;AACnE,QAAA,OAAO;AACJ,aAAA,GAAG,CAAC,CAAC,IAAI,KAAI;AACZ,YAAA,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACxC,IAAI,CAAC,EAAE,EAAE;AACP,gBAAA,OAAO,IAAI;YACb;AACA,YAAA,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE;AAClF,YAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE;AACtB,QAAA,CAAC;aACA,MAAM,CAAC,CAAC,GAAG,KAAuC,GAAG,IAAI,IAAI,CAAC;IACnE;IAEQ,MAAM,+BAA+B,CAAC,aAAsB,EAAA;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,yBAAyB,EAC7D,aAAa,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CACvC;AACD,QAAA,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;AACpB,YAAA,OAAO,EAAE;QACX;AACA,QAAA,MAAM,OAAO,GAAI,MAAwD,EAAE,IAAI;QAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,IAAI,IAAI,OAAO;AACnE,QAAA,OAAO;AACJ,aAAA,GAAG,CAAC,CAAC,IAAI,KAAI;AACZ,YAAA,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;AACxC,YAAA,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;AAC9D,YAAA,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE;AACzB,gBAAA,OAAO,IAAI;YACb;AACA,YAAA,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE;AAClF,YAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;AACrC,QAAA,CAAC;aACA,MAAM,CAAC,CAAC,GAAG,KAA+B,GAAG,IAAI,IAAI,CAAC;IAC3D;IAEQ,oCAAoC,CAC1C,YAAyC,EACzC,WAAgC,EAAA;QAEhC,OAAO;AACL,YAAA;AACE,gBAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU;AACvC,gBAAA,IAAI,EAAE,MAAe;AACrB,gBAAA,OAAO,EAAE;AACP,oBAAA,aAAa,EAAE,KAAK;AACpB,oBAAA,GAAG,EAAE,MAAM;AACX,oBAAA,UAAU,EAAE,UAAU;AACtB,oBAAA,IAAI,EAAE,QAAQ;AACf,iBAAA;AACD,gBAAA,QAAQ,EAAE;AACR,oBAAA;AACE,wBAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,cAAc;AAC3C,wBAAA,IAAI,EAAE,MAAe;AACrB,wBAAA,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;AAC/C,wBAAA,QAAQ,EAAE;AACR,4BAAA;AACE,gCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,gCAAA,IAAI,EAAE,MAAe;AACrB,gCAAA,OAAO,EAAE;AACP,oCAAA,KAAK,EACH,0FAA0F;AAC5F,oCAAA,SAAS,EAAE,IAAI;AAChB,iCAAA;AACD,gCAAA,QAAQ,EAAE;AACR,oCAAA;AACE,wCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,wCAAA,IAAI,EAAE,MAAe;AACrB,wCAAA,IAAI,EAAE,eAAe;AACrB,wCAAA,IAAI,EAAE,eAAe;AACrB,wCAAA,OAAO,EAAE;AACP,4CAAA,UAAU,EAAE,YAAY;AACxB,4CAAA,UAAU,EAAE,IAAI;AAChB,4CAAA,SAAS,EAAE,OAAO;AAClB,4CAAA,WAAW,EAAE,IAAI;AACjB,4CAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,yCAAA;AACF,qCAAA;AACF,iCAAA;AACF,6BAAA;AACF,yBAAA;AACF,qBAAA;AACD,oBAAA;AACE,wBAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,cAAc;AAC3C,wBAAA,IAAI,EAAE,MAAe;AACrB,wBAAA,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;AAC/C,wBAAA,QAAQ,EAAE;AACR,4BAAA;AACE,gCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,gCAAA,IAAI,EAAE,MAAe;AACrB,gCAAA,OAAO,EAAE;AACP,oCAAA,KAAK,EACH,oFAAoF;AACtF,oCAAA,SAAS,EAAE,IAAI;AAChB,iCAAA;AACD,gCAAA,QAAQ,EAAE;AACR,oCAAA;AACE,wCAAA,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS;AACtC,wCAAA,IAAI,EAAE,MAAe;AACrB,wCAAA,IAAI,EAAE,SAAS;AACf,wCAAA,IAAI,EAAE,SAAS;AACf,wCAAA,OAAO,EAAE;AACP,4CAAA,UAAU,EAAE,WAAW;AACvB,4CAAA,UAAU,EAAE,IAAI;AAChB,4CAAA,SAAS,EAAE,OAAO;AAClB,4CAAA,QAAQ,EAAE,IAAI;AACd,4CAAA,WAAW,EAAE,IAAI;AACjB,4CAAA,QAAQ,EAAE,uCAAuC;AACjD,4CAAA,MAAM,EAAE;AACN,gDAAA,KAAK,EAAE,eAAe;AACtB,gDAAA,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;AAC3B,gDAAA,KAAK,EAAE,sCAAsC;AAC9C,6CAAA;AACF,yCAAA;AACD,wCAAA,QAAQ,EAAE;AACR,4CAAA;AACE,gDAAA,KAAK,EAAE,wCAAwC;AAC/C,gDAAA,MAAM,EAAE,8CAA8C;AACvD,6CAAA;AACF,yCAAA;AACF,qCAAA;AACF,iCAAA;AACF,6BAAA;AACF,yBAAA;AACF,qBAAA;AACF,iBAAA;AACF,aAAA;SACF;IACH;IAEQ,MAAM,iBAAiB,CAC7B,WAAwC,EAAA;QAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC;AAChE,QAAA,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACvE,YAAA,QAAQ,GAAG,IAAI,CAAC,8BAA8B,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAiC,CAAC;AACrG,YAAA,QAAQ,GAAG,IAAI,CAAC,+BAA+B,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAyB,CAAC;YAC9F;AACE,kBAAE,OAAO,CAAC,OAAO,CAAC,EAAsB;kBACtC,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,aAAa,CAAC;AACnE,SAAA,CAAC;AACF,QAAA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC,CAAC;AAChF,QAAA,MAAM,cAAc,GAClB,aAAa,CAAC,IAAI,GAAG;AACnB,cAAE,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;cACtD,YAAY;AAElB,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;AACvB,aAAA,MAAM;AACN,aAAA,MAAM,CAA2B,CAAC,MAAM,KAAI;YAC3C;iBACG,QAAQ,CAAC,oFAAoF;iBAC7F,OAAO,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI;iBAC9B,cAAc,CAAC,IAAI;AACnB,iBAAA,UAAU,CACT;AACE,kBAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC7D,kBAAE,EAAE,OAAO,EAAE,EAAE,EAAE;AAEpB,iBAAA,OAAO,CAAC,CAAC,IAAI,KAAI;gBAChB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBAE1C,IAAI,QAAQ,EAAE;oBACZ,IAAI,CAAC,SAAS,CACZ,gGAAgG,EAChG,CAAC,KAAK,KAAI;AACR,wBAAA,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;AACjC,wBAAA,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;wBACxB,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE;AACxD,4BAAA,WAAW,EAAE,IAAI;AACjB,4BAAA,gBAAgB,EAAE,IAAI;4BACtB,WAAW,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;4BAC/C,QAAQ,EAAE,IAAI,CAAC,oCAAoC,CAAC,cAAc,EAAE,iBAAiB,CAAC;AACvF,yBAAA,CAAC;AACJ,oBAAA,CAAC,CACF;gBACH;qBAAO;oBACL,IAAI,CAAC,SAAS,CACZ,oFAAoF,EACpF,CAAC,KAAK,KAAI;AACR,wBAAA,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,KAAK,CAAC,SAAS,CAAC;AACd,4BAAA,UAAU,EAAE,WAA+B;AAC3C,4BAAA,UAAU,EAAE,IAAI;AAChB,4BAAA,SAAS,EAAE,OAAO;AAClB,4BAAA,QAAQ,EAAE,IAAI;AACf,yBAAA,CAAC;AACJ,oBAAA,CAAC,CACF;gBACH;AACF,YAAA,CAAC;AACA,iBAAA,UAAU,CAAC,CAAC,OAAO,KAAI;AACtB,gBAAA,OAAO,CAAC,MAAM,CAAC,+BAA+B,CAAC;AAC/C,gBAAA,OAAO,CAAC,MAAM,CACZ,qFAAqF,CACtF;AACH,YAAA,CAAC;AACA,iBAAA,QAAQ,CAAC,OAAO,SAAS,KAAI;AAC5B,gBAAA,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,QAAQ,EAAE;AACnC,oBAAA,OAAO,IAAI;gBACb;AACA,gBAAA,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAuB;gBAEpD,IAAI,QAAQ,EAAE;oBACZ,MAAM,WAAW,GAAG,yCAAyC,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACtF,oBAAA,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5B,wBAAA,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG;oBACH;AACA,oBAAA,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE;AACvD,wBAAA,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F;oBACH;AACA,oBAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE;gBAC7C;gBAEA,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;AACvC,sBAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;sBACvE,EAAE;AACN,gBAAA,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AACxB,oBAAA,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F;gBACH;gBACA,OAAO,EAAE,OAAO,EAAE;AACpB,YAAA,CAAC,CAAC;AACN,QAAA,CAAC;AACA,aAAA,IAAI,EAAE;AAET,QAAA,OAAO,gCAAgC,CAAoB,MAAM,CAAC;IACpE;8GAhWW,4BAA4B,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAA5B,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,4BAA4B,cADf,MAAM,EAAA,CAAA,CAAA;;2FACnB,4BAA4B,EAAA,UAAA,EAAA,CAAA;kBADxC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;"}

package/fesm2022/acorex-platform-module-security-management-client-contracts.mjs

@@ -1,4 +1,4 @@
-import { AXPWidgetsCatalog, AXPSystemActionType } from '@acorex-platform/framework-shared/core';
+import { coerceUnknownToTrimmedString, AXPWidgetsCatalog, AXPSystemActionType } from '@acorex-platform/framework-shared/core';
 import { createAllQueryView, entityMasterCrudActions, AXPEntityCommandScope } from '@acorex-platform/framework-shared/entity';
 
 //#region ---- User context definitions ----
@@ -297,11 +297,12 @@ const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY = 'security-manageme
 const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite';
 //#endregion
 
-//#region ----- Types -----
+//#region ----- Imports -----
 //#endregion
 //#region ----- Helpers -----
 function readScopeString(value) {
-    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+    const id = coerceUnknownToTrimmedString(value);
+    return id || undefined;
 }
 function readInviteRoleScopeInfo(role) {
     const scope = role?.scopeInfo && typeof role.scopeInfo === 'object'
@@ -329,7 +330,7 @@ function isRoleAssignableForInvite(role, mode, context) {
     if (isHiddenRole(role)) {
         return false;
     }
-    const tenantId = context.tenantId?.trim();
+    const tenantId = readScopeString(context.tenantId);
     if (!tenantId) {
         return false;
     }
@@ -340,7 +341,7 @@ function isRoleAssignableForInvite(role, mode, context) {
     if (mode === 'tenant') {
         return !scope.applicationId;
     }
-    const applicationId = context.applicationId?.trim();
+    const applicationId = readScopeString(context.applicationId);
     if (!applicationId) {
         return false;
     }
@@ -355,8 +356,8 @@ function isRoleAssignableForTenantUserInviteRow(role, context) {
     if (isHiddenRole(role)) {
         return false;
     }
-    const tenantId = context.tenantId?.trim();
-    const applicationId = context.applicationId?.trim();
+    const tenantId = readScopeString(context.tenantId);
+    const applicationId = readScopeString(context.applicationId);
     if (!tenantId || !applicationId) {
         return false;
     }

package/fesm2022/acorex-platform-module-security-management-client-contracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-contracts.mjs","sources":["../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts","../../../../libs/modules/security-management/contracts/src/features.keys.ts","../../../../libs/modules/security-management/contracts/src/menu.keys.ts","../../../../libs/modules/security-management/contracts/src/permission.keys.ts","../../../../libs/modules/security-management/contracts/src/ROLE_PERMISSIONS_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/USER_ROLES_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/root-config.ts","../../../../libs/modules/security-management/contracts/src/manifest.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_ACCESS_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/user-access-state.ts","../../../../libs/modules/security-management/contracts/src/user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/user-password-reset.ts","../../../../libs/modules/security-management/contracts/src/user-invitation.ts","../../../../libs/modules/security-management/contracts/src/invite-assignable-roles.util.ts","../../../../libs/modules/security-management/contracts/src/invite-application-role-rows.util.ts","../../../../libs/modules/security-management/contracts/src/create-application-role-rows.util.ts","../../../../libs/modules/security-management/contracts/src/server-commands.ts","../../../../libs/modules/security-management/contracts/src/settings.keys.ts","../../../../libs/modules/security-management/contracts/src/device-session-admin-scope.ts","../../../../libs/modules/security-management/contracts/src/entities/device-sessions/device-sessions.types.ts","../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.types.ts","../../../../libs/modules/security-management/contracts/src/entities/policy/policy.types.ts","../../../../libs/modules/security-management/contracts/src/entities/role-permission/role-permission.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-role/user-role.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-two-factor/user-two-factor.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-two-factor/user-two-factor.entity.ts","../../../../libs/modules/security-management/contracts/src/entities/users/user-provisioning-list-actions.ts","../../../../libs/modules/security-management/contracts/src/index.ts","../../../../libs/modules/security-management/contracts/src/acorex-platform-module-security-management-client-contracts.ts"],"sourcesContent":["import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';\n\n//#region ---- User context definitions ----\n\nexport const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[] = [\n  {\n    name: 'userDisplayName',\n    title: 'User display name',\n    description:\n      'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',\n    order: 11,\n    capabilities: ['ai'],\n  },\n];\n\n//#endregion\n","//#region ----   Feature Keys   ----\n\n/**\n * Security Management Module Feature Keys.\n * Defines all available features for the Security Management module.\n */\nexport const AXPSecurityManagementFeatureKeys = {\n  ManageRoles: 'SecurityManagement:Feature:ManageRoles',\n  ManageUsers: 'SecurityManagement:Feature:ManageUsers',\n  MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',\n  ManageSessions: 'SecurityManagement:Feature:ManageSessions',\n  ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',\n  /** Platform Console only — Identity Provider management menu + CRUD. */\n  ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',\n  /** Self-service account deletion on the profile page. Off unless the edition enables it. */\n  DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',\n} as const;\n\n//#endregion\n\n","export const AXPSecurityManagementMenuKeys = {\n  Root: 'SecurityManagement:Menu',\n  Users: 'SecurityManagement:Menu:Users',\n  Roles: 'SecurityManagement:Menu:Roles',\n  DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',\n  Policy: 'SecurityManagement:Menu:Policy',\n  IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',\n  MyProfile: 'SecurityManagement:Menu:MyProfile',\n} as const;\n","/**\n * Administration capabilities used by this module.\n * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).\n */\nexport const AXPAdministrationPermissionKeys = {\n  Access: 'Administration:Permission:Access',\n  /** Create and maintain users, roles, role assignments, and related security-access reports. */\n  MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',\n  ManageSessions: 'Administration:Permission:ManageSessions',\n  MaintainPolicies: 'Administration:Permission:MaintainPolicies',\n  ViewIntegrations: 'Administration:Permission:ViewIntegrations',\n  MaintainConnections: 'Administration:Permission:MaintainConnections',\n  ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',\n  MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',\n  ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',\n  ViewRules: 'Administration:Permission:ViewRules',\n  MaintainRules: 'Administration:Permission:MaintainRules',\n  ManageRuleActions: 'Administration:Permission:ManageRuleActions',\n  MaintainAi: 'Administration:Permission:MaintainAi',\n  UseAiAssist: 'Administration:Permission:UseAiAssist',\n  MaintainDashboards: 'Administration:Permission:MaintainDashboards',\n  ViewJobs: 'Administration:Permission:ViewJobs',\n  ManageJobActions: 'Administration:Permission:ManageJobActions',\n  ViewObservability: 'Administration:Permission:ViewObservability',\n  MaintainObservability: 'Administration:Permission:MaintainObservability',\n} as const;\n\n/**\n * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.\n * Legacy nested shape kept so existing imports compile during migration.\n */\nexport const AXPSecurityManagementPermissionKeys = {\n  User: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  Role: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  DeviceSession: {\n    Management: AXPAdministrationPermissionKeys.ManageSessions,\n    View: AXPAdministrationPermissionKeys.ManageSessions,\n    Terminate: AXPAdministrationPermissionKeys.ManageSessions,\n  },\n  Policy: {\n    Management: AXPAdministrationPermissionKeys.MaintainPolicies,\n    View: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Edit: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Delete: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Create: AXPAdministrationPermissionKeys.MaintainPolicies,\n  },\n} as const;\n","/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */\nexport const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = 'role-permissions-page';\n","export const USER_ROLES_PAGE_COMPONENT_KEY = 'user-roles-page';\n","const config = {\n  i18n: 'security-management',\n  profileEntity: 'Profile',\n};\nexport const RootConfig = {\n  config,\n  module: {\n    route: 'security-management',\n    name: 'SecurityManagement',\n    title: `@${config.i18n}:module.title`,\n    icon: 'fa-light fa-shield-halved',\n  },\n  entities: {\n    policy: {\n      name: 'Policy',\n      title: `@${config.i18n}:policies.entities.policy.title`,\n      titlePlural: `@${config.i18n}:policies.entities.policy.plural`,\n      icon: 'fa-light fa-clipboard-list',\n    },\n    deviceSessions: {\n      name: 'DeviceSessions',\n      title: `@${config.i18n}:sessions.entities.session.title`,\n      titlePlural: `@${config.i18n}:sessions.entities.session.plural`,\n      icon: 'fa-light fa-laptop',\n    },\n    users: {\n      name: 'User',\n      title: `@${config.i18n}:users.entities.user.title`,\n      titlePlural: `@${config.i18n}:users.entities.user.plural`,\n      icon: 'fa-light fa-users',\n    },\n    roles: {\n      name: 'Role',\n      title: `@${config.i18n}:roles.entities.role.title`,\n      titlePlural: `@${config.i18n}:roles.entities.role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    rolePermission: {\n      name: 'RolePermission',\n      title: `@${config.i18n}:role-permissions.entities.role-permission.title`,\n      titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,\n      icon: 'fa-light fa-key',\n    },\n    userRole: {\n      name: 'UserRole',\n      title: `@${config.i18n}:user-roles.entities.user-role.title`,\n      titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    profile: {\n      name: 'Profile',\n      title: `@${config.i18n}:profile.entities.profile.title`,\n      titlePlural: `@${config.i18n}:profile.entities.profile.plural`,\n      icon: 'fa-light fa-user',\n    },\n    identityProvider: {\n      name: 'IdentityProvider',\n      title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,\n      titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,\n      icon: 'fa-light fa-id-badge',\n    },\n    userTwoFactor: {\n      name: 'UserTwoFactor',\n      title: `@${config.i18n}:user-two-factor.entities.user-two-factor.title`,\n      titlePlural: `@${config.i18n}:user-two-factor.entities.user-two-factor.plural`,\n      icon: 'fa-light fa-shield-keyhole',\n    },\n  },\n  queries: {\n    reports: {\n      getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',\n      getUserEffectivePermissionsHistory:\n        'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',\n      getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',\n      getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',\n      getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',\n    },\n  },\n} as const;\n","//#region ----   Imports   ----\n\nimport { AXPModuleManifest } from '@acorex-platform/framework-shared/core';\nimport { RootConfig } from './root-config';\n\n//#endregion\n\n//#region ----   Manifest Definition   ----\n\n/**\n * Security Management Module Manifest.