npm - @andrewcaires/api - Versions diffs - 5.3.2 → 5.3.4 - Mend

@andrewcaires/api 5.3.2 → 5.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/index.cjs.js CHANGED Viewed

@@ -1,7 +1,7 @@
 /*!
- * @andrewcaires/api v5.3.2
+ * @andrewcaires/api v5.3.4
  * Simple api for small applications using express, jsonwebtoken, sequelize and websocket
  * (c) 2026 Andrew Caires
  * @license: MIT
  */
-"use strict";var e,t=require("@andrewcaires/express"),r=require("@andrewcaires/node"),o=require("@andrewcaires/utils.js"),i=require("ws"),s=require("@andrewcaires/sequelize"),n=require("dotenv"),d=require("@andrewcaires/decorator"),a=require("express-session"),l=require("jsonwebtoken"),p=require("@node-rs/argon2"),u=require("fs"),c=require("path");function g(e,t,r,o){var i,s=arguments.length,n=s<3?t:null===o?o=Object.getOwnPropertyDescriptor(t,r):o;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)n=Reflect.decorate(e,t,r,o);else for(var d=e.length-1;d>=0;d--)(i=e[d])&&(n=(s<3?i(n):s>3?i(t,r,n):i(t,r))||n);return s>3&&n&&Object.defineProperty(t,r,n),n}function v(e,t){return function(r,o){t(r,o,e)}}function h(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function m(e,t,r,o){return new(r||(r=Promise))(function(i,s){function n(e){try{a(o.next(e))}catch(e){s(e)}}function d(e){try{a(o.throw(e))}catch(e){s(e)}}function a(e){var t;e.done?i(e.value):(t=e.value,t instanceof r?t:new r(function(e){e(t)})).then(n,d)}a((o=o.apply(e,t||[])).next())})}"function"==typeof SuppressedError&&SuppressedError,n.config({quiet:!0});class Env extends r.Env{}e=Env,Env.BASE_NAME=e.getString("BASE_NAME",""),Env.CONSOLE_ERROR=e.getBool("CONSOLE_ERROR",!1),Env.DATABASE_URI=e.getString("DATABASE_URI","",!0),Env.DATABASE_LOG=e.getBool("DATABASE_LOG",!1),Env.DATABASE_AUDIT=e.getBool("DATABASE_AUDIT",!0),Env.DATABASE_PREFIX=e.getString("DATABASE_PREFIX",""),Env.DATABASE_TIMEZONE=e.getString("DATABASE_TIMEZONE","+00:00"),Env.HTTP_CROSS=e.getString("HTTP_CROSS",""),Env.HTTP_PORT=e.getInt("HTTP_PORT",e.getInt("PORT",3e3)),Env.HTTP_PUBLIC=e.getString("HTTP_PUBLIC",""),Env.HTTP_TLS_CA=e.getFile("HTTP_TLS_CA"),Env.HTTP_TLS_CRT=e.getFile("HTTP_TLS_CRT"),Env.HTTP_TLS_KEY=e.getFile("HTTP_TLS_KEY"),Env.KEY_HEADER=e.getString("KEY_HEADER","x-api-key"),Env.MODEL_LIMIT=e.getInt("MODEL_LIMIT",10),Env.MODEL_LIMIT_MAX=e.getInt("MODEL_LIMIT_MAX",100),Env.MCP_ALLOWED_ORIGINS=e.getString("MCP_ALLOWED_ORIGINS",""),Env.MCP_RATE_LIMIT_MAX=e.getInt("MCP_RATE_LIMIT_MAX",120),Env.MCP_RATE_LIMIT_WINDOW=e.getMs("MCP_RATE_LIMIT_WINDOW","1m"),Env.MCP_SESSION_TTL=e.getMs("MCP_SESSION_TTL","30m"),Env.PASSWORD_ALGORITHM=e.getInt("PASSWORD_ALGORITHM",2),Env.PASSWORD_MEMORY_COST=e.getInt("PASSWORD_MEMORY_COST",4096),Env.PASSWORD_PARALLELISM=e.getInt("PASSWORD_PARALLELISM",1),Env.PASSWORD_PEPPER=e.getString("PASSWORD_PEPPER",""),Env.PASSWORD_TIME_COST=e.getInt("PASSWORD_TIME_COST",3),Env.SLEEP_AUTH=e.getMs("SLEEP_AUTH","2s"),Env.SLEEP_FORGOT=e.getMs("SLEEP_FORGOT","5s"),