\n * Defines module metadata, features, and provider references.\n */\nexport const SecurityManagementManifest: AXPModuleManifest = {\n  name: RootConfig.module.name,\n  version: '1.0.0',\n  title: RootConfig.module.title,\n  icon: RootConfig.module.icon,\n  i18n: RootConfig.config.i18n,\n  type: 'platform',\n  domain: 'platform',\n  required: true,\n\n  // Module dependencies (optional)\n};\n\n//#endregion\n\n","/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */\nexport const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';\n","/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */\nexport const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';\n","//#region ---- User access state ----\n\n/**\n * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).\n * Persisted as the enum string value (e.g. `allowed`).\n */\nexport enum AXMUserAccessState {\n  Allowed = 'allowed',\n  Blocked = 'blocked',\n  Expired = 'expired',\n}\n\n//#endregion\n","//#region ---- User effective (unified) state ----\n\n/**\n * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).\n */\nexport enum AXMUserEffectiveState {\n  Pending = 'pending',\n  Active = 'active',\n  Suspended = 'suspended',\n  Inactive = 'inactive',\n  Archived = 'archived',\n  SignInBlocked = 'sign-in-blocked',\n  CredentialExpired = 'credential-expired',\n}\n\n//#endregion\n","import { AXMUserAccessState } from './user-access-state';\nimport { AXMUserEffectiveState } from './user-effective-state';\n\n//#region ---- Resolve effective state ----\n\nconst AccountLifecycleState = {\n  Active: 'active',\n  Archived: 'archived',\n  Pending: 'pending',\n  Inactive: 'inactive',\n  Suspended: 'suspended',\n} as const;\n\n/**\n * Derives the unified operational state from account lifecycle and sign-in gate.\n * Used for persisted `effectiveState` on SecurityManagement.User.\n */\nexport function resolveAXMUserEffectiveState(input: {\n  accountState: string | undefined;\n  accessState: AXMUserAccessState | string | undefined;\n}): AXMUserEffectiveState {\n  const lifecycle = input.accountState;\n  const auth = (input.accessState ?? AXMUserAccessState.Allowed) as string;\n\n  if (lifecycle === AccountLifecycleState.Archived) {\n    return AXMUserEffectiveState.Archived;\n  }\n  if (lifecycle === AccountLifecycleState.Pending) {\n    return AXMUserEffectiveState.Pending;\n  }\n  if (lifecycle === AccountLifecycleState.Inactive) {\n    return AXMUserEffectiveState.Inactive;\n  }\n  if (lifecycle === AccountLifecycleState.Suspended) {\n    return AXMUserEffectiveState.Suspended;\n  }\n  if (auth === AXMUserAccessState.Expired) {\n    return AXMUserEffectiveState.CredentialExpired;\n  }\n  if (auth === AXMUserAccessState.Blocked) {\n    return AXMUserEffectiveState.SignInBlocked;\n  }\n  if (lifecycle === AccountLifecycleState.Active) {\n    return AXMUserEffectiveState.Active;\n  }\n  return AXMUserEffectiveState.Active;\n}\n\n//#endregion\n","//#region ---- Password reset payload on User ----\n\n/**\n * One-time password-reset token state stored as JSON on SecurityManagement.User.\n * The raw token is never persisted — only a SHA-256 hash.\n */\nexport interface AXMUserPasswordResetInfo {\n  tokenHash: string;\n  expiresAt: string;\n  sentAt: string;\n}\n\n//#endregion\n","//#region ---- User invitation payload on TenantUser ----\n\n/**\n * Invitation challenge / audit metadata on TenantManagement.TenantUser.\n * The raw token is never persisted — only a SHA-256 hash while the invite is pending.\n */\nexport interface AXMUserInvitationInfo {\n  /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */\n  tokenHash?: string;\n  expiresAt: string; // ISO\n  sentAt: string;\n  invitedByUserId: string;\n  applicationIds?: string[];\n  /** Role ids selected at invite time (flat union; mirrored onto scoped UserRole). */\n  roleIds?: string[];\n  /** TM Tenant Users: roles grouped by application (optional audit / accept helper). */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * `invite` = admin sent; `join-request` = user requested membership from waiting room;\n   * `tenant-request` = user requested creation of a new tenant (public form).\n   */\n  source: AXMMembershipInvitationSource;\n  /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */\n  acceptedAt?: string;\n}\n\nexport type AXMMembershipInvitationSource = 'invite' | 'join-request' | 'tenant-request';\n\nexport const AXM_MEMBERSHIP_INVITATION_SOURCE = {\n  Invite: 'invite',\n  JoinRequest: 'join-request',\n  TenantRequest: 'tenant-request',\n} as const;\n\n/** How a User identity row was created (directory provenance). */\nexport type AXMUserCreatedVia =\n  | 'invite'\n  | 'create-in-tenant'\n  | 'register'\n  | 'seed'\n  | 'idp'\n  | 'tenant-request';\n/**\n * In-app inbox definition for membership invites to users who already have a tenant.\n * Inbox row action opens the auth waiting room (Approve/Decline live there).\n */\nexport const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY =\n  'security-management.membership-invitation' as const;\n\n/** Query `source` value when opening waiting room from a membership-invite notification. */\nexport const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite' as const;\n\n//#endregion\n","//#region ----- Types -----\n\n/** Invite surface that decides which Role catalog rows are selectable. */\nexport type AXMInviteRoleAssignmentMode = 'application' | 'tenant';\n\nexport interface AXMInviteRoleScopeContext {\n  tenantId: string;\n  /** Required for application-mode filtering. */\n  applicationId?: string;\n}\n\nexport interface AXMInviteRoleScopeInfo {\n  tenantId?: string;\n  applicationId?: string;\n}\n\n//#endregion\n\n//#region ----- Helpers -----\n\nfunction readScopeString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.trim() ? value.trim() : undefined;\n}\n\nexport function readInviteRoleScopeInfo(\n  role: { scopeInfo?: unknown } | null | undefined,\n): AXMInviteRoleScopeInfo {\n  const scope =\n    role?.scopeInfo && typeof role.scopeInfo === 'object'\n      ? (role.scopeInfo as Record<string, unknown>)\n      : undefined;\n  return {\n    tenantId: readScopeString(scope?.['tenantId']),\n    applicationId: readScopeString(scope?.['applicationId']),\n  };\n}\n\nfunction isHiddenRole(role: { stateInfo?: unknown } | null | undefined): boolean {\n  const state =\n    role?.stateInfo && typeof role.stateInfo === 'object'\n      ? (role.stateInfo as Record<string, unknown>)\n      : undefined;\n  return state?.['isHidden'] === true;\n}\n\n/**\n * Whether a Role catalog row may appear in the invite roles multi-select.\n *\n * UI-only selection filter (does not change Role / RLS):\n * - Application invite / per-app repeater row → current-tenant + that application overlays only\n * - Tenant invite → current-tenant-wide rows only (no applicationId, no other-app overlays)\n */\nexport function isRoleAssignableForInvite(\n  role: { scopeInfo?: unknown; stateInfo?: unknown } | null | undefined,\n  mode: AXMInviteRoleAssignmentMode,\n  context: AXMInviteRoleScopeContext,\n): boolean {\n  if (isHiddenRole(role)) {\n    return false;\n  }\n\n  const tenantId = context.tenantId?.trim();\n  if (!tenantId) {\n    return false;\n  }\n\n  const scope = readInviteRoleScopeInfo(role);\n  if (!scope.tenantId || scope.tenantId !== tenantId) {\n    return false;\n  }\n\n  if (mode === 'tenant') {\n    return !scope.applicationId;\n  }\n\n  const applicationId = context.applicationId?.trim();\n  if (!applicationId) {\n    return false;\n  }\n  return scope.applicationId === applicationId;\n}\n\n/**\n * TM Tenant Users invite repeater only: overlay for current tenant + the\n * application chosen on that row. Independent of {@link isRoleAssignableForInvite}\n * so Security → Users invite can change without affecting this picker.\n */\nexport function isRoleAssignableForTenantUserInviteRow(\n  role: { scopeInfo?: unknown; stateInfo?: unknown } | null | undefined,\n  context: AXMInviteRoleScopeContext,\n): boolean {\n  if (isHiddenRole(role)) {\n    return false;\n  }\n\n  const tenantId = context.tenantId?.trim();\n  const applicationId = context.applicationId?.trim();\n  if (!tenantId || !applicationId) {\n    return false;\n  }\n\n  const scope = readInviteRoleScopeInfo(role);\n  return scope.tenantId === tenantId && scope.applicationId === applicationId;\n}\n\n//#endregion\n","//#region ----- Types -----\n\n/** One TM invite repeater row: application + multi-select roles for that app. */\nexport interface AXMInviteApplicationRoleAssignment {\n  applicationId: string;\n  roleIds: string[];\n}\n\n//#endregion\n\n//#region ----- Helpers -----\n\nfunction readId(value: unknown): string {\n  if (typeof value === 'string') {\n    return value.trim();\n  }\n  if (value && typeof value === 'object') {\n    const id = (value as { id?: unknown }).id;\n    if (typeof id === 'string') {\n      return id.trim();\n    }\n    if (typeof id === 'number') {\n      return String(id);\n    }\n    return '';\n  }\n  return value != null ? String(value).trim() : '';\n}\n\nfunction readRoleIds(value: unknown): string[] {\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return [...new Set(value.map((id) => readId(id)).filter(Boolean))];\n}\n\n/**\n * Submit-time merge for the TM invite repeater.\n * Duplicate applications (same app on two rows, different role picks) become one assignment\n * with the union of role ids. Empty application rows are dropped. Do not unique the dropdown\n * instead — the UI may repeat an application.\n */\nexport function normalizeInviteApplicationRoleAssignments(\n  rows: unknown,\n): AXMInviteApplicationRoleAssignment[] {\n  if (!Array.isArray(rows)) {\n    return [];\n  }\n\n  const byApp = new Map<string, Set<string>>();\n  for (const row of rows) {\n    if (!row || typeof row !== 'object') {\n      continue;\n    }\n    const record = row as Record<string, unknown>;\n    const applicationId = readId(record['applicationId']);\n    if (!applicationId) {\n      continue;\n    }\n    const bucket = byApp.get(applicationId) ?? new Set<string>();\n    for (const roleId of readRoleIds(record['roleIds'])) {\n      bucket.add(roleId);\n    }\n    byApp.set(applicationId, bucket);\n  }\n\n  return [...byApp.entries()].map(([applicationId, roleIds]) => ({\n    applicationId,\n    roleIds: [...roleIds],\n  }));\n}\n\nexport function flattenInviteApplicationRoleAssignments(\n  assignments: readonly AXMInviteApplicationRoleAssignment[],\n): { applicationIds: string[]; roleIds: string[] } {\n  const applicationIds = assignments.map((row) => row.applicationId);\n  const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];\n  return { applicationIds, roleIds };\n}\n\n//#endregion\n","//#region ----- Types -----\n\n/** One TM create-in-tenant repeater row: application + multi-select roles for that app. */\nexport interface AXMCreateApplicationRoleAssignment {\n  applicationId: string;\n  roleIds: string[];\n}\n\n//#endregion\n\n//#region ----- Helpers -----\n\nfunction readId(value: unknown): string {\n  if (typeof value === 'string') {\n    return value.trim();\n  }\n  if (value && typeof value === 'object') {\n    const id = (value as { id?: unknown }).id;\n    if (typeof id === 'string') {\n      return id.trim();\n    }\n    if (typeof id === 'number') {\n      return String(id);\n    }\n    return '';\n  }\n  return value != null ? String(value).trim() : '';\n}\n\nfunction readRoleIds(value: unknown): string[] {\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return [...new Set(value.map((id) => readId(id)).filter(Boolean))];\n}\n\n/**\n * Submit-time merge for the TM create-in-tenant repeater.\n * Duplicate applications (same app on two rows, different role picks) become one assignment\n * with the union of role ids. Empty application rows are dropped.\n */\nexport function normalizeCreateApplicationRoleAssignments(\n  rows: unknown,\n): AXMCreateApplicationRoleAssignment[] {\n  if (!Array.isArray(rows)) {\n    return [];\n  }\n\n  const byApp = new Map<string, Set<string>>();\n  for (const row of rows) {\n    if (!row || typeof row !== 'object') {\n      continue;\n    }\n    const record = row as Record<string, unknown>;\n    const applicationId = readId(record['applicationId']);\n    if (!applicationId) {\n      continue;\n    }\n    const bucket = byApp.get(applicationId) ?? new Set<string>();\n    for (const roleId of readRoleIds(record['roleIds'])) {\n      bucket.add(roleId);\n    }\n    byApp.set(applicationId, bucket);\n  }\n\n  return [...byApp.entries()].map(([applicationId, roleIds]) => ({\n    applicationId,\n    roleIds: [...roleIds],\n  }));\n}\n\nexport function flattenCreateApplicationRoleAssignments(\n  assignments: readonly AXMCreateApplicationRoleAssignment[],\n): { applicationIds: string[]; roleIds: string[] } {\n  const applicationIds = assignments.map((row) => row.applicationId);\n  const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];\n  return { applicationIds, roleIds };\n}\n\n//#endregion\n","//#region ---- Security management server command keys ----\n\nexport const AXMSecurityManagementServerCommands = {\n  SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',\n  CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',\n  ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',\n  GetOwnPasswordStatus: 'SecurityManagement:Server:GetOwnPasswordStatus',\n  InviteUser: 'SecurityManagement:Server:InviteUser',\n  /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */\n  ListTenantEntitledApplications: 'SecurityManagement:Server:ListTenantEntitledApplications',\n  /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */\n  ListInviteAssignableRoles: 'SecurityManagement:Server:ListInviteAssignableRoles',\n  ResendInvitation: 'SecurityManagement:Server:ResendInvitation',\n  CancelInvitation: 'SecurityManagement:Server:CancelInvitation',\n  AcceptInvitation: 'SecurityManagement:Server:AcceptInvitation',\n  ListMyPendingInvitations: 'SecurityManagement:Server:ListMyPendingInvitations',\n  DeclineInvitation: 'SecurityManagement:Server:DeclineInvitation',\n  AcceptMyInvitation: 'SecurityManagement:Server:AcceptMyInvitation',\n  LookupTenantByUniqueName: 'SecurityManagement:Server:LookupTenantByUniqueName',\n  RequestTenantMembership: 'SecurityManagement:Server:RequestTenantMembership',\n  ListMyJoinRequests: 'SecurityManagement:Server:ListMyJoinRequests',\n  CancelMyJoinRequest: 'SecurityManagement:Server:CancelMyJoinRequest',\n  ApproveJoinRequest: 'SecurityManagement:Server:ApproveJoinRequest',\n  RejectJoinRequest: 'SecurityManagement:Server:RejectJoinRequest',\n  CreateUserInTenant: 'SecurityManagement:Server:CreateUserInTenant',\n  StartTwoFactorEnrollment: 'SecurityManagement:Server:StartTwoFactorEnrollment',\n  ConfirmTwoFactorEnrollment: 'SecurityManagement:Server:ConfirmTwoFactorEnrollment',\n  DisableTwoFactor: 'SecurityManagement:Server:DisableTwoFactor',\n  GenerateTwoFactorRecoveryCodes: 'SecurityManagement:Server:GenerateTwoFactorRecoveryCodes',\n  GetTwoFactorStatus: 'SecurityManagement:Server:GetTwoFactorStatus',\n  AdminResetTwoFactor: 'SecurityManagement:Server:AdminResetTwoFactor',\n  /** Public — completes login after password challenge (TOTP or recovery). */\n  VerifyTwoFactorLogin: 'SecurityManagement:Server:VerifyTwoFactorLogin',\n} as const;\n\n/** Stable codes for self-service password change (client maps to i18n). */\nexport const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {\n  NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',\n  IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',\n  SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',\n  InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',\n} as const;\n\n/** Client/UI action key (confirm dialog → server send). */\nexport const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';\n\n/** Client/UI action key (confirm dialog → server admin reset 2FA). */\nexport const AXM_USER_RESET_TWO_FACTOR_COMMAND = 'SecurityManagement:User:ResetTwoFactor';\n\n/** Client/UI action keys for invite / create-in-tenant flows. */\nexport const AXM_USER_INVITE_COMMAND = 'SecurityManagement:User:Invite';\nexport const AXM_USER_RESEND_INVITATION_COMMAND = 'SecurityManagement:User:ResendInvitation';\nexport const AXM_USER_CANCEL_INVITATION_COMMAND = 'SecurityManagement:User:CancelInvitation';\nexport const AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:ApproveJoinRequest';\nexport const AXM_USER_REJECT_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:RejectJoinRequest';\nexport const AXM_USER_CREATE_IN_TENANT_COMMAND = 'SecurityManagement:User:CreateInTenant';\n\nexport interface AXMSendPasswordResetEmailInput {\n  /** Admin path: target user id. */\n  userId?: string;\n  /** Forgot path: email or username. */\n  login?: string;\n  /** Optional absolute web origin for reset link (defaults to env / localhost). */\n  webOrigin?: string;\n}\n\nexport interface AXMCompletePasswordResetInput {\n  token: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordInput {\n  /** Required when the account already has a password; omit/empty when setting the first password. */\n  currentPassword?: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordResult {\n  passwordChangedAt: string;\n}\n\nexport interface AXMGetOwnPasswordStatusResult {\n  /** True when the signed-in user has a non-empty stored password credential. */\n  hasPassword: boolean;\n}\n\nexport interface AXMInviteUserInput {\n  email: string;\n  displayName?: string;\n  applicationIds?: string[];\n  /**\n   * Role ids to assign on invite (scoped UserRole grant).\n   * Application invite → app-scoped grant; tenant invite without per-app rows → tenant-wide grant.\n   */\n  roleIds?: string[];\n  /**\n   * TM Tenant Users repeater: roles per selected application.\n   * When present, server upserts a UserRole grant per application (not one tenant-wide grant).\n   */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * True when invite is from Tenant Users (tenant-membership) with multi-app UI.\n   * Server SoT with session edition feature — not Application.code === 'TM'.\n   */\n  tenantMembershipInvite?: boolean;\n  /** Client sets true after warning that the identity already exists. */\n  confirmExisting?: boolean;\n  webOrigin?: string;\n}\n\n/** One selectable application for TM invite (tenant subscription entitlement). */\nexport interface AXMTenantEntitledApplicationItem {\n  id: string;\n  /** Raw MLS / string title — client resolves for display. */\n  title: unknown;\n}\n\nexport interface AXMListTenantEntitledApplicationsResult {\n  items: AXMTenantEntitledApplicationItem[];\n}\n\n/** One Role overlay selectable on a TM invite repeater row. */\nexport interface AXMInviteAssignableRoleItem {\n  id: string;\n  title: unknown;\n  name?: string;\n  applicationId: string;\n}\n\nexport interface AXMListInviteAssignableRolesInput {\n  /** When set, only overlays for this application (current tenant). */\n  applicationId?: string;\n}\n\nexport interface AXMListInviteAssignableRolesResult {\n  items: AXMInviteAssignableRoleItem[];\n}\n\nexport interface AXMInviteUserResult {\n  userId: string;\n  tenantUserId: string;\n  userAlreadyExists: boolean;\n  sent: boolean;\n}\n\nexport interface AXMResendInvitationInput {\n  tenantUserId?: string;\n  userId?: string;\n  webOrigin?: string;\n}\n\nexport interface AXMCancelInvitationInput {\n  tenantUserId?: string;\n  userId?: string;\n}\n\n/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */\nexport const AXM_ACCEPT_INVITATION_ERROR_CODES = {\n  Invalid: 'ACCEPT_INVITATION_INVALID',\n  Expired: 'ACCEPT_INVITATION_EXPIRED',\n  PasswordRequired: 'ACCEPT_INVITATION_PASSWORD_REQUIRED',\n} as const;\n\nexport type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';\n\nexport interface AXMAcceptInvitationInput {\n  token: string;\n  newPassword?: string;\n  /** Check the token only. Does not set a password or consume the link. */\n  preview?: boolean;\n}\n\nexport interface AXMAcceptInvitationPreviewResult {\n  usable: boolean;\n  reason: AXMAcceptInvitationReason;\n}\n\nexport interface AXMPendingInvitationItem {\n  tenantUserId: string;\n  tenantId: string;\n  tenantTitle?: string;\n  /** Tenant branding logo URL / storage id when available. */\n  tenantLogo?: string;\n  invitedByUserId?: string;\n  expiresAt?: string;\n  sentAt?: string;\n  applicationIds?: string[];\n}\n\nexport interface AXMListMyPendingInvitationsResult {\n  items: AXMPendingInvitationItem[];\n}\n\nexport interface AXMAcceptMyInvitationInput {\n  tenantUserId: string;\n  newPassword?: string;\n}\n\nexport interface AXMDeclineInvitationInput {\n  tenantUserId: string;\n}\n\n/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */\nexport const AXM_JOIN_REQUEST_ERROR_CODES = {\n  NotSignedIn: 'JOIN_REQUEST_NOT_SIGNED_IN',\n  InvalidInput: 'JOIN_REQUEST_INVALID_INPUT',\n  TenantNotFound: 'JOIN_REQUEST_TENANT_NOT_FOUND',\n  AlreadyMember: 'JOIN_REQUEST_ALREADY_MEMBER',\n  InvitePending: 'JOIN_REQUEST_INVITE_PENDING',\n  RequestNotFound: 'JOIN_REQUEST_NOT_FOUND',\n  NotPending: 'JOIN_REQUEST_NOT_PENDING',\n} as const;\n\nexport interface AXMLookupTenantByUniqueNameInput {\n  /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */\n  uniqueName: string;\n}\n\nexport interface AXMLookupTenantByUniqueNameItem {\n  id: string;\n  /** Stored unique name with original casing. */\n  name: string;\n}\n\nexport interface AXMLookupTenantByUniqueNameResult {\n  /** Present only when the name/title matches exactly one active tenant. */\n  item?: AXMLookupTenantByUniqueNameItem | null;\n}\n\nexport interface AXMRequestTenantMembershipInput {\n  /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */\n  uniqueName: string;\n}\n\nexport interface AXMRequestTenantMembershipResult {\n  tenantUserId: string;\n  tenantId: string;\n  tenantName: string;\n}\n\nexport interface AXMJoinRequestItem {\n  tenantUserId: string;\n  tenantId: string;\n  tenantName?: string;\n  tenantTitle?: string;\n  /** Tenant branding logo URL / storage id when available. */\n  tenantLogo?: string;\n  sentAt?: string;\n  expiresAt?: string;\n}\n\nexport interface AXMListMyJoinRequestsResult {\n  items: AXMJoinRequestItem[];\n}\n\nexport interface AXMCancelMyJoinRequestInput {\n  tenantUserId: string;\n}\n\nexport interface AXMApproveJoinRequestInput {\n  tenantUserId?: string;\n  userId?: string;\n  /** Product / app-scoped approve: roles for the current session application. */\n  roleIds?: string[];\n  applicationIds?: string[];\n  /** TM Tenant Users: per-application role rows (same shape as invite). */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * When true, allow multi-application assignment (TM Tenant Users + edition feature).\n   * Mirrors invite `tenantMembershipInvite`.\n   */\n  tenantMembershipApprove?: boolean;\n}\n\nexport interface AXMRejectJoinRequestInput {\n  tenantUserId?: string;\n  userId?: string;\n}\n\nexport interface AXMCreateUserInTenantInput {\n  email?: string;\n  username?: string;\n  displayName?: string;\n  password?: string;\n  applicationIds?: string[];\n  /** Product Users create: roles for the current session application. */\n  roleIds?: string[];\n  /** TM Tenant Users create: per-application role rows (merged client-side before submit). */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * When true, allow multi-application assignment (TM Tenant Users + edition feature).\n   * Parallel to invite `tenantMembershipInvite`; Create path only.\n   */\n  tenantMembershipCreate?: boolean;\n}\n\nexport interface AXMCreateUserInTenantResult {\n  userId: string;\n  tenantUserId: string;\n}\n\n/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */\nexport const AXM_TWO_FACTOR_ERROR_CODES = {\n  NotSignedIn: 'TWO_FACTOR_NOT_SIGNED_IN',\n  InvalidInput: 'TWO_FACTOR_INVALID_INPUT',\n  IncorrectPassword: 'TWO_FACTOR_INCORRECT_PASSWORD',\n  IncorrectCode: 'TWO_FACTOR_INCORRECT_CODE',\n  AlreadyEnabled: 'TWO_FACTOR_ALREADY_ENABLED',\n  NotEnabled: 'TWO_FACTOR_NOT_ENABLED',\n  EnrollmentExpired: 'TWO_FACTOR_ENROLLMENT_EXPIRED',\n  ChallengeExpired: 'TWO_FACTOR_CHALLENGE_EXPIRED',\n  RateLimited: 'TWO_FACTOR_RATE_LIMITED',\n  InvalidConfiguration: 'TWO_FACTOR_INVALID_CONFIGURATION',\n  ProofRequired: 'TWO_FACTOR_PROOF_REQUIRED',\n  UserNotFound: 'TWO_FACTOR_USER_NOT_FOUND',\n  Forbidden: 'TWO_FACTOR_FORBIDDEN',\n} as const;\n\nexport interface AXMStartTwoFactorEnrollmentInput {\n  password: string;\n}\n\nexport interface AXMStartTwoFactorEnrollmentResult {\n  enrollmentId: string;\n  otpauthUri: string;\n  /** Base32 secret for manual entry (client renders QR via ax-qrcode). */\n  secretBase32: string;\n  expiresAt: string;\n}\n\nexport interface AXMConfirmTwoFactorEnrollmentInput {\n  enrollmentId: string;\n  code: string;\n}\n\nexport interface AXMConfirmTwoFactorEnrollmentResult {\n  enabled: true;\n  verifiedAt: string;\n}\n\nexport interface AXMDisableTwoFactorInput {\n  /** At least one of password or totpCode is required. */\n  password?: string;\n  totpCode?: string;\n}\n\nexport interface AXMDisableTwoFactorResult {\n  enabled: false;\n}\n\nexport interface AXMGenerateTwoFactorRecoveryCodesInput {\n  /** At least one of password or totpCode is required. */\n  password?: string;\n  totpCode?: string;\n}\n\nexport interface AXMGenerateTwoFactorRecoveryCodesResult {\n  /** Plaintext codes shown once only (display format ABCD-EFGH). */\n  codes: string[];\n}\n\nexport interface AXMGetTwoFactorStatusResult {\n  enabled: boolean;\n  enrolled: boolean;\n  verifiedAt?: string | null;\n  hasRecoveryCodes: boolean;\n  unusedRecoveryCodeCount: number;\n}\n\nexport interface AXMAdminResetTwoFactorInput {\n  userId: string;\n  /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */\n  dryRun?: boolean;\n}\n\nexport interface AXMAdminResetTwoFactorResult {\n  reset: boolean;\n}\n\nexport interface AXMVerifyTwoFactorLoginInput {\n  challengeId: string;\n  /** TOTP (6 digits) or recovery code. */\n  code: string;\n  rememberMe?: boolean;\n}\n\n//#endregion\n","//#region ----- User provisioning settings -----\n\n/** Platform settings owned by Security Management. */\nexport const AXMSecurityManagementSettings = {\n  /**\n   * Which Users-list add actions are available.\n   * `create` and `invite` are primary. `both` shows them as secondary actions.\n   */\n  UserProvisioningMode: 'SecurityManagement:Setting:User.ProvisioningMode',\n} as const;\n\nexport const AXMUserProvisioningMode = {\n  Create: 'create',\n  Invite: 'invite',\n  Both: 'both',\n} as const;\n\nexport type AXMUserProvisioningMode = (typeof AXMUserProvisioningMode)[keyof typeof AXMUserProvisioningMode];\n\n/** Used when the platform setting has not been saved yet. */\nexport const AXM_USER_PROVISIONING_MODE_DEFAULT = AXMUserProvisioningMode.Both;\n\n//#endregion\n","//#region ----- Device session admin scope (operation-owned) -----\r\r\n\r\r\n/**\r\r\n * Explicit DeviceSessions admin operation scope (ADR-TEN-001 D-07).\r\r\n * Selected by the calling surface (menu/view), not by Application.code / TM ids.\r\r\n */\r\r\nexport type AXPDeviceSessionAdminScope = 'tenant' | 'application';\r\r\n\r\r\n/** Query `params` key and HTTP header value for admin scope. */\r\r\nexport const AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM = 'deviceSessionAdminScope';\r\r\n\r\r\n/** HTTP header (lowercase) carrying the same scope for getOne/update/delete. */\r\r\nexport const AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER = 'x-axp-device-session-admin-scope';\r\r\n\r\r\n/** Entity list view name for TM → Tenant Sessions. */\r\r\nexport const AXP_DEVICE_SESSION_TENANT_SESSIONS_VIEW = 'tenant-sessions';\r\r\n\r\r\nexport function normalizeDeviceSessionAdminScope(\r\r\n  value: unknown,\r\r\n): AXPDeviceSessionAdminScope {\r\r\n  return value === 'tenant' ? 'tenant' : 'application';\r\r\n}\r\r\n\r\r\n//#endregion\r\r\n\r","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport enum AXMSessionStatusTypes {\n  revoked = 'revoked',\n  expired = 'expired',\n  active = 'active',\n}\n\nexport interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<string> {\n  clientName: string;\n  ipAddress: string;\n  userAgent: string;\n  authorizationId: string;\n  status: string;\n  userId: string;\n  user: {\n    id: string;\n    name: string;\n  };\n  applicationId: string;\n  application: {\n    id: string;\n    name: string;\n  };\n  tenantId: string;\n  tenant: {\n    id: string;\n    name: string;\n  };\n  /** True only for the caller's current login (`sid`); stamped on read. */\n  isActiveSession: boolean;\n  /** Login/session id matching access-token `sid`. */\n  sessionId?: string;\n  /** Stable per-device fingerprint (one active row per user+device). */\n  deviceKey?: string;\n\n  deviceName: string;\n  operatingSystem: string;\n  browser: string;\n  location: string;\n  lastLoginDate: Date;\n  /** When the session was revoked / logged out (null while still active). */\n  loggedOutAt?: Date | string | null;\n}\n","//#region ---- Identity provider entity model ----\n\n/**\n * Login protocol for {@link AXMIdentityProviderEntityModel}.\n * `directory` covers LDAP, Active Directory, and similar bind-based directories.\n */\nexport const AXM_IDENTITY_PROVIDER_PROTOCOL = {\n  Oidc: 'oidc',\n  Directory: 'directory',\n} as const;\n\nexport type AXMIdentityProviderProtocol =\n  (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];\n\n/**\n * Platform login IdP row (SecurityManagement.IdentityProvider).\n * Active/inactive uses the disable plugin field `isDisabled`.\n * Broker routing uses `key` as OAuth `acr_values` (OIDC only).\n */\nexport interface AXMIdentityProviderEntityModel {\n  id: string;\n  /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */\n  key: string;\n  title: string;\n  icon?: string | null;\n  /**\n   * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.\n   * Missing/legacy rows are treated as `oidc`.\n   */\n  protocol?: AXMIdentityProviderProtocol | null;\n  /** External IdP authorize URL (OIDC). */\n  authorizationUrl?: string | null;\n  /** External IdP token URL (OIDC). */\n  tokenUrl?: string | null;\n  /** Optional userinfo URL when id_token is absent (OIDC). */\n  userInfoUrl?: string | null;\n  /** Space-separated scopes requested from the external IdP (OIDC). */\n  scopes?: string | null;\n  /**\n   * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.\n   */\n  issuerUrl?: string | null;\n  /**\n   * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.\n   */\n  clientId?: string | null;\n  /**\n   * OAuth client secret (OIDC), or directory Bind Password when using search bind.\n   */\n  clientSecret?: string | null;\n  /** Directory server URL, e.g. `ldap://directory.example.com:389`. */\n  directoryUrl?: string | null;\n  /** Directory search base DN, e.g. `DC=example,DC=com`. */\n  directoryBaseDn?: string | null;\n  /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */\n  directoryUserDnTemplate?: string | null;\n  /** Optional search filter with `{{username}}` when using a service bind account. */\n  directoryUserSearchFilter?: string | null;\n  /** Start TLS when connecting to the directory server. */\n  directoryUseTls?: boolean | null;\n  /** Reject connections when the directory TLS certificate is untrusted. */\n  directoryTlsRejectUnauthorized?: boolean | null;\n  /** From disable plugin — `true` means not offered on login. */\n  isDisabled?: boolean;\n  priority: number;\n}\n\n//#endregion\n","import { AXPExpression } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {\n  name: string;\n  title: string;\n  description?: string;\n\n  rules: {\n    conditions: AXPExpression;\n    effects: AXMPolicyEffectRule[]; // list of effect rules\n  }[];\n\n  permission: string; // related permission\n  scope: AXMPolicyScope;\n\n  resource: {\n    type: string;\n    target: string;\n  };\n}\n\nexport type AXMPolicyScope = 'system' | 'tenant' | 'user';\n\nexport type AXMPolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';\n\nexport interface AXMPolicyEffectRule {\n  effect: AXMPolicyEffect;\n  target: string;\n}\n\n// const glocbal_readonly_policy = {\n//   name: 'readonly',\n//   resource: {\n//     reference: '*',\n//     type: 'entity',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ isHidden==true }}',\n//       effects: [\n//         {\n//           target: '*',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n\n// const readonly_file_by_role_policy = {\n//   name: 'readonly_file_by_role_policy',\n//   resource: {\n//     type: 'entity',\n//     reference: 'COntentManagement.Promotion',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ createdDate > 2025-01-01 && user.role!=\"admin\"}}',\n//       effects: [\n//         {\n//           target: 'imageId',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n","//#region ----- RolePermission types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped permission grants for a Role.\n * Role rows are identity-only; all capability keys live here.\n */\nexport interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.Role} id. */\n  roleId: string;\n  /** Capability keys granted for this scope. */\n  permissions: string[];\n}\n\n//#endregion\n","//#region ----- UserRole types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped role assignments for a User.\n * User rows are identity-only for roles; all role memberships live here.\n */\nexport interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.User} id. */\n  userId: string;\n  /** Role ids granted for this scope. */\n  roleIds: string[];\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n//#region ----- Types -----\n\nexport type AXMUserTwoFactorMethod = 'authenticator';\n\nexport interface AXMUserTwoFactorRecoveryCode {\n  hash: string;\n  /** Salt / hashing metadata (e.g. full pbkdf2 encoded string already embeds salt — optional extra). */\n  salt?: string;\n  usedAt?: string | null;\n}\n\n/**\n * Persisted authenticator enrollment for one user.\n * Secrets must never be returned on client/entity APIs.\n */\nexport interface AXMSecurityManagementUserTwoFactorEntityModel extends AXPEntityModel<string> {\n  userId: string;\n  method: AXMUserTwoFactorMethod;\n  encryptedSecret: string;\n  iv: string;\n  authTag: string;\n  keyVersion: number;\n  verifiedAt: string;\n  /** Last accepted TOTP time-step (floor(unix/period)); replay guard. */\n  lastAcceptedStep?: number | null;\n  recoveryCodes?: AXMUserTwoFactorRecoveryCode[];\n}\n\n//#endregion\n","import { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';\nimport { AXPEntity, createAllQueryView, entityMasterCrudActions } from '@acorex-platform/framework-shared/entity';\nimport { RootConfig } from '../../root-config';\n\n/**\n * Schema-only entity for authenticator enrollment.\n * No secret fields in UI; all mutations go through dedicated 2FA commands.\n */\nexport async function userTwoFactorFactory(): Promise<AXPEntity | null> {\n  const i18n = RootConfig.config.i18n;\n\n  const entityDef: AXPEntity = {\n    module: RootConfig.module.name,\n    name: RootConfig.entities.userTwoFactor.name,\n    title: RootConfig.entities.userTwoFactor.title,\n    icon: RootConfig.entities.userTwoFactor.icon,\n    searchTags: ['two-factor', '2fa', 'totp', 'authenticator', 'احراز هویت دو مرحله‌ای'],\n    formats: {\n      individual: RootConfig.entities.userTwoFactor.title,\n      plural: RootConfig.entities.userTwoFactor.titlePlural,\n      searchResult: {\n        title: '{{ userId }}',\n        description: RootConfig.module.title,\n      },\n    },\n    groups: [\n      {\n        id: 'basic-info',\n        title: `@general:terms.interface.basic-info`,\n      },\n    ],\n    properties: [\n      {\n        name: 'userId',\n        title: `@${i18n}:user-two-factor.fields.user-id.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'string',\n          interface: {\n            type: AXPWidgetsCatalog.text,\n            options: { readOnly: true },\n          },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'method',\n        title: `@${i18n}:user-two-factor.fields.method.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'string',\n          interface: {\n            type: AXPWidgetsCatalog.text,\n            options: { readOnly: true },\n          },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'verifiedAt',\n        title: `@${i18n}:user-two-factor.fields.verified-at.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'dateTime',\n          interface: {\n            type: AXPWidgetsCatalog.dateTime,\n            options: { readOnly: true },\n          },\n        },\n      },\n    ],\n    columns: [{ name: 'userId' }, { name: 'method' }, { name: 'verifiedAt' }],\n    interfaces: {\n      master: {\n        single: {\n          title: '{{ userId }}',\n          sections: [\n            {\n              id: 'basic-info',\n              layout: { positions: { lg: { colSpan: 12 } } },\n            },\n          ],\n          properties: [\n            { name: 'userId', layout: { positions: { lg: { colSpan: 6 } } } },\n            { name: 'method', layout: { positions: { lg: { colSpan: 6 } } } },\n            { name: 'verifiedAt', layout: { positions: { lg: { colSpan: 6 } } } },\n          ],\n          actions: [],\n        },\n        list: {\n          actions: [...entityMasterCrudActions({ create: false, delete: false, edit: false })],\n          views: [createAllQueryView({ sorts: [{ name: 'verifiedAt', dir: 'desc' }] })],\n        },\n      },\n    },\n  };\n\n  return entityDef;\n}\n","//#region ----- Imports -----\n\nimport { AXPSystemActionType } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityCommandScope, type AXPEntityAction } from '@acorex-platform/framework-shared/entity';\nimport { AXM_USER_CREATE_IN_TENANT_COMMAND, AXM_USER_INVITE_COMMAND } from '../../server-commands';\nimport {\n  AXM_USER_PROVISIONING_MODE_DEFAULT,\n  AXMSecurityManagementSettings,\n  AXMUserProvisioningMode,\n} from '../../settings.keys';\n\n//#endregion\n\n//#region ----- List actions -----\n\nconst PROVISIONING_MODE_KEY = AXMSecurityManagementSettings.UserProvisioningMode;\n\n/**\n * Hides the action unless the platform provisioning setting matches `mode`.\n * A missing value uses {@link AXM_USER_PROVISIONING_MODE_DEFAULT}.\n * Select widgets may persist either the scalar or `{ value }`.\n */\nfunction hiddenUnlessProvisioningMode(mode: AXMUserProvisioningMode): string {\n  return `{{ (((await settings.get('${PROVISIONING_MODE_KEY}'))?.value ?? (await settings.get('${PROVISIONING_MODE_KEY}'))) || '${AXM_USER_PROVISIONING_MODE_DEFAULT}') !== '${mode}' }}`;\n}\n\nconst USER_ADD_COMMANDS = new Set<string>([AXM_USER_INVITE_COMMAND, AXM_USER_CREATE_IN_TENANT_COMMAND]);\n\nfunction commandNameOf(action: AXPEntityAction): string | undefined {\n  return typeof action.command === 'string' ? action.command : action.command?.name;\n}\n\n/** Type-level Invite / Create actions, including the legacy Create dropdown. */\nexport function isUserProvisioningListAction(action: AXPEntityAction): boolean {\n  if (action.scope !== AXPEntityCommandScope.TypeLevel) {\n    return false;\n  }\n  if (USER_ADD_COMMANDS.has(commandNameOf(action) ?? '')) {\n    return true;\n  }\n  return (action.items ?? []).some((child) => USER_ADD_COMMANDS.has(commandNameOf(child) ?? ''));\n}\n\nfunction provisioningAction(input: {\n  name: string;\n  title: string;\n  icon: string;\n  command: string;\n  priority: 'primary' | 'secondary';\n  mode: AXMUserProvisioningMode;\n  order: number;\n}): AXPEntityAction {\n  return {\n    name: input.name,\n    title: input.title,\n    icon: input.icon,\n    command: { name: input.command },\n    priority: input.priority,\n    type: AXPSystemActionType.Create,\n    scope: AXPEntityCommandScope.TypeLevel,\n    order: input.order,\n    hidden: hiddenUnlessProvisioningMode(input.mode),\n  };\n}\n\n/**\n * Users list add actions driven by the platform provisioning setting.\n * Create-only and invite-only stay primary. Both are secondary menu items.\n */\nexport function userProvisioningListActions(): AXPEntityAction[] {\n  return [\n    provisioningAction({\n      name: 'provision-create',\n      title: '@general:actions.create.title',\n      icon: 'fa-light fa-user-plus',\n      command: AXM_USER_CREATE_IN_TENANT_COMMAND,\n      priority: 'primary',\n      mode: AXMUserProvisioningMode.Create,\n      order: 1,\n    }),\n    provisioningAction({\n      name: 'provision-invite',\n      title: '@security-management:users.entities.user.actions.invite.title',\n      icon: 'fa-light fa-envelope',\n      command: AXM_USER_INVITE_COMMAND,\n      priority: 'primary',\n      mode: AXMUserProvisioningMode.Invite,\n      order: 1,\n    }),\n    provisioningAction({\n      name: 'provision-invite-secondary',\n      title: '@security-management:users.entities.user.actions.invite.title',\n      icon: 'fa-light fa-envelope',\n      command: AXM_USER_INVITE_COMMAND,\n      priority: 'secondary',\n      mode: AXMUserProvisioningMode.Both,\n      order: 1,\n    }),\n    provisioningAction({\n      name: 'provision-create-secondary',\n      title: '@security-management:users.entities.user.actions.create-in-tenant.title',\n      icon: 'fa-light fa-user-plus',\n      command: AXM_USER_CREATE_IN_TENANT_COMMAND,\n      priority: 'secondary',\n      mode: AXMUserProvisioningMode.Both,\n      order: 2,\n    }),\n  ];\n}\n\n//#endregion\n","//#region ---- Contracts barrel ----\n\nexport * from './lib/context.definitions';\nexport * from './features.keys';\nexport * from './menu.keys';\nexport * from './permission.keys';\nexport * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';\nexport * from './USER_ROLES_PAGE_COMPONENT_KEY';\n\nexport * from './root-config';\nexport * from './manifest';\n\nexport * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';\nexport * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';\nexport * from './user-access-state';\nexport * from './user-effective-state';\nexport * from './resolve-user-effective-state';\nexport * from './user-password-reset';\nexport * from './user-invitation';\nexport * from './invite-assignable-roles.util';\nexport * from './invite-application-role-rows.util';\nexport * from './create-application-role-rows.util';\nexport * from './server-commands';\nexport * from './settings.keys';\nexport * from './device-session-admin-scope';\n//#endregion\n\nexport * from './entities';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":["readId","readRoleIds"],"mappings":";;;AAEA;AAEO,MAAM,gCAAgC,GAA2B;AACtE,IAAA;AACE,QAAA,IAAI,EAAE,iBAAiB;AACvB,QAAA,KAAK,EAAE,mBAAmB;AAC1B,QAAA,WAAW,EACT,0GAA0G;AAC5G,QAAA,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;AACrB,KAAA;;AAGH;;ACfA;AAEA;;;AAGG;AACI,MAAM,gCAAgC,GAAG;AAC9C,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,aAAa,EAAE,0CAA0C;AACzD,IAAA,cAAc,EAAE,2CAA2C;AAC3D,IAAA,cAAc,EAAE,2CAA2C;;AAE3D,IAAA,uBAAuB,EAAE,oDAAoD;;AAE7E,IAAA,aAAa,EAAE,0CAA0C;;AAG3D;;AClBO,MAAM,6BAA6B,GAAG;AAC3C,IAAA,IAAI,EAAE,yBAAyB;AAC/B,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,cAAc,EAAE,wCAAwC;AACxD,IAAA,MAAM,EAAE,gCAAgC;AACxC,IAAA,iBAAiB,EAAE,2CAA2C;AAC9D,IAAA,SAAS,EAAE,mCAAmC;;;ACPhD;;;AAGG;AACI,MAAM,+BAA+B,GAAG;AAC7C,IAAA,MAAM,EAAE,kCAAkC;;AAE1C,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,cAAc,EAAE,0CAA0C;AAC1D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,SAAS,EAAE,qCAAqC;AAChD,IAAA,aAAa,EAAE,yCAAyC;AACxD,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,WAAW,EAAE,uCAAuC;AACpD,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,QAAQ,EAAE,oCAAoC;AAC9C,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;;AAG1E;;;AAGG;AACI,MAAM,mCAAmC,GAAG;AACjD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,aAAa,EAAE;QACb,UAAU,EAAE,+BAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,+BAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,+BAA+B,CAAC,cAAc;AAC1D,KAAA;AACD,IAAA,MAAM,EAAE;QACN,UAAU,EAAE,+BAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;AACzD,KAAA;;;ACzDH;AACO,MAAM,mCAAmC,GAAG;;ACD5C,MAAM,6BAA6B,GAAG;;ACA7C,MAAM,MAAM,GAAG;AACb,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,aAAa,EAAE,SAAS;CACzB;AACM,MAAM,UAAU,GAAG;IACxB,MAAM;AACN,IAAA,MAAM,EAAE;AACN,QAAA,KAAK,EAAE,qBAAqB;AAC5B,QAAA,IAAI,EAAE,oBAAoB;AAC1B,QAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,aAAA,CAAe;AACrC,QAAA,IAAI,EAAE,2BAA2B;AAClC,KAAA;AACD,IAAA,QAAQ,EAAE;AACR,QAAA,MAAM,EAAE;AACN,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AACxD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iCAAA,CAAmC;AAC/D,YAAA,IAAI,EAAE,oBAAoB;AAC3B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,mBAAmB;AAC1B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AACxE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iDAAA,CAAmD;AAC/E,YAAA,IAAI,EAAE,iBAAiB;AACxB,SAAA;AACD,QAAA,QAAQ,EAAE;AACR,YAAA,IAAI,EAAE,UAAU;AAChB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oCAAA,CAAsC;AAC5D,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qCAAA,CAAuC;AACnE,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,SAAS;AACf,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,kBAAkB;AACzB,SAAA;AACD,QAAA,gBAAgB,EAAE;AAChB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oDAAA,CAAsD;AAC5E,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qDAAA,CAAuD;AACnF,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,aAAa,EAAE;AACb,YAAA,IAAI,EAAE,eAAe;AACrB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+CAAA,CAAiD;AACvE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AAC9E,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACF,KAAA;AACD,IAAA,OAAO,EAAE;AACP,QAAA,OAAO,EAAE;AACP,YAAA,4BAA4B,EAAE,yDAAyD;AACvF,YAAA,kCAAkC,EAChC,+DAA+D;AACjE,YAAA,qBAAqB,EAAE,kDAAkD;AACzE,YAAA,2BAA2B,EAAE,wDAAwD;AACrF,YAAA,4BAA4B,EAAE,yDAAyD;AACxF,SAAA;AACF,KAAA;;;AC7EH;AAKA;AAEA;AAEA;;;AAGG;AACI,MAAM,0BAA0B,GAAsB;AAC3D,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,OAAO,EAAE,OAAO;AAChB,IAAA,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AAC9B,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,IAAI,EAAE,UAAU;AAChB,IAAA,MAAM,EAAE,UAAU;AAClB,IAAA,QAAQ,EAAE,IAAI;;;AAKhB;;AC1BA;AACO,MAAM,oCAAoC,GAAG;;ACDpD;AACO,MAAM,uCAAuC,GAAG;;ACDvD;AAEA;;;AAGG;IACS;AAAZ,CAAA,UAAY,kBAAkB,EAAA;AAC5B,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,GAAA,EAAA,CAAA,CAAA;AAM9B;;ACZA;AAEA;;AAEG;IACS;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACjB,IAAA,qBAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,eAAA,CAAA,GAAA,iBAAiC;AACjC,IAAA,qBAAA,CAAA,mBAAA,CAAA,GAAA,oBAAwC;AAC1C,CAAC,EARW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;AAUjC;;ACZA;AAEA,MAAM,qBAAqB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,OAAO,EAAE,SAAS;AAClB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,SAAS,EAAE,WAAW;CACd;AAEV;;;AAGG;AACG,SAAU,4BAA4B,CAAC,KAG5C,EAAA;AACC,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;IACpC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAW;AAExE,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE;QAC/C,OAAO,qBAAqB,CAAC,OAAO;IACtC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE;QACjD,OAAO,qBAAqB,CAAC,SAAS;IACxC;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,iBAAiB;IAChD;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,aAAa;IAC5C;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE;QAC9C,OAAO,qBAAqB,CAAC,MAAM;IACrC;IACA,OAAO,qBAAqB,CAAC,MAAM;AACrC;AAEA;;AChDA;AAYA;;ACZA;AA4BO,MAAM,gCAAgC,GAAG;AAC9C,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,WAAW,EAAE,cAAc;AAC3B,IAAA,aAAa,EAAE,gBAAgB;;AAWjC;;;AAGG;AACI,MAAM,qDAAqD,GAChE;AAEF;AACO,MAAM,yCAAyC,GAAG;AAEzD;;ACpDA;AAgBA;AAEA;AAEA,SAAS,eAAe,CAAC,KAAc,EAAA;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS;AAC7E;AAEM,SAAU,uBAAuB,CACrC,IAAgD,EAAA;IAEhD,MAAM,KAAK,GACT,IAAI,EAAE,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK;UACxC,IAAI,CAAC;UACN,SAAS;IACf,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC;QAC9C,aAAa,EAAE,eAAe,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;KACzD;AACH;AAEA,SAAS,YAAY,CAAC,IAAgD,EAAA;IACpE,MAAM,KAAK,GACT,IAAI,EAAE,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK;UACxC,IAAI,CAAC;UACN,SAAS;AACf,IAAA,OAAO,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI;AACrC;AAEA;;;;;;AAMG;SACa,yBAAyB,CACvC,IAAqE,EACrE,IAAiC,EACjC,OAAkC,EAAA;AAElC,IAAA,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE;AACtB,QAAA,OAAO,KAAK;IACd;IAEA,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;IACzC,IAAI,CAAC,QAAQ,EAAE;AACb,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE;AAClD,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,IAAI,IAAI,KAAK,QAAQ,EAAE;AACrB,QAAA,OAAO,CAAC,KAAK,CAAC,aAAa;IAC7B;IAEA,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE;IACnD,IAAI,CAAC,aAAa,EAAE;AAClB,QAAA,OAAO,KAAK;IACd;AACA,IAAA,OAAO,KAAK,CAAC,aAAa,KAAK,aAAa;AAC9C;AAEA;;;;AAIG;AACG,SAAU,sCAAsC,CACpD,IAAqE,EACrE,OAAkC,EAAA;AAElC,IAAA,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE;AACtB,QAAA,OAAO,KAAK;IACd;IAEA,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;IACzC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE;AACnD,IAAA,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE;AAC/B,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa;AAC7E;AAEA;;ACzGA;AAQA;AAEA;AAEA,SAASA,QAAM,CAAC,KAAc,EAAA;AAC5B,IAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,QAAA,OAAO,KAAK,CAAC,IAAI,EAAE;IACrB;AACA,IAAA,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACtC,QAAA,MAAM,EAAE,GAAI,KAA0B,CAAC,EAAE;AACzC,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,EAAE,CAAC,IAAI,EAAE;QAClB;AACA,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB;AACA,QAAA,OAAO,EAAE;IACX;AACA,IAAA,OAAO,KAAK,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE;AAClD;AAEA,SAASC,aAAW,CAAC,KAAc,EAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AACzB,QAAA,OAAO,EAAE;IACX;IACA,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAKD,QAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE;AAEA;;;;;AAKG;AACG,SAAU,yCAAyC,CACvD,IAAa,EAAA;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AACxB,QAAA,OAAO,EAAE;IACX;AAEA,IAAA,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB;AAC5C,IAAA,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;YACnC;QACF;QACA,MAAM,MAAM,GAAG,GAA8B;QAC7C,MAAM,aAAa,GAAGA,QAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE;YAClB;QACF;AACA,QAAA,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,GAAG,EAAU;QAC5D,KAAK,MAAM,MAAM,IAAIC,aAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;AACnD,YAAA,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB;AACA,QAAA,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;IAClC;AAEA,IAAA,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7D,aAAa;AACb,QAAA,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;AACtB,KAAA,CAAC,CAAC;AACL;AAEM,SAAU,uCAAuC,CACrD,WAA0D,EAAA;AAE1D,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACvE,IAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE;AACpC;AAEA;;AChFA;AAQA;AAEA;AAEA,SAAS,MAAM,CAAC,KAAc,EAAA;AAC5B,IAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,QAAA,OAAO,KAAK,CAAC,IAAI,EAAE;IACrB;AACA,IAAA,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACtC,QAAA,MAAM,EAAE,GAAI,KAA0B,CAAC,EAAE;AACzC,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,EAAE,CAAC,IAAI,EAAE;QAClB;AACA,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB;AACA,QAAA,OAAO,EAAE;IACX;AACA,IAAA,OAAO,KAAK,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE;AAClD;AAEA,SAAS,WAAW,CAAC,KAAc,EAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AACzB,QAAA,OAAO,EAAE;IACX;IACA,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE;AAEA;;;;AAIG;AACG,SAAU,yCAAyC,CACvD,IAAa,EAAA;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AACxB,QAAA,OAAO,EAAE;IACX;AAEA,IAAA,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB;AAC5C,IAAA,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;YACnC;QACF;QACA,MAAM,MAAM,GAAG,GAA8B;QAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE;YAClB;QACF;AACA,QAAA,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,GAAG,EAAU;QAC5D,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;AACnD,YAAA,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB;AACA,QAAA,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;IAClC;AAEA,IAAA,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7D,aAAa;AACb,QAAA,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;AACtB,KAAA,CAAC,CAAC;AACL;AAEM,SAAU,uCAAuC,CACrD,WAA0D,EAAA;AAE1D,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACvE,IAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE;AACpC;AAEA;;AC/EA;AAEO,MAAM,mCAAmC,GAAG;AACjD,IAAA,sBAAsB,EAAE,kDAAkD;AAC1E,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,oBAAoB,EAAE,gDAAgD;AACtE,IAAA,UAAU,EAAE,sCAAsC;;AAElD,IAAA,8BAA8B,EAAE,0DAA0D;;AAE1F,IAAA,yBAAyB,EAAE,qDAAqD;AAChF,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,uBAAuB,EAAE,mDAAmD;AAC5E,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,0BAA0B,EAAE,sDAAsD;AAClF,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,8BAA8B,EAAE,0DAA0D;AAC1F,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,mBAAmB,EAAE,+CAA+C;;AAEpE,IAAA,oBAAoB,EAAE,gDAAgD;;AAGxE;AACO,MAAM,mCAAmC,GAAG;AACjD,IAAA,WAAW,EAAE,mCAAmC;AAChD,IAAA,gBAAgB,EAAE,uCAAuC;AACzD,IAAA,aAAa,EAAE,qCAAqC;AACpD,IAAA,YAAY,EAAE,mCAAmC;;AAGnD;AACO,MAAM,oCAAoC,GAAG;AAEpD;AACO,MAAM,iCAAiC,GAAG;AAEjD;AACO,MAAM,uBAAuB,GAAG;AAChC,MAAM,kCAAkC,GAAG;AAC3C,MAAM,kCAAkC,GAAG;AAC3C,MAAM,qCAAqC,GAAG;AAC9C,MAAM,oCAAoC,GAAG;AAC7C,MAAM,iCAAiC,GAAG;AAqGjD;AACO,MAAM,iCAAiC,GAAG;AAC/C,IAAA,OAAO,EAAE,2BAA2B;AACpC,IAAA,OAAO,EAAE,2BAA2B;AACpC,IAAA,gBAAgB,EAAE,qCAAqC;;AA0CzD;AACO,MAAM,4BAA4B,GAAG;AAC1C,IAAA,WAAW,EAAE,4BAA4B;AACzC,IAAA,YAAY,EAAE,4BAA4B;AAC1C,IAAA,cAAc,EAAE,+BAA+B;AAC/C,IAAA,aAAa,EAAE,6BAA6B;AAC5C,IAAA,aAAa,EAAE,6BAA6B;AAC5C,IAAA,eAAe,EAAE,wBAAwB;AACzC,IAAA,UAAU,EAAE,0BAA0B;;AA2FxC;AACO,MAAM,0BAA0B,GAAG;AACxC,IAAA,WAAW,EAAE,0BAA0B;AACvC,IAAA,YAAY,EAAE,0BAA0B;AACxC,IAAA,iBAAiB,EAAE,+BAA+B;AAClD,IAAA,aAAa,EAAE,2BAA2B;AAC1C,IAAA,cAAc,EAAE,4BAA4B;AAC5C,IAAA,UAAU,EAAE,wBAAwB;AACpC,IAAA,iBAAiB,EAAE,+BAA+B;AAClD,IAAA,gBAAgB,EAAE,8BAA8B;AAChD,IAAA,WAAW,EAAE,yBAAyB;AACtC,IAAA,oBAAoB,EAAE,kCAAkC;AACxD,IAAA,aAAa,EAAE,2BAA2B;AAC1C,IAAA,YAAY,EAAE,2BAA2B;AACzC,IAAA,SAAS,EAAE,sBAAsB;;AAuEnC;;AClYA;AAEA;AACO,MAAM,6BAA6B,GAAG;AAC3C;;;AAGG;AACH,IAAA,oBAAoB,EAAE,kDAAkD;;AAGnE,MAAM,uBAAuB,GAAG;AACrC,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,IAAI,EAAE,MAAM;;AAKd;AACO,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;AAE1E;;ACtBA;AAgBA;AAEO,MAAM,oCAAoC,GAAG;AAIpD;AAEO,MAAM,qCAAqC,GAAG;AAIrD;AAEO,MAAM,uCAAuC,GAAG;AAIjD,SAAU,gCAAgC,CAE9C,KAAc,EAAA;IAId,OAAO,KAAK,KAAK,QAAQ,GAAG,QAAQ,GAAG,aAAa;AAEtD;AAIA;;IC7CY;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;;ACDjC;AAEA;;;AAGG;AACI,MAAM,8BAA8B,GAAG;AAC5C,IAAA,IAAI,EAAE,MAAM;AACZ,IAAA,SAAS,EAAE,WAAW;;AA2DxB;;ACrCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACtEA;AAeA;;ACfA;AAeA;;ACeA;;AC1BA;;;AAGG;AACI,eAAe,oBAAoB,GAAA;AACxC,IAAA,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI;AAEnC,IAAA,MAAM,SAAS,GAAc;AAC3B,QAAA,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC9B,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI;AAC5C,QAAA,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK;AAC9C,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI;QAC5C,UAAU,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,wBAAwB,CAAC;AACpF,QAAA,OAAO,EAAE;AACP,YAAA,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK;AACnD,YAAA,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW;AACrD,YAAA,YAAY,EAAE;AACZ,gBAAA,KAAK,EAAE,cAAc;AACrB,gBAAA,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AACrC,aAAA;AACF,SAAA;AACD,QAAA,MAAM,EAAE;AACN,YAAA;AACE,gBAAA,EAAE,EAAE,YAAY;AAChB,gBAAA,KAAK,EAAE,CAAA,mCAAA,CAAqC;AAC7C,aAAA;AACF,SAAA;AACD,QAAA,UAAU,EAAE;AACV,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,qCAAA,CAAuC;AACtD,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI;AAC5B,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,oCAAA,CAAsC;AACrD,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI;AAC5B,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,yCAAA,CAA2C;AAC1D,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,UAAU;AACpB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,QAAQ;AAChC,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACF,aAAA;AACF,SAAA;AACD,QAAA,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzE,QAAA,UAAU,EAAE;AACV,YAAA,MAAM,EAAE;AACN,gBAAA,MAAM,EAAE;AACN,oBAAA,KAAK,EAAE,cAAc;AACrB,oBAAA,QAAQ,EAAE;AACR,wBAAA;AACE,4BAAA,EAAE,EAAE,YAAY;AAChB,4BAAA,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE;AAC/C,yBAAA;AACF,qBAAA;AACD,oBAAA,UAAU,EAAE;AACV,wBAAA,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACjE,wBAAA,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACjE,wBAAA,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACtE,qBAAA;AACD,oBAAA,OAAO,EAAE,EAAE;AACZ,iBAAA;AACD,gBAAA,IAAI,EAAE;AACJ,oBAAA,OAAO,EAAE,CAAC,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpF,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9E,iBAAA;AACF,aAAA;AACF,SAAA;KACF;AAED,IAAA,OAAO,SAAS;AAClB;;AClGA;AAWA;AAEA;AAEA,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,oBAAoB;AAEhF;;;;AAIG;AACH,SAAS,4BAA4B,CAAC,IAA6B,EAAA;IACjE,OAAO,CAAA,0BAAA,EAA6B,qBAAqB,CAAA,mCAAA,EAAsC,qBAAqB,YAAY,kCAAkC,CAAA,QAAA,EAAW,IAAI,CAAA,IAAA,CAAM;AACzL;AAEA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;AAEvG,SAAS,aAAa,CAAC,MAAuB,EAAA;IAC5C,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,GAAG,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI;AACnF;AAEA;AACM,SAAU,4BAA4B,CAAC,MAAuB,EAAA;IAClE,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,SAAS,EAAE;AACpD,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE;AACtD,QAAA,OAAO,IAAI;IACb;IACA,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAChG;AAEA,SAAS,kBAAkB,CAAC,KAQ3B,EAAA;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;AAChB,QAAA,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,mBAAmB,CAAC,MAAM;QAChC,KAAK,EAAE,qBAAqB,CAAC,SAAS;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK;AAClB,QAAA,MAAM,EAAE,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC;KACjD;AACH;AAEA;;;AAGG;SACa,2BAA2B,GAAA;IACzC,OAAO;AACL,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,+BAA+B;AACtC,YAAA,IAAI,EAAE,uBAAuB;AAC7B,YAAA,OAAO,EAAE,iCAAiC;AAC1C,YAAA,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,uBAAuB,CAAC,MAAM;AACpC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;AACF,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,+DAA+D;AACtE,YAAA,IAAI,EAAE,sBAAsB;AAC5B,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,uBAAuB,CAAC,MAAM;AACpC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;AACF,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,4BAA4B;AAClC,YAAA,KAAK,EAAE,+DAA+D;AACtE,YAAA,IAAI,EAAE,sBAAsB;AAC5B,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,uBAAuB,CAAC,IAAI;AAClC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;AACF,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,4BAA4B;AAClC,YAAA,KAAK,EAAE,yEAAyE;AAChF,YAAA,IAAI,EAAE,uBAAuB;AAC7B,YAAA,OAAO,EAAE,iCAAiC;AAC1C,YAAA,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,uBAAuB,CAAC,IAAI;AAClC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;KACH;AACH;AAEA;;AC9GA;;ACAA;;AAEG;;"}
+{"version":3,"file":"acorex-platform-module-security-management-client-contracts.mjs","sources":["../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts","../../../../libs/modules/security-management/contracts/src/features.keys.ts","../../../../libs/modules/security-management/contracts/src/menu.keys.ts","../../../../libs/modules/security-management/contracts/src/permission.keys.ts","../../../../libs/modules/security-management/contracts/src/ROLE_PERMISSIONS_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/USER_ROLES_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/root-config.ts","../../../../libs/modules/security-management/contracts/src/manifest.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_ACCESS_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/user-access-state.ts","../../../../libs/modules/security-management/contracts/src/user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/user-password-reset.ts","../../../../libs/modules/security-management/contracts/src/user-invitation.ts","../../../../libs/modules/security-management/contracts/src/invite-assignable-roles.util.ts","../../../../libs/modules/security-management/contracts/src/invite-application-role-rows.util.ts","../../../../libs/modules/security-management/contracts/src/create-application-role-rows.util.ts","../../../../libs/modules/security-management/contracts/src/server-commands.ts","../../../../libs/modules/security-management/contracts/src/settings.keys.ts","../../../../libs/modules/security-management/contracts/src/device-session-admin-scope.ts","../../../../libs/modules/security-management/contracts/src/entities/device-sessions/device-sessions.types.ts","../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.types.ts","../../../../libs/modules/security-management/contracts/src/entities/policy/policy.types.ts","../../../../libs/modules/security-management/contracts/src/entities/role-permission/role-permission.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-role/user-role.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-two-factor/user-two-factor.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-two-factor/user-two-factor.entity.ts","../../../../libs/modules/security-management/contracts/src/entities/users/user-provisioning-list-actions.ts","../../../../libs/modules/security-management/contracts/src/index.ts","../../../../libs/modules/security-management/contracts/src/acorex-platform-module-security-management-client-contracts.ts"],"sourcesContent":["import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';\n\n//#region ---- User context definitions ----\n\nexport const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[] = [\n  {\n    name: 'userDisplayName',\n    title: 'User display name',\n    description:\n      'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',\n    order: 11,\n    capabilities: ['ai'],\n  },\n];\n\n//#endregion\n","//#region ----   Feature Keys   ----\n\n/**\n * Security Management Module Feature Keys.\n * Defines all available features for the Security Management module.\n */\nexport const AXPSecurityManagementFeatureKeys = {\n  ManageRoles: 'SecurityManagement:Feature:ManageRoles',\n  ManageUsers: 'SecurityManagement:Feature:ManageUsers',\n  MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',\n  ManageSessions: 'SecurityManagement:Feature:ManageSessions',\n  ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',\n  /** Platform Console only — Identity Provider management menu + CRUD. */\n  ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',\n  /** Self-service account deletion on the profile page. Off unless the edition enables it. */\n  DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',\n} as const;\n\n//#endregion\n\n","export const AXPSecurityManagementMenuKeys = {\n  Root: 'SecurityManagement:Menu',\n  Users: 'SecurityManagement:Menu:Users',\n  Roles: 'SecurityManagement:Menu:Roles',\n  DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',\n  Policy: 'SecurityManagement:Menu:Policy',\n  IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',\n  MyProfile: 'SecurityManagement:Menu:MyProfile',\n} as const;\n","/**\n * Administration capabilities used by this module.\n * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).\n */\nexport const AXPAdministrationPermissionKeys = {\n  Access: 'Administration:Permission:Access',\n  /** Create and maintain users, roles, role assignments, and related security-access reports. */\n  MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',\n  ManageSessions: 'Administration:Permission:ManageSessions',\n  MaintainPolicies: 'Administration:Permission:MaintainPolicies',\n  ViewIntegrations: 'Administration:Permission:ViewIntegrations',\n  MaintainConnections: 'Administration:Permission:MaintainConnections',\n  ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',\n  MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',\n  ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',\n  ViewRules: 'Administration:Permission:ViewRules',\n  MaintainRules: 'Administration:Permission:MaintainRules',\n  ManageRuleActions: 'Administration:Permission:ManageRuleActions',\n  MaintainAi: 'Administration:Permission:MaintainAi',\n  UseAiAssist: 'Administration:Permission:UseAiAssist',\n  MaintainDashboards: 'Administration:Permission:MaintainDashboards',\n  ViewJobs: 'Administration:Permission:ViewJobs',\n  ManageJobActions: 'Administration:Permission:ManageJobActions',\n  ViewObservability: 'Administration:Permission:ViewObservability',\n  MaintainObservability: 'Administration:Permission:MaintainObservability',\n} as const;\n\n/**\n * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.\n * Legacy nested shape kept so existing imports compile during migration.\n */\nexport const AXPSecurityManagementPermissionKeys = {\n  User: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  Role: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  DeviceSession: {\n    Management: AXPAdministrationPermissionKeys.ManageSessions,\n    View: AXPAdministrationPermissionKeys.ManageSessions,\n    Terminate: AXPAdministrationPermissionKeys.ManageSessions,\n  },\n  Policy: {\n    Management: AXPAdministrationPermissionKeys.MaintainPolicies,\n    View: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Edit: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Delete: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Create: AXPAdministrationPermissionKeys.MaintainPolicies,\n  },\n} as const;\n","/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */\nexport const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = 'role-permissions-page';\n","export const USER_ROLES_PAGE_COMPONENT_KEY = 'user-roles-page';\n","const config = {\n  i18n: 'security-management',\n  profileEntity: 'Profile',\n};\nexport const RootConfig = {\n  config,\n  module: {\n    route: 'security-management',\n    name: 'SecurityManagement',\n    title: `@${config.i18n}:module.title`,\n    icon: 'fa-light fa-shield-halved',\n  },\n  entities: {\n    policy: {\n      name: 'Policy',\n      title: `@${config.i18n}:policies.entities.policy.title`,\n      titlePlural: `@${config.i18n}:policies.entities.policy.plural`,\n      icon: 'fa-light fa-clipboard-list',\n    },\n    deviceSessions: {\n      name: 'DeviceSessions',\n      title: `@${config.i18n}:sessions.entities.session.title`,\n      titlePlural: `@${config.i18n}:sessions.entities.session.plural`,\n      icon: 'fa-light fa-laptop',\n    },\n    users: {\n      name: 'User',\n      title: `@${config.i18n}:users.entities.user.title`,\n      titlePlural: `@${config.i18n}:users.entities.user.plural`,\n      icon: 'fa-light fa-users',\n    },\n    roles: {\n      name: 'Role',\n      title: `@${config.i18n}:roles.entities.role.title`,\n      titlePlural: `@${config.i18n}:roles.entities.role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    rolePermission: {\n      name: 'RolePermission',\n      title: `@${config.i18n}:role-permissions.entities.role-permission.title`,\n      titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,\n      icon: 'fa-light fa-key',\n    },\n    userRole: {\n      name: 'UserRole',\n      title: `@${config.i18n}:user-roles.entities.user-role.title`,\n      titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    profile: {\n      name: 'Profile',\n      title: `@${config.i18n}:profile.entities.profile.title`,\n      titlePlural: `@${config.i18n}:profile.entities.profile.plural`,\n      icon: 'fa-light fa-user',\n    },\n    identityProvider: {\n      name: 'IdentityProvider',\n      title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,\n      titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,\n      icon: 'fa-light fa-id-badge',\n    },\n    userTwoFactor: {\n      name: 'UserTwoFactor',\n      title: `@${config.i18n}:user-two-factor.entities.user-two-factor.title`,\n      titlePlural: `@${config.i18n}:user-two-factor.entities.user-two-factor.plural`,\n      icon: 'fa-light fa-shield-keyhole',\n    },\n  },\n  queries: {\n    reports: {\n      getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',\n      getUserEffectivePermissionsHistory:\n        'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',\n      getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',\n      getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',\n      getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',\n    },\n  },\n} as const;\n","//#region ----   Imports   ----\n\nimport { AXPModuleManifest } from '@acorex-platform/framework-shared/core';\nimport { RootConfig } from './root-config';\n\n//#endregion\n\n//#region ----   Manifest Definition   ----\n\n/**\n * Security Management Module Manifest.\n * Defines module metadata, features, and provider references.\n */\nexport const SecurityManagementManifest: AXPModuleManifest = {\n  name: RootConfig.module.name,\n  version: '1.0.0',\n  title: RootConfig.module.title,\n  icon: RootConfig.module.icon,\n  i18n: RootConfig.config.i18n,\n  type: 'platform',\n  domain: 'platform',\n  required: true,\n\n  // Module dependencies (optional)\n};\n\n//#endregion\n\n","/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */\nexport const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';\n","/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */\nexport const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';\n","//#region ---- User access state ----\n\n/**\n * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).\n * Persisted as the enum string value (e.g. `allowed`).\n */\nexport enum AXMUserAccessState {\n  Allowed = 'allowed',\n  Blocked = 'blocked',\n  Expired = 'expired',\n}\n\n//#endregion\n","//#region ---- User effective (unified) state ----\n\n/**\n * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).\n */\nexport enum AXMUserEffectiveState {\n  Pending = 'pending',\n  Active = 'active',\n  Suspended = 'suspended',\n  Inactive = 'inactive',\n  Archived = 'archived',\n  SignInBlocked = 'sign-in-blocked',\n  CredentialExpired = 'credential-expired',\n}\n\n//#endregion\n","import { AXMUserAccessState } from './user-access-state';\nimport { AXMUserEffectiveState } from './user-effective-state';\n\n//#region ---- Resolve effective state ----\n\nconst AccountLifecycleState = {\n  Active: 'active',\n  Archived: 'archived',\n  Pending: 'pending',\n  Inactive: 'inactive',\n  Suspended: 'suspended',\n} as const;\n\n/**\n * Derives the unified operational state from account lifecycle and sign-in gate.\n * Used for persisted `effectiveState` on SecurityManagement.User.\n */\nexport function resolveAXMUserEffectiveState(input: {\n  accountState: string | undefined;\n  accessState: AXMUserAccessState | string | undefined;\n}): AXMUserEffectiveState {\n  const lifecycle = input.accountState;\n  const auth = (input.accessState ?? AXMUserAccessState.Allowed) as string;\n\n  if (lifecycle === AccountLifecycleState.Archived) {\n    return AXMUserEffectiveState.Archived;\n  }\n  if (lifecycle === AccountLifecycleState.Pending) {\n    return AXMUserEffectiveState.Pending;\n  }\n  if (lifecycle === AccountLifecycleState.Inactive) {\n    return AXMUserEffectiveState.Inactive;\n  }\n  if (lifecycle === AccountLifecycleState.Suspended) {\n    return AXMUserEffectiveState.Suspended;\n  }\n  if (auth === AXMUserAccessState.Expired) {\n    return AXMUserEffectiveState.CredentialExpired;\n  }\n  if (auth === AXMUserAccessState.Blocked) {\n    return AXMUserEffectiveState.SignInBlocked;\n  }\n  if (lifecycle === AccountLifecycleState.Active) {\n    return AXMUserEffectiveState.Active;\n  }\n  return AXMUserEffectiveState.Active;\n}\n\n//#endregion\n","//#region ---- Password reset payload on User ----\n\n/**\n * One-time password-reset token state stored as JSON on SecurityManagement.User.\n * The raw token is never persisted — only a SHA-256 hash.\n */\nexport interface AXMUserPasswordResetInfo {\n  tokenHash: string;\n  expiresAt: string;\n  sentAt: string;\n}\n\n//#endregion\n","//#region ---- User invitation payload on TenantUser ----\n\n/**\n * Invitation challenge / audit metadata on TenantManagement.TenantUser.\n * The raw token is never persisted — only a SHA-256 hash while the invite is pending.\n */\nexport interface AXMUserInvitationInfo {\n  /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */\n  tokenHash?: string;\n  expiresAt: string; // ISO\n  sentAt: string;\n  invitedByUserId: string;\n  applicationIds?: string[];\n  /** Role ids selected at invite time (flat union; mirrored onto scoped UserRole). */\n  roleIds?: string[];\n  /** TM Tenant Users: roles grouped by application (optional audit / accept helper). */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * `invite` = admin sent; `join-request` = user requested membership from waiting room;\n   * `tenant-request` = user requested creation of a new tenant (public form).\n   */\n  source: AXMMembershipInvitationSource;\n  /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */\n  acceptedAt?: string;\n}\n\nexport type AXMMembershipInvitationSource = 'invite' | 'join-request' | 'tenant-request';\n\nexport const AXM_MEMBERSHIP_INVITATION_SOURCE = {\n  Invite: 'invite',\n  JoinRequest: 'join-request',\n  TenantRequest: 'tenant-request',\n} as const;\n\n/** How a User identity row was created (directory provenance). */\nexport type AXMUserCreatedVia =\n  | 'invite'\n  | 'create-in-tenant'\n  | 'register'\n  | 'seed'\n  | 'idp'\n  | 'tenant-request';\n/**\n * In-app inbox definition for membership invites to users who already have a tenant.\n * Inbox row action opens the auth waiting room (Approve/Decline live there).\n */\nexport const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY =\n  'security-management.membership-invitation' as const;\n\n/** Query `source` value when opening waiting room from a membership-invite notification. */\nexport const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite' as const;\n\n//#endregion\n","//#region ----- Imports -----\n\nimport { coerceUnknownToTrimmedString } from '@acorex-platform/framework-shared/core';\n\n//#endregion\n\n//#region ----- Types -----\n\n/** Invite surface that decides which Role catalog rows are selectable. */\nexport type AXMInviteRoleAssignmentMode = 'application' | 'tenant';\n\nexport interface AXMInviteRoleScopeContext {\n  tenantId: string;\n  /** Required for application-mode filtering. */\n  applicationId?: string;\n}\n\nexport interface AXMInviteRoleScopeInfo {\n  tenantId?: string;\n  applicationId?: string;\n}\n\n//#endregion\n\n//#region ----- Helpers -----\n\nfunction readScopeString(value: unknown): string | undefined {\n  const id = coerceUnknownToTrimmedString(value);\n  return id || undefined;\n}\n\nexport function readInviteRoleScopeInfo(\n  role: { scopeInfo?: unknown } | null | undefined,\n): AXMInviteRoleScopeInfo {\n  const scope =\n    role?.scopeInfo && typeof role.scopeInfo === 'object'\n      ? (role.scopeInfo as Record<string, unknown>)\n      : undefined;\n  return {\n    tenantId: readScopeString(scope?.['tenantId']),\n    applicationId: readScopeString(scope?.['applicationId']),\n  };\n}\n\nfunction isHiddenRole(role: { stateInfo?: unknown } | null | undefined): boolean {\n  const state =\n    role?.stateInfo && typeof role.stateInfo === 'object'\n      ? (role.stateInfo as Record<string, unknown>)\n      : undefined;\n  return state?.['isHidden'] === true;\n}\n\n/**\n * Whether a Role catalog row may appear in the invite roles multi-select.\n *\n * UI-only selection filter (does not change Role / RLS):\n * - Application invite / per-app repeater row → current-tenant + that application overlays only\n * - Tenant invite → current-tenant-wide rows only (no applicationId, no other-app overlays)\n */\nexport function isRoleAssignableForInvite(\n  role: { scopeInfo?: unknown; stateInfo?: unknown } | null | undefined,\n  mode: AXMInviteRoleAssignmentMode,\n  context: AXMInviteRoleScopeContext,\n): boolean {\n  if (isHiddenRole(role)) {\n    return false;\n  }\n\n  const tenantId = readScopeString(context.tenantId);\n  if (!tenantId) {\n    return false;\n  }\n\n  const scope = readInviteRoleScopeInfo(role);\n  if (!scope.tenantId || scope.tenantId !== tenantId) {\n    return false;\n  }\n\n  if (mode === 'tenant') {\n    return !scope.applicationId;\n  }\n\n  const applicationId = readScopeString(context.applicationId);\n  if (!applicationId) {\n    return false;\n  }\n  return scope.applicationId === applicationId;\n}\n\n/**\n * TM Tenant Users invite repeater only: overlay for current tenant + the\n * application chosen on that row. Independent of {@link isRoleAssignableForInvite}\n * so Security → Users invite can change without affecting this picker.\n */\nexport function isRoleAssignableForTenantUserInviteRow(\n  role: { scopeInfo?: unknown; stateInfo?: unknown } | null | undefined,\n  context: AXMInviteRoleScopeContext,\n): boolean {\n  if (isHiddenRole(role)) {\n    return false;\n  }\n\n  const tenantId = readScopeString(context.tenantId);\n  const applicationId = readScopeString(context.applicationId);\n  if (!tenantId || !applicationId) {\n    return false;\n  }\n\n  const scope = readInviteRoleScopeInfo(role);\n  return scope.tenantId === tenantId && scope.applicationId === applicationId;\n}\n\n//#endregion\n","//#region ----- Types -----\n\n/** One TM invite repeater row: application + multi-select roles for that app. */\nexport interface AXMInviteApplicationRoleAssignment {\n  applicationId: string;\n  roleIds: string[];\n}\n\n//#endregion\n\n//#region ----- Helpers -----\n\nfunction readId(value: unknown): string {\n  if (typeof value === 'string') {\n    return value.trim();\n  }\n  if (value && typeof value === 'object') {\n    const id = (value as { id?: unknown }).id;\n    if (typeof id === 'string') {\n      return id.trim();\n    }\n    if (typeof id === 'number') {\n      return String(id);\n    }\n    return '';\n  }\n  return value != null ? String(value).trim() : '';\n}\n\nfunction readRoleIds(value: unknown): string[] {\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return [...new Set(value.map((id) => readId(id)).filter(Boolean))];\n}\n\n/**\n * Submit-time merge for the TM invite repeater.\n * Duplicate applications (same app on two rows, different role picks) become one assignment\n * with the union of role ids. Empty application rows are dropped. Do not unique the dropdown\n * instead — the UI may repeat an application.\n */\nexport function normalizeInviteApplicationRoleAssignments(\n  rows: unknown,\n): AXMInviteApplicationRoleAssignment[] {\n  if (!Array.isArray(rows)) {\n    return [];\n  }\n\n  const byApp = new Map<string, Set<string>>();\n  for (const row of rows) {\n    if (!row || typeof row !== 'object') {\n      continue;\n    }\n    const record = row as Record<string, unknown>;\n    const applicationId = readId(record['applicationId']);\n    if (!applicationId) {\n      continue;\n    }\n    const bucket = byApp.get(applicationId) ?? new Set<string>();\n    for (const roleId of readRoleIds(record['roleIds'])) {\n      bucket.add(roleId);\n    }\n    byApp.set(applicationId, bucket);\n  }\n\n  return [...byApp.entries()].map(([applicationId, roleIds]) => ({\n    applicationId,\n    roleIds: [...roleIds],\n  }));\n}\n\nexport function flattenInviteApplicationRoleAssignments(\n  assignments: readonly AXMInviteApplicationRoleAssignment[],\n): { applicationIds: string[]; roleIds: string[] } {\n  const applicationIds = assignments.map((row) => row.applicationId);\n  const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];\n  return { applicationIds, roleIds };\n}\n\n//#endregion\n","//#region ----- Types -----\n\n/** One TM create-in-tenant repeater row: application + multi-select roles for that app. */\nexport interface AXMCreateApplicationRoleAssignment {\n  applicationId: string;\n  roleIds: string[];\n}\n\n//#endregion\n\n//#region ----- Helpers -----\n\nfunction readId(value: unknown): string {\n  if (typeof value === 'string') {\n    return value.trim();\n  }\n  if (value && typeof value === 'object') {\n    const id = (value as { id?: unknown }).id;\n    if (typeof id === 'string') {\n      return id.trim();\n    }\n    if (typeof id === 'number') {\n      return String(id);\n    }\n    return '';\n  }\n  return value != null ? String(value).trim() : '';\n}\n\nfunction readRoleIds(value: unknown): string[] {\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return [...new Set(value.map((id) => readId(id)).filter(Boolean))];\n}\n\n/**\n * Submit-time merge for the TM create-in-tenant repeater.\n * Duplicate applications (same app on two rows, different role picks) become one assignment\n * with the union of role ids. Empty application rows are dropped.\n */\nexport function normalizeCreateApplicationRoleAssignments(\n  rows: unknown,\n): AXMCreateApplicationRoleAssignment[] {\n  if (!Array.isArray(rows)) {\n    return [];\n  }\n\n  const byApp = new Map<string, Set<string>>();\n  for (const row of rows) {\n    if (!row || typeof row !== 'object') {\n      continue;\n    }\n    const record = row as Record<string, unknown>;\n    const applicationId = readId(record['applicationId']);\n    if (!applicationId) {\n      continue;\n    }\n    const bucket = byApp.get(applicationId) ?? new Set<string>();\n    for (const roleId of readRoleIds(record['roleIds'])) {\n      bucket.add(roleId);\n    }\n    byApp.set(applicationId, bucket);\n  }\n\n  return [...byApp.entries()].map(([applicationId, roleIds]) => ({\n    applicationId,\n    roleIds: [...roleIds],\n  }));\n}\n\nexport function flattenCreateApplicationRoleAssignments(\n  assignments: readonly AXMCreateApplicationRoleAssignment[],\n): { applicationIds: string[]; roleIds: string[] } {\n  const applicationIds = assignments.map((row) => row.applicationId);\n  const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];\n  return { applicationIds, roleIds };\n}\n\n//#endregion\n","//#region ---- Security management server command keys ----\n\nexport const AXMSecurityManagementServerCommands = {\n  SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',\n  CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',\n  ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',\n  GetOwnPasswordStatus: 'SecurityManagement:Server:GetOwnPasswordStatus',\n  InviteUser: 'SecurityManagement:Server:InviteUser',\n  /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */\n  ListTenantEntitledApplications: 'SecurityManagement:Server:ListTenantEntitledApplications',\n  /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */\n  ListInviteAssignableRoles: 'SecurityManagement:Server:ListInviteAssignableRoles',\n  ResendInvitation: 'SecurityManagement:Server:ResendInvitation',\n  CancelInvitation: 'SecurityManagement:Server:CancelInvitation',\n  AcceptInvitation: 'SecurityManagement:Server:AcceptInvitation',\n  ListMyPendingInvitations: 'SecurityManagement:Server:ListMyPendingInvitations',\n  DeclineInvitation: 'SecurityManagement:Server:DeclineInvitation',\n  AcceptMyInvitation: 'SecurityManagement:Server:AcceptMyInvitation',\n  LookupTenantByUniqueName: 'SecurityManagement:Server:LookupTenantByUniqueName',\n  RequestTenantMembership: 'SecurityManagement:Server:RequestTenantMembership',\n  ListMyJoinRequests: 'SecurityManagement:Server:ListMyJoinRequests',\n  CancelMyJoinRequest: 'SecurityManagement:Server:CancelMyJoinRequest',\n  ApproveJoinRequest: 'SecurityManagement:Server:ApproveJoinRequest',\n  RejectJoinRequest: 'SecurityManagement:Server:RejectJoinRequest',\n  CreateUserInTenant: 'SecurityManagement:Server:CreateUserInTenant',\n  StartTwoFactorEnrollment: 'SecurityManagement:Server:StartTwoFactorEnrollment',\n  ConfirmTwoFactorEnrollment: 'SecurityManagement:Server:ConfirmTwoFactorEnrollment',\n  DisableTwoFactor: 'SecurityManagement:Server:DisableTwoFactor',\n  GenerateTwoFactorRecoveryCodes: 'SecurityManagement:Server:GenerateTwoFactorRecoveryCodes',\n  GetTwoFactorStatus: 'SecurityManagement:Server:GetTwoFactorStatus',\n  AdminResetTwoFactor: 'SecurityManagement:Server:AdminResetTwoFactor',\n  /** Public — completes login after password challenge (TOTP or recovery). */\n  VerifyTwoFactorLogin: 'SecurityManagement:Server:VerifyTwoFactorLogin',\n} as const;\n\n/** Stable codes for self-service password change (client maps to i18n). */\nexport const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {\n  NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',\n  IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',\n  SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',\n  InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',\n} as const;\n\n/** Client/UI action key (confirm dialog → server send). */\nexport const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';\n\n/** Client/UI action key (confirm dialog → server admin reset 2FA). */\nexport const AXM_USER_RESET_TWO_FACTOR_COMMAND = 'SecurityManagement:User:ResetTwoFactor';\n\n/** Client/UI action keys for invite / create-in-tenant flows. */\nexport const AXM_USER_INVITE_COMMAND = 'SecurityManagement:User:Invite';\nexport const AXM_USER_RESEND_INVITATION_COMMAND = 'SecurityManagement:User:ResendInvitation';\nexport const AXM_USER_CANCEL_INVITATION_COMMAND = 'SecurityManagement:User:CancelInvitation';\nexport const AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:ApproveJoinRequest';\nexport const AXM_USER_REJECT_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:RejectJoinRequest';\nexport const AXM_USER_CREATE_IN_TENANT_COMMAND = 'SecurityManagement:User:CreateInTenant';\n\nexport interface AXMSendPasswordResetEmailInput {\n  /** Admin path: target user id. */\n  userId?: string;\n  /** Forgot path: email or username. */\n  login?: string;\n  /** Optional absolute web origin for reset link (defaults to env / localhost). */\n  webOrigin?: string;\n}\n\nexport interface AXMCompletePasswordResetInput {\n  token: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordInput {\n  /** Required when the account already has a password; omit/empty when setting the first password. */\n  currentPassword?: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordResult {\n  passwordChangedAt: string;\n}\n\nexport interface AXMGetOwnPasswordStatusResult {\n  /** True when the signed-in user has a non-empty stored password credential. */\n  hasPassword: boolean;\n}\n\nexport interface AXMInviteUserInput {\n  email: string;\n  displayName?: string;\n  applicationIds?: string[];\n  /**\n   * Role ids to assign on invite (scoped UserRole grant).\n   * Application invite → app-scoped grant; tenant invite without per-app rows → tenant-wide grant.\n   */\n  roleIds?: string[];\n  /**\n   * TM Tenant Users repeater: roles per selected application.\n   * When present, server upserts a UserRole grant per application (not one tenant-wide grant).\n   */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * True when invite is from Tenant Users (tenant-membership) with multi-app UI.\n   * Server SoT with session edition feature — not Application.code === 'TM'.\n   */\n  tenantMembershipInvite?: boolean;\n  /** Client sets true after warning that the identity already exists. */\n  confirmExisting?: boolean;\n  webOrigin?: string;\n}\n\n/** One selectable application for TM invite (tenant subscription entitlement). */\nexport interface AXMTenantEntitledApplicationItem {\n  id: string;\n  /** Raw MLS / string title — client resolves for display. */\n  title: unknown;\n}\n\nexport interface AXMListTenantEntitledApplicationsResult {\n  items: AXMTenantEntitledApplicationItem[];\n}\n\n/** One Role overlay selectable on a TM invite repeater row. */\nexport interface AXMInviteAssignableRoleItem {\n  id: string;\n  title: unknown;\n  name?: string;\n  applicationId: string;\n}\n\nexport interface AXMListInviteAssignableRolesInput {\n  /** When set, only overlays for this application (current tenant). */\n  applicationId?: string;\n}\n\nexport interface AXMListInviteAssignableRolesResult {\n  items: AXMInviteAssignableRoleItem[];\n}\n\nexport interface AXMInviteUserResult {\n  userId: string;\n  tenantUserId: string;\n  userAlreadyExists: boolean;\n  sent: boolean;\n}\n\nexport interface AXMResendInvitationInput {\n  tenantUserId?: string;\n  userId?: string;\n  webOrigin?: string;\n}\n\nexport interface AXMCancelInvitationInput {\n  tenantUserId?: string;\n  userId?: string;\n}\n\n/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */\nexport const AXM_ACCEPT_INVITATION_ERROR_CODES = {\n  Invalid: 'ACCEPT_INVITATION_INVALID',\n  Expired: 'ACCEPT_INVITATION_EXPIRED',\n  PasswordRequired: 'ACCEPT_INVITATION_PASSWORD_REQUIRED',\n} as const;\n\nexport type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';\n\nexport interface AXMAcceptInvitationInput {\n  token: string;\n  newPassword?: string;\n  /** Check the token only. Does not set a password or consume the link. */\n  preview?: boolean;\n}\n\nexport interface AXMAcceptInvitationPreviewResult {\n  usable: boolean;\n  reason: AXMAcceptInvitationReason;\n}\n\nexport interface AXMPendingInvitationItem {\n  tenantUserId: string;\n  tenantId: string;\n  tenantTitle?: string;\n  /** Tenant branding logo URL / storage id when available. */\n  tenantLogo?: string;\n  invitedByUserId?: string;\n  expiresAt?: string;\n  sentAt?: string;\n  applicationIds?: string[];\n}\n\nexport interface AXMListMyPendingInvitationsResult {\n  items: AXMPendingInvitationItem[];\n}\n\nexport interface AXMAcceptMyInvitationInput {\n  tenantUserId: string;\n  newPassword?: string;\n}\n\nexport interface AXMDeclineInvitationInput {\n  tenantUserId: string;\n}\n\n/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */\nexport const AXM_JOIN_REQUEST_ERROR_CODES = {\n  NotSignedIn: 'JOIN_REQUEST_NOT_SIGNED_IN',\n  InvalidInput: 'JOIN_REQUEST_INVALID_INPUT',\n  TenantNotFound: 'JOIN_REQUEST_TENANT_NOT_FOUND',\n  AlreadyMember: 'JOIN_REQUEST_ALREADY_MEMBER',\n  InvitePending: 'JOIN_REQUEST_INVITE_PENDING',\n  RequestNotFound: 'JOIN_REQUEST_NOT_FOUND',\n  NotPending: 'JOIN_REQUEST_NOT_PENDING',\n} as const;\n\nexport interface AXMLookupTenantByUniqueNameInput {\n  /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */\n  uniqueName: string;\n}\n\nexport interface AXMLookupTenantByUniqueNameItem {\n  id: string;\n  /** Stored unique name with original casing. */\n  name: string;\n}\n\nexport interface AXMLookupTenantByUniqueNameResult {\n  /** Present only when the name/title matches exactly one active tenant. */\n  item?: AXMLookupTenantByUniqueNameItem | null;\n}\n\nexport interface AXMRequestTenantMembershipInput {\n  /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */\n  uniqueName: string;\n}\n\nexport interface AXMRequestTenantMembershipResult {\n  tenantUserId: string;\n  tenantId: string;\n  tenantName: string;\n}\n\nexport interface AXMJoinRequestItem {\n  tenantUserId: string;\n  tenantId: string;\n  tenantName?: string;\n  tenantTitle?: string;\n  /** Tenant branding logo URL / storage id when available. */\n  tenantLogo?: string;\n  sentAt?: string;\n  expiresAt?: string;\n}\n\nexport interface AXMListMyJoinRequestsResult {\n  items: AXMJoinRequestItem[];\n}\n\nexport interface AXMCancelMyJoinRequestInput {\n  tenantUserId: string;\n}\n\nexport interface AXMApproveJoinRequestInput {\n  tenantUserId?: string;\n  userId?: string;\n  /** Product / app-scoped approve: roles for the current session application. */\n  roleIds?: string[];\n  applicationIds?: string[];\n  /** TM Tenant Users: per-application role rows (same shape as invite). */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * When true, allow multi-application assignment (TM Tenant Users + edition feature).\n   * Mirrors invite `tenantMembershipInvite`.\n   */\n  tenantMembershipApprove?: boolean;\n}\n\nexport interface AXMRejectJoinRequestInput {\n  tenantUserId?: string;\n  userId?: string;\n}\n\nexport interface AXMCreateUserInTenantInput {\n  email?: string;\n  username?: string;\n  displayName?: string;\n  password?: string;\n  applicationIds?: string[];\n  /** Product Users create: roles for the current session application. */\n  roleIds?: string[];\n  /** TM Tenant Users create: per-application role rows (merged client-side before submit). */\n  applicationRoleAssignments?: Array<{ applicationId: string; roleIds: string[] }>;\n  /**\n   * When true, allow multi-application assignment (TM Tenant Users + edition feature).\n   * Parallel to invite `tenantMembershipInvite`; Create path only.\n   */\n  tenantMembershipCreate?: boolean;\n}\n\nexport interface AXMCreateUserInTenantResult {\n  userId: string;\n  tenantUserId: string;\n}\n\n/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */\nexport const AXM_TWO_FACTOR_ERROR_CODES = {\n  NotSignedIn: 'TWO_FACTOR_NOT_SIGNED_IN',\n  InvalidInput: 'TWO_FACTOR_INVALID_INPUT',\n  IncorrectPassword: 'TWO_FACTOR_INCORRECT_PASSWORD',\n  IncorrectCode: 'TWO_FACTOR_INCORRECT_CODE',\n  AlreadyEnabled: 'TWO_FACTOR_ALREADY_ENABLED',\n  NotEnabled: 'TWO_FACTOR_NOT_ENABLED',\n  EnrollmentExpired: 'TWO_FACTOR_ENROLLMENT_EXPIRED',\n  ChallengeExpired: 'TWO_FACTOR_CHALLENGE_EXPIRED',\n  RateLimited: 'TWO_FACTOR_RATE_LIMITED',\n  InvalidConfiguration: 'TWO_FACTOR_INVALID_CONFIGURATION',\n  ProofRequired: 'TWO_FACTOR_PROOF_REQUIRED',\n  UserNotFound: 'TWO_FACTOR_USER_NOT_FOUND',\n  Forbidden: 'TWO_FACTOR_FORBIDDEN',\n} as const;\n\nexport interface AXMStartTwoFactorEnrollmentInput {\n  password: string;\n}\n\nexport interface AXMStartTwoFactorEnrollmentResult {\n  enrollmentId: string;\n  otpauthUri: string;\n  /** Base32 secret for manual entry (client renders QR via ax-qrcode). */\n  secretBase32: string;\n  expiresAt: string;\n}\n\nexport interface AXMConfirmTwoFactorEnrollmentInput {\n  enrollmentId: string;\n  code: string;\n}\n\nexport interface AXMConfirmTwoFactorEnrollmentResult {\n  enabled: true;\n  verifiedAt: string;\n}\n\nexport interface AXMDisableTwoFactorInput {\n  /** At least one of password or totpCode is required. */\n  password?: string;\n  totpCode?: string;\n}\n\nexport interface AXMDisableTwoFactorResult {\n  enabled: false;\n}\n\nexport interface AXMGenerateTwoFactorRecoveryCodesInput {\n  /** At least one of password or totpCode is required. */\n  password?: string;\n  totpCode?: string;\n}\n\nexport interface AXMGenerateTwoFactorRecoveryCodesResult {\n  /** Plaintext codes shown once only (display format ABCD-EFGH). */\n  codes: string[];\n}\n\nexport interface AXMGetTwoFactorStatusResult {\n  enabled: boolean;\n  enrolled: boolean;\n  verifiedAt?: string | null;\n  hasRecoveryCodes: boolean;\n  unusedRecoveryCodeCount: number;\n}\n\nexport interface AXMAdminResetTwoFactorInput {\n  userId: string;\n  /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */\n  dryRun?: boolean;\n}\n\nexport interface AXMAdminResetTwoFactorResult {\n  reset: boolean;\n}\n\nexport interface AXMVerifyTwoFactorLoginInput {\n  challengeId: string;\n  /** TOTP (6 digits) or recovery code. */\n  code: string;\n  rememberMe?: boolean;\n}\n\n//#endregion\n","//#region ----- User provisioning settings -----\n\n/** Platform settings owned by Security Management. */\nexport const AXMSecurityManagementSettings = {\n  /**\n   * Which Users-list add actions are available.\n   * `create` and `invite` are primary. `both` shows them as secondary actions.\n   */\n  UserProvisioningMode: 'SecurityManagement:Setting:User.ProvisioningMode',\n} as const;\n\nexport const AXMUserProvisioningMode = {\n  Create: 'create',\n  Invite: 'invite',\n  Both: 'both',\n} as const;\n\nexport type AXMUserProvisioningMode = (typeof AXMUserProvisioningMode)[keyof typeof AXMUserProvisioningMode];\n\n/** Used when the platform setting has not been saved yet. */\nexport const AXM_USER_PROVISIONING_MODE_DEFAULT = AXMUserProvisioningMode.Both;\n\n//#endregion\n","//#region ----- Device session admin scope (operation-owned) -----\r\r\n\r\r\n/**\r\r\n * Explicit DeviceSessions admin operation scope (ADR-TEN-001 D-07).\r\r\n * Selected by the calling surface (menu/view), not by Application.code / TM ids.\r\r\n */\r\r\nexport type AXPDeviceSessionAdminScope = 'tenant' | 'application';\r\r\n\r\r\n/** Query `params` key and HTTP header value for admin scope. */\r\r\nexport const AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM = 'deviceSessionAdminScope';\r\r\n\r\r\n/** HTTP header (lowercase) carrying the same scope for getOne/update/delete. */\r\r\nexport const AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER = 'x-axp-device-session-admin-scope';\r\r\n\r\r\n/** Entity list view name for TM → Tenant Sessions. */\r\r\nexport const AXP_DEVICE_SESSION_TENANT_SESSIONS_VIEW = 'tenant-sessions';\r\r\n\r\r\nexport function normalizeDeviceSessionAdminScope(\r\r\n  value: unknown,\r\r\n): AXPDeviceSessionAdminScope {\r\r\n  return value === 'tenant' ? 'tenant' : 'application';\r\r\n}\r\r\n\r\r\n//#endregion\r\r\n\r","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport enum AXMSessionStatusTypes {\n  revoked = 'revoked',\n  expired = 'expired',\n  active = 'active',\n}\n\nexport interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<string> {\n  clientName: string;\n  ipAddress: string;\n  userAgent: string;\n  authorizationId: string;\n  status: string;\n  userId: string;\n  user: {\n    id: string;\n    name: string;\n  };\n  applicationId: string;\n  application: {\n    id: string;\n    name: string;\n  };\n  tenantId: string;\n  tenant: {\n    id: string;\n    name: string;\n  };\n  /** True only for the caller's current login (`sid`); stamped on read. */\n  isActiveSession: boolean;\n  /** Login/session id matching access-token `sid`. */\n  sessionId?: string;\n  /** Stable per-device fingerprint (one active row per user+device). */\n  deviceKey?: string;\n\n  deviceName: string;\n  operatingSystem: string;\n  browser: string;\n  location: string;\n  lastLoginDate: Date;\n  /** When the session was revoked / logged out (null while still active). */\n  loggedOutAt?: Date | string | null;\n}\n","//#region ---- Identity provider entity model ----\n\n/**\n * Login protocol for {@link AXMIdentityProviderEntityModel}.\n * `directory` covers LDAP, Active Directory, and similar bind-based directories.\n */\nexport const AXM_IDENTITY_PROVIDER_PROTOCOL = {\n  Oidc: 'oidc',\n  Directory: 'directory',\n} as const;\n\nexport type AXMIdentityProviderProtocol =\n  (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];\n\n/**\n * Platform login IdP row (SecurityManagement.IdentityProvider).\n * Active/inactive uses the disable plugin field `isDisabled`.\n * Broker routing uses `key` as OAuth `acr_values` (OIDC only).\n */\nexport interface AXMIdentityProviderEntityModel {\n  id: string;\n  /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */\n  key: string;\n  title: string;\n  icon?: string | null;\n  /**\n   * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.\n   * Missing/legacy rows are treated as `oidc`.\n   */\n  protocol?: AXMIdentityProviderProtocol | null;\n  /** External IdP authorize URL (OIDC). */\n  authorizationUrl?: string | null;\n  /** External IdP token URL (OIDC). */\n  tokenUrl?: string | null;\n  /** Optional userinfo URL when id_token is absent (OIDC). */\n  userInfoUrl?: string | null;\n  /** Space-separated scopes requested from the external IdP (OIDC). */\n  scopes?: string | null;\n  /**\n   * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.\n   */\n  issuerUrl?: string | null;\n  /**\n   * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.\n   */\n  clientId?: string | null;\n  /**\n   * OAuth client secret (OIDC), or directory Bind Password when using search bind.\n   */\n  clientSecret?: string | null;\n  /** Directory server URL, e.g. `ldap://directory.example.com:389`. */\n  directoryUrl?: string | null;\n  /** Directory search base DN, e.g. `DC=example,DC=com`. */\n  directoryBaseDn?: string | null;\n  /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */\n  directoryUserDnTemplate?: string | null;\n  /** Optional search filter with `{{username}}` when using a service bind account. */\n  directoryUserSearchFilter?: string | null;\n  /** Start TLS when connecting to the directory server. */\n  directoryUseTls?: boolean | null;\n  /** Reject connections when the directory TLS certificate is untrusted. */\n  directoryTlsRejectUnauthorized?: boolean | null;\n  /** From disable plugin — `true` means not offered on login. */\n  isDisabled?: boolean;\n  priority: number;\n}\n\n//#endregion\n","import { AXPExpression } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {\n  name: string;\n  title: string;\n  description?: string;\n\n  rules: {\n    conditions: AXPExpression;\n    effects: AXMPolicyEffectRule[]; // list of effect rules\n  }[];\n\n  permission: string; // related permission\n  scope: AXMPolicyScope;\n\n  resource: {\n    type: string;\n    target: string;\n  };\n}\n\nexport type AXMPolicyScope = 'system' | 'tenant' | 'user';\n\nexport type AXMPolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';\n\nexport interface AXMPolicyEffectRule {\n  effect: AXMPolicyEffect;\n  target: string;\n}\n\n// const glocbal_readonly_policy = {\n//   name: 'readonly',\n//   resource: {\n//     reference: '*',\n//     type: 'entity',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ isHidden==true }}',\n//       effects: [\n//         {\n//           target: '*',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n\n// const readonly_file_by_role_policy = {\n//   name: 'readonly_file_by_role_policy',\n//   resource: {\n//     type: 'entity',\n//     reference: 'COntentManagement.Promotion',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ createdDate > 2025-01-01 && user.role!=\"admin\"}}',\n//       effects: [\n//         {\n//           target: 'imageId',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n","//#region ----- RolePermission types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped permission grants for a Role.\n * Role rows are identity-only; all capability keys live here.\n */\nexport interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.Role} id. */\n  roleId: string;\n  /** Capability keys granted for this scope. */\n  permissions: string[];\n}\n\n//#endregion\n","//#region ----- UserRole types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped role assignments for a User.\n * User rows are identity-only for roles; all role memberships live here.\n */\nexport interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.User} id. */\n  userId: string;\n  /** Role ids granted for this scope. */\n  roleIds: string[];\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n//#region ----- Types -----\n\nexport type AXMUserTwoFactorMethod = 'authenticator';\n\nexport interface AXMUserTwoFactorRecoveryCode {\n  hash: string;\n  /** Salt / hashing metadata (e.g. full pbkdf2 encoded string already embeds salt — optional extra). */\n  salt?: string;\n  usedAt?: string | null;\n}\n\n/**\n * Persisted authenticator enrollment for one user.\n * Secrets must never be returned on client/entity APIs.\n */\nexport interface AXMSecurityManagementUserTwoFactorEntityModel extends AXPEntityModel<string> {\n  userId: string;\n  method: AXMUserTwoFactorMethod;\n  encryptedSecret: string;\n  iv: string;\n  authTag: string;\n  keyVersion: number;\n  verifiedAt: string;\n  /** Last accepted TOTP time-step (floor(unix/period)); replay guard. */\n  lastAcceptedStep?: number | null;\n  recoveryCodes?: AXMUserTwoFactorRecoveryCode[];\n}\n\n//#endregion\n","import { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';\nimport { AXPEntity, createAllQueryView, entityMasterCrudActions } from '@acorex-platform/framework-shared/entity';\nimport { RootConfig } from '../../root-config';\n\n/**\n * Schema-only entity for authenticator enrollment.\n * No secret fields in UI; all mutations go through dedicated 2FA commands.\n */\nexport async function userTwoFactorFactory(): Promise<AXPEntity | null> {\n  const i18n = RootConfig.config.i18n;\n\n  const entityDef: AXPEntity = {\n    module: RootConfig.module.name,\n    name: RootConfig.entities.userTwoFactor.name,\n    title: RootConfig.entities.userTwoFactor.title,\n    icon: RootConfig.entities.userTwoFactor.icon,\n    searchTags: ['two-factor', '2fa', 'totp', 'authenticator', 'احراز هویت دو مرحله‌ای'],\n    formats: {\n      individual: RootConfig.entities.userTwoFactor.title,\n      plural: RootConfig.entities.userTwoFactor.titlePlural,\n      searchResult: {\n        title: '{{ userId }}',\n        description: RootConfig.module.title,\n      },\n    },\n    groups: [\n      {\n        id: 'basic-info',\n        title: `@general:terms.interface.basic-info`,\n      },\n    ],\n    properties: [\n      {\n        name: 'userId',\n        title: `@${i18n}:user-two-factor.fields.user-id.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'string',\n          interface: {\n            type: AXPWidgetsCatalog.text,\n            options: { readOnly: true },\n          },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'method',\n        title: `@${i18n}:user-two-factor.fields.method.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'string',\n          interface: {\n            type: AXPWidgetsCatalog.text,\n            options: { readOnly: true },\n          },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'verifiedAt',\n        title: `@${i18n}:user-two-factor.fields.verified-at.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'dateTime',\n          interface: {\n            type: AXPWidgetsCatalog.dateTime,\n            options: { readOnly: true },\n          },\n        },\n      },\n    ],\n    columns: [{ name: 'userId' }, { name: 'method' }, { name: 'verifiedAt' }],\n    interfaces: {\n      master: {\n        single: {\n          title: '{{ userId }}',\n          sections: [\n            {\n              id: 'basic-info',\n              layout: { positions: { lg: { colSpan: 12 } } },\n            },\n          ],\n          properties: [\n            { name: 'userId', layout: { positions: { lg: { colSpan: 6 } } } },\n            { name: 'method', layout: { positions: { lg: { colSpan: 6 } } } },\n            { name: 'verifiedAt', layout: { positions: { lg: { colSpan: 6 } } } },\n          ],\n          actions: [],\n        },\n        list: {\n          actions: [...entityMasterCrudActions({ create: false, delete: false, edit: false })],\n          views: [createAllQueryView({ sorts: [{ name: 'verifiedAt', dir: 'desc' }] })],\n        },\n      },\n    },\n  };\n\n  return entityDef;\n}\n","//#region ----- Imports -----\n\nimport { AXPSystemActionType } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityCommandScope, type AXPEntityAction } from '@acorex-platform/framework-shared/entity';\nimport { AXM_USER_CREATE_IN_TENANT_COMMAND, AXM_USER_INVITE_COMMAND } from '../../server-commands';\nimport {\n  AXM_USER_PROVISIONING_MODE_DEFAULT,\n  AXMSecurityManagementSettings,\n  AXMUserProvisioningMode,\n} from '../../settings.keys';\n\n//#endregion\n\n//#region ----- List actions -----\n\nconst PROVISIONING_MODE_KEY = AXMSecurityManagementSettings.UserProvisioningMode;\n\n/**\n * Hides the action unless the platform provisioning setting matches `mode`.\n * A missing value uses {@link AXM_USER_PROVISIONING_MODE_DEFAULT}.\n * Select widgets may persist either the scalar or `{ value }`.\n */\nfunction hiddenUnlessProvisioningMode(mode: AXMUserProvisioningMode): string {\n  return `{{ (((await settings.get('${PROVISIONING_MODE_KEY}'))?.value ?? (await settings.get('${PROVISIONING_MODE_KEY}'))) || '${AXM_USER_PROVISIONING_MODE_DEFAULT}') !== '${mode}' }}`;\n}\n\nconst USER_ADD_COMMANDS = new Set<string>([AXM_USER_INVITE_COMMAND, AXM_USER_CREATE_IN_TENANT_COMMAND]);\n\nfunction commandNameOf(action: AXPEntityAction): string | undefined {\n  return typeof action.command === 'string' ? action.command : action.command?.name;\n}\n\n/** Type-level Invite / Create actions, including the legacy Create dropdown. */\nexport function isUserProvisioningListAction(action: AXPEntityAction): boolean {\n  if (action.scope !== AXPEntityCommandScope.TypeLevel) {\n    return false;\n  }\n  if (USER_ADD_COMMANDS.has(commandNameOf(action) ?? '')) {\n    return true;\n  }\n  return (action.items ?? []).some((child) => USER_ADD_COMMANDS.has(commandNameOf(child) ?? ''));\n}\n\nfunction provisioningAction(input: {\n  name: string;\n  title: string;\n  icon: string;\n  command: string;\n  priority: 'primary' | 'secondary';\n  mode: AXMUserProvisioningMode;\n  order: number;\n}): AXPEntityAction {\n  return {\n    name: input.name,\n    title: input.title,\n    icon: input.icon,\n    command: { name: input.command },\n    priority: input.priority,\n    type: AXPSystemActionType.Create,\n    scope: AXPEntityCommandScope.TypeLevel,\n    order: input.order,\n    hidden: hiddenUnlessProvisioningMode(input.mode),\n  };\n}\n\n/**\n * Users list add actions driven by the platform provisioning setting.\n * Create-only and invite-only stay primary. Both are secondary menu items.\n */\nexport function userProvisioningListActions(): AXPEntityAction[] {\n  return [\n    provisioningAction({\n      name: 'provision-create',\n      title: '@general:actions.create.title',\n      icon: 'fa-light fa-user-plus',\n      command: AXM_USER_CREATE_IN_TENANT_COMMAND,\n      priority: 'primary',\n      mode: AXMUserProvisioningMode.Create,\n      order: 1,\n    }),\n    provisioningAction({\n      name: 'provision-invite',\n      title: '@security-management:users.entities.user.actions.invite.title',\n      icon: 'fa-light fa-envelope',\n      command: AXM_USER_INVITE_COMMAND,\n      priority: 'primary',\n      mode: AXMUserProvisioningMode.Invite,\n      order: 1,\n    }),\n    provisioningAction({\n      name: 'provision-invite-secondary',\n      title: '@security-management:users.entities.user.actions.invite.title',\n      icon: 'fa-light fa-envelope',\n      command: AXM_USER_INVITE_COMMAND,\n      priority: 'secondary',\n      mode: AXMUserProvisioningMode.Both,\n      order: 1,\n    }),\n    provisioningAction({\n      name: 'provision-create-secondary',\n      title: '@security-management:users.entities.user.actions.create-in-tenant.title',\n      icon: 'fa-light fa-user-plus',\n      command: AXM_USER_CREATE_IN_TENANT_COMMAND,\n      priority: 'secondary',\n      mode: AXMUserProvisioningMode.Both,\n      order: 2,\n    }),\n  ];\n}\n\n//#endregion\n","//#region ---- Contracts barrel ----\n\nexport * from './lib/context.definitions';\nexport * from './features.keys';\nexport * from './menu.keys';\nexport * from './permission.keys';\nexport * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';\nexport * from './USER_ROLES_PAGE_COMPONENT_KEY';\n\nexport * from './root-config';\nexport * from './manifest';\n\nexport * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';\nexport * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';\nexport * from './user-access-state';\nexport * from './user-effective-state';\nexport * from './resolve-user-effective-state';\nexport * from './user-password-reset';\nexport * from './user-invitation';\nexport * from './invite-assignable-roles.util';\nexport * from './invite-application-role-rows.util';\nexport * from './create-application-role-rows.util';\nexport * from './server-commands';\nexport * from './settings.keys';\nexport * from './device-session-admin-scope';\n//#endregion\n\nexport * from './entities';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":["readId","readRoleIds"],"mappings":";;;AAEA;AAEO,MAAM,gCAAgC,GAA2B;AACtE,IAAA;AACE,QAAA,IAAI,EAAE,iBAAiB;AACvB,QAAA,KAAK,EAAE,mBAAmB;AAC1B,QAAA,WAAW,EACT,0GAA0G;AAC5G,QAAA,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;AACrB,KAAA;;AAGH;;ACfA;AAEA;;;AAGG;AACI,MAAM,gCAAgC,GAAG;AAC9C,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,aAAa,EAAE,0CAA0C;AACzD,IAAA,cAAc,EAAE,2CAA2C;AAC3D,IAAA,cAAc,EAAE,2CAA2C;;AAE3D,IAAA,uBAAuB,EAAE,oDAAoD;;AAE7E,IAAA,aAAa,EAAE,0CAA0C;;AAG3D;;AClBO,MAAM,6BAA6B,GAAG;AAC3C,IAAA,IAAI,EAAE,yBAAyB;AAC/B,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,cAAc,EAAE,wCAAwC;AACxD,IAAA,MAAM,EAAE,gCAAgC;AACxC,IAAA,iBAAiB,EAAE,2CAA2C;AAC9D,IAAA,SAAS,EAAE,mCAAmC;;;ACPhD;;;AAGG;AACI,MAAM,+BAA+B,GAAG;AAC7C,IAAA,MAAM,EAAE,kCAAkC;;AAE1C,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,cAAc,EAAE,0CAA0C;AAC1D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,SAAS,EAAE,qCAAqC;AAChD,IAAA,aAAa,EAAE,yCAAyC;AACxD,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,WAAW,EAAE,uCAAuC;AACpD,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,QAAQ,EAAE,oCAAoC;AAC9C,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;;AAG1E;;;AAGG;AACI,MAAM,mCAAmC,GAAG;AACjD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,aAAa,EAAE;QACb,UAAU,EAAE,+BAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,+BAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,+BAA+B,CAAC,cAAc;AAC1D,KAAA;AACD,IAAA,MAAM,EAAE;QACN,UAAU,EAAE,+BAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;AACzD,KAAA;;;ACzDH;AACO,MAAM,mCAAmC,GAAG;;ACD5C,MAAM,6BAA6B,GAAG;;ACA7C,MAAM,MAAM,GAAG;AACb,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,aAAa,EAAE,SAAS;CACzB;AACM,MAAM,UAAU,GAAG;IACxB,MAAM;AACN,IAAA,MAAM,EAAE;AACN,QAAA,KAAK,EAAE,qBAAqB;AAC5B,QAAA,IAAI,EAAE,oBAAoB;AAC1B,QAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,aAAA,CAAe;AACrC,QAAA,IAAI,EAAE,2BAA2B;AAClC,KAAA;AACD,IAAA,QAAQ,EAAE;AACR,QAAA,MAAM,EAAE;AACN,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AACxD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iCAAA,CAAmC;AAC/D,YAAA,IAAI,EAAE,oBAAoB;AAC3B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,mBAAmB;AAC1B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AACxE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iDAAA,CAAmD;AAC/E,YAAA,IAAI,EAAE,iBAAiB;AACxB,SAAA;AACD,QAAA,QAAQ,EAAE;AACR,YAAA,IAAI,EAAE,UAAU;AAChB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oCAAA,CAAsC;AAC5D,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qCAAA,CAAuC;AACnE,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,SAAS;AACf,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,kBAAkB;AACzB,SAAA;AACD,QAAA,gBAAgB,EAAE;AAChB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oDAAA,CAAsD;AAC5E,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qDAAA,CAAuD;AACnF,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,aAAa,EAAE;AACb,YAAA,IAAI,EAAE,eAAe;AACrB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+CAAA,CAAiD;AACvE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AAC9E,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACF,KAAA;AACD,IAAA,OAAO,EAAE;AACP,QAAA,OAAO,EAAE;AACP,YAAA,4BAA4B,EAAE,yDAAyD;AACvF,YAAA,kCAAkC,EAChC,+DAA+D;AACjE,YAAA,qBAAqB,EAAE,kDAAkD;AACzE,YAAA,2BAA2B,EAAE,wDAAwD;AACrF,YAAA,4BAA4B,EAAE,yDAAyD;AACxF,SAAA;AACF,KAAA;;;AC7EH;AAKA;AAEA;AAEA;;;AAGG;AACI,MAAM,0BAA0B,GAAsB;AAC3D,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,OAAO,EAAE,OAAO;AAChB,IAAA,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AAC9B,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,IAAI,EAAE,UAAU;AAChB,IAAA,MAAM,EAAE,UAAU;AAClB,IAAA,QAAQ,EAAE,IAAI;;;AAKhB;;AC1BA;AACO,MAAM,oCAAoC,GAAG;;ACDpD;AACO,MAAM,uCAAuC,GAAG;;ACDvD;AAEA;;;AAGG;IACS;AAAZ,CAAA,UAAY,kBAAkB,EAAA;AAC5B,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,GAAA,EAAA,CAAA,CAAA;AAM9B;;ACZA;AAEA;;AAEG;IACS;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACjB,IAAA,qBAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,eAAA,CAAA,GAAA,iBAAiC;AACjC,IAAA,qBAAA,CAAA,mBAAA,CAAA,GAAA,oBAAwC;AAC1C,CAAC,EARW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;AAUjC;;ACZA;AAEA,MAAM,qBAAqB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,OAAO,EAAE,SAAS;AAClB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,SAAS,EAAE,WAAW;CACd;AAEV;;;AAGG;AACG,SAAU,4BAA4B,CAAC,KAG5C,EAAA;AACC,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;IACpC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAW;AAExE,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE;QAC/C,OAAO,qBAAqB,CAAC,OAAO;IACtC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE;QACjD,OAAO,qBAAqB,CAAC,SAAS;IACxC;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,iBAAiB;IAChD;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,aAAa;IAC5C;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE;QAC9C,OAAO,qBAAqB,CAAC,MAAM;IACrC;IACA,OAAO,qBAAqB,CAAC,MAAM;AACrC;AAEA;;AChDA;AAYA;;ACZA;AA4BO,MAAM,gCAAgC,GAAG;AAC9C,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,WAAW,EAAE,cAAc;AAC3B,IAAA,aAAa,EAAE,gBAAgB;;AAWjC;;;AAGG;AACI,MAAM,qDAAqD,GAChE;AAEF;AACO,MAAM,yCAAyC,GAAG;AAEzD;;ACpDA;AAsBA;AAEA;AAEA,SAAS,eAAe,CAAC,KAAc,EAAA;AACrC,IAAA,MAAM,EAAE,GAAG,4BAA4B,CAAC,KAAK,CAAC;IAC9C,OAAO,EAAE,IAAI,SAAS;AACxB;AAEM,SAAU,uBAAuB,CACrC,IAAgD,EAAA;IAEhD,MAAM,KAAK,GACT,IAAI,EAAE,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK;UACxC,IAAI,CAAC;UACN,SAAS;IACf,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC;QAC9C,aAAa,EAAE,eAAe,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;KACzD;AACH;AAEA,SAAS,YAAY,CAAC,IAAgD,EAAA;IACpE,MAAM,KAAK,GACT,IAAI,EAAE,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK;UACxC,IAAI,CAAC;UACN,SAAS;AACf,IAAA,OAAO,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI;AACrC;AAEA;;;;;;AAMG;SACa,yBAAyB,CACvC,IAAqE,EACrE,IAAiC,EACjC,OAAkC,EAAA;AAElC,IAAA,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE;AACtB,QAAA,OAAO,KAAK;IACd;IAEA,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE;AACb,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE;AAClD,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,IAAI,IAAI,KAAK,QAAQ,EAAE;AACrB,QAAA,OAAO,CAAC,KAAK,CAAC,aAAa;IAC7B;IAEA,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;IAC5D,IAAI,CAAC,aAAa,EAAE;AAClB,QAAA,OAAO,KAAK;IACd;AACA,IAAA,OAAO,KAAK,CAAC,aAAa,KAAK,aAAa;AAC9C;AAEA;;;;AAIG;AACG,SAAU,sCAAsC,CACpD,IAAqE,EACrE,OAAkC,EAAA;AAElC,IAAA,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE;AACtB,QAAA,OAAO,KAAK;IACd;IAEA,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;AAC5D,IAAA,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE;AAC/B,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa;AAC7E;AAEA;;AChHA;AAQA;AAEA;AAEA,SAASA,QAAM,CAAC,KAAc,EAAA;AAC5B,IAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,QAAA,OAAO,KAAK,CAAC,IAAI,EAAE;IACrB;AACA,IAAA,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACtC,QAAA,MAAM,EAAE,GAAI,KAA0B,CAAC,EAAE;AACzC,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,EAAE,CAAC,IAAI,EAAE;QAClB;AACA,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB;AACA,QAAA,OAAO,EAAE;IACX;AACA,IAAA,OAAO,KAAK,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE;AAClD;AAEA,SAASC,aAAW,CAAC,KAAc,EAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AACzB,QAAA,OAAO,EAAE;IACX;IACA,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAKD,QAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE;AAEA;;;;;AAKG;AACG,SAAU,yCAAyC,CACvD,IAAa,EAAA;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AACxB,QAAA,OAAO,EAAE;IACX;AAEA,IAAA,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB;AAC5C,IAAA,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;YACnC;QACF;QACA,MAAM,MAAM,GAAG,GAA8B;QAC7C,MAAM,aAAa,GAAGA,QAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE;YAClB;QACF;AACA,QAAA,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,GAAG,EAAU;QAC5D,KAAK,MAAM,MAAM,IAAIC,aAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;AACnD,YAAA,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB;AACA,QAAA,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;IAClC;AAEA,IAAA,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7D,aAAa;AACb,QAAA,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;AACtB,KAAA,CAAC,CAAC;AACL;AAEM,SAAU,uCAAuC,CACrD,WAA0D,EAAA;AAE1D,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACvE,IAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE;AACpC;AAEA;;AChFA;AAQA;AAEA;AAEA,SAAS,MAAM,CAAC,KAAc,EAAA;AAC5B,IAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,QAAA,OAAO,KAAK,CAAC,IAAI,EAAE;IACrB;AACA,IAAA,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACtC,QAAA,MAAM,EAAE,GAAI,KAA0B,CAAC,EAAE;AACzC,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,EAAE,CAAC,IAAI,EAAE;QAClB;AACA,QAAA,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;AAC1B,YAAA,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB;AACA,QAAA,OAAO,EAAE;IACX;AACA,IAAA,OAAO,KAAK,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE;AAClD;AAEA,SAAS,WAAW,CAAC,KAAc,EAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AACzB,QAAA,OAAO,EAAE;IACX;IACA,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE;AAEA;;;;AAIG;AACG,SAAU,yCAAyC,CACvD,IAAa,EAAA;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AACxB,QAAA,OAAO,EAAE;IACX;AAEA,IAAA,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB;AAC5C,IAAA,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;YACnC;QACF;QACA,MAAM,MAAM,GAAG,GAA8B;QAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE;YAClB;QACF;AACA,QAAA,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,GAAG,EAAU;QAC5D,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;AACnD,YAAA,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB;AACA,QAAA,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;IAClC;AAEA,IAAA,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7D,aAAa;AACb,QAAA,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;AACtB,KAAA,CAAC,CAAC;AACL;AAEM,SAAU,uCAAuC,CACrD,WAA0D,EAAA;AAE1D,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACvE,IAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE;AACpC;AAEA;;AC/EA;AAEO,MAAM,mCAAmC,GAAG;AACjD,IAAA,sBAAsB,EAAE,kDAAkD;AAC1E,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,oBAAoB,EAAE,gDAAgD;AACtE,IAAA,UAAU,EAAE,sCAAsC;;AAElD,IAAA,8BAA8B,EAAE,0DAA0D;;AAE1F,IAAA,yBAAyB,EAAE,qDAAqD;AAChF,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,uBAAuB,EAAE,mDAAmD;AAC5E,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,0BAA0B,EAAE,sDAAsD;AAClF,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,8BAA8B,EAAE,0DAA0D;AAC1F,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,mBAAmB,EAAE,+CAA+C;;AAEpE,IAAA,oBAAoB,EAAE,gDAAgD;;AAGxE;AACO,MAAM,mCAAmC,GAAG;AACjD,IAAA,WAAW,EAAE,mCAAmC;AAChD,IAAA,gBAAgB,EAAE,uCAAuC;AACzD,IAAA,aAAa,EAAE,qCAAqC;AACpD,IAAA,YAAY,EAAE,mCAAmC;;AAGnD;AACO,MAAM,oCAAoC,GAAG;AAEpD;AACO,MAAM,iCAAiC,GAAG;AAEjD;AACO,MAAM,uBAAuB,GAAG;AAChC,MAAM,kCAAkC,GAAG;AAC3C,MAAM,kCAAkC,GAAG;AAC3C,MAAM,qCAAqC,GAAG;AAC9C,MAAM,oCAAoC,GAAG;AAC7C,MAAM,iCAAiC,GAAG;AAqGjD;AACO,MAAM,iCAAiC,GAAG;AAC/C,IAAA,OAAO,EAAE,2BAA2B;AACpC,IAAA,OAAO,EAAE,2BAA2B;AACpC,IAAA,gBAAgB,EAAE,qCAAqC;;AA0CzD;AACO,MAAM,4BAA4B,GAAG;AAC1C,IAAA,WAAW,EAAE,4BAA4B;AACzC,IAAA,YAAY,EAAE,4BAA4B;AAC1C,IAAA,cAAc,EAAE,+BAA+B;AAC/C,IAAA,aAAa,EAAE,6BAA6B;AAC5C,IAAA,aAAa,EAAE,6BAA6B;AAC5C,IAAA,eAAe,EAAE,wBAAwB;AACzC,IAAA,UAAU,EAAE,0BAA0B;;AA2FxC;AACO,MAAM,0BAA0B,GAAG;AACxC,IAAA,WAAW,EAAE,0BAA0B;AACvC,IAAA,YAAY,EAAE,0BAA0B;AACxC,IAAA,iBAAiB,EAAE,+BAA+B;AAClD,IAAA,aAAa,EAAE,2BAA2B;AAC1C,IAAA,cAAc,EAAE,4BAA4B;AAC5C,IAAA,UAAU,EAAE,wBAAwB;AACpC,IAAA,iBAAiB,EAAE,+BAA+B;AAClD,IAAA,gBAAgB,EAAE,8BAA8B;AAChD,IAAA,WAAW,EAAE,yBAAyB;AACtC,IAAA,oBAAoB,EAAE,kCAAkC;AACxD,IAAA,aAAa,EAAE,2BAA2B;AAC1C,IAAA,YAAY,EAAE,2BAA2B;AACzC,IAAA,SAAS,EAAE,sBAAsB;;AAuEnC;;AClYA;AAEA;AACO,MAAM,6BAA6B,GAAG;AAC3C;;;AAGG;AACH,IAAA,oBAAoB,EAAE,kDAAkD;;AAGnE,MAAM,uBAAuB,GAAG;AACrC,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,IAAI,EAAE,MAAM;;AAKd;AACO,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;AAE1E;;ACtBA;AAgBA;AAEO,MAAM,oCAAoC,GAAG;AAIpD;AAEO,MAAM,qCAAqC,GAAG;AAIrD;AAEO,MAAM,uCAAuC,GAAG;AAIjD,SAAU,gCAAgC,CAE9C,KAAc,EAAA;IAId,OAAO,KAAK,KAAK,QAAQ,GAAG,QAAQ,GAAG,aAAa;AAEtD;AAIA;;IC7CY;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;;ACDjC;AAEA;;;AAGG;AACI,MAAM,8BAA8B,GAAG;AAC5C,IAAA,IAAI,EAAE,MAAM;AACZ,IAAA,SAAS,EAAE,WAAW;;AA2DxB;;ACrCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACtEA;AAeA;;ACfA;AAeA;;ACeA;;AC1BA;;;AAGG;AACI,eAAe,oBAAoB,GAAA;AACxC,IAAA,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI;AAEnC,IAAA,MAAM,SAAS,GAAc;AAC3B,QAAA,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC9B,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI;AAC5C,QAAA,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK;AAC9C,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI;QAC5C,UAAU,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,wBAAwB,CAAC;AACpF,QAAA,OAAO,EAAE;AACP,YAAA,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK;AACnD,YAAA,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW;AACrD,YAAA,YAAY,EAAE;AACZ,gBAAA,KAAK,EAAE,cAAc;AACrB,gBAAA,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AACrC,aAAA;AACF,SAAA;AACD,QAAA,MAAM,EAAE;AACN,YAAA;AACE,gBAAA,EAAE,EAAE,YAAY;AAChB,gBAAA,KAAK,EAAE,CAAA,mCAAA,CAAqC;AAC7C,aAAA;AACF,SAAA;AACD,QAAA,UAAU,EAAE;AACV,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,qCAAA,CAAuC;AACtD,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI;AAC5B,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,oCAAA,CAAsC;AACrD,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI;AAC5B,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,yCAAA,CAA2C;AAC1D,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,UAAU;AACpB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,QAAQ;AAChC,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACF,aAAA;AACF,SAAA;AACD,QAAA,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzE,QAAA,UAAU,EAAE;AACV,YAAA,MAAM,EAAE;AACN,gBAAA,MAAM,EAAE;AACN,oBAAA,KAAK,EAAE,cAAc;AACrB,oBAAA,QAAQ,EAAE;AACR,wBAAA;AACE,4BAAA,EAAE,EAAE,YAAY;AAChB,4BAAA,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE;AAC/C,yBAAA;AACF,qBAAA;AACD,oBAAA,UAAU,EAAE;AACV,wBAAA,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACjE,wBAAA,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACjE,wBAAA,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACtE,qBAAA;AACD,oBAAA,OAAO,EAAE,EAAE;AACZ,iBAAA;AACD,gBAAA,IAAI,EAAE;AACJ,oBAAA,OAAO,EAAE,CAAC,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpF,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9E,iBAAA;AACF,aAAA;AACF,SAAA;KACF;AAED,IAAA,OAAO,SAAS;AAClB;;AClGA;AAWA;AAEA;AAEA,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,oBAAoB;AAEhF;;;;AAIG;AACH,SAAS,4BAA4B,CAAC,IAA6B,EAAA;IACjE,OAAO,CAAA,0BAAA,EAA6B,qBAAqB,CAAA,mCAAA,EAAsC,qBAAqB,YAAY,kCAAkC,CAAA,QAAA,EAAW,IAAI,CAAA,IAAA,CAAM;AACzL;AAEA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;AAEvG,SAAS,aAAa,CAAC,MAAuB,EAAA;IAC5C,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,GAAG,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI;AACnF;AAEA;AACM,SAAU,4BAA4B,CAAC,MAAuB,EAAA;IAClE,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,SAAS,EAAE;AACpD,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE;AACtD,QAAA,OAAO,IAAI;IACb;IACA,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAChG;AAEA,SAAS,kBAAkB,CAAC,KAQ3B,EAAA;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;AAChB,QAAA,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,mBAAmB,CAAC,MAAM;QAChC,KAAK,EAAE,qBAAqB,CAAC,SAAS;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK;AAClB,QAAA,MAAM,EAAE,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC;KACjD;AACH;AAEA;;;AAGG;SACa,2BAA2B,GAAA;IACzC,OAAO;AACL,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,+BAA+B;AACtC,YAAA,IAAI,EAAE,uBAAuB;AAC7B,YAAA,OAAO,EAAE,iCAAiC;AAC1C,YAAA,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,uBAAuB,CAAC,MAAM;AACpC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;AACF,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,+DAA+D;AACtE,YAAA,IAAI,EAAE,sBAAsB;AAC5B,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,uBAAuB,CAAC,MAAM;AACpC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;AACF,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,4BAA4B;AAClC,YAAA,KAAK,EAAE,+DAA+D;AACtE,YAAA,IAAI,EAAE,sBAAsB;AAC5B,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,uBAAuB,CAAC,IAAI;AAClC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;AACF,QAAA,kBAAkB,CAAC;AACjB,YAAA,IAAI,EAAE,4BAA4B;AAClC,YAAA,KAAK,EAAE,yEAAyE;AAChF,YAAA,IAAI,EAAE,uBAAuB;AAC7B,YAAA,OAAO,EAAE,iCAAiC;AAC1C,YAAA,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,uBAAuB,CAAC,IAAI;AAClC,YAAA,KAAK,EAAE,CAAC;SACT,CAAC;KACH;AACH;AAEA;;AC9GA;;ACAA;;AAEG;;"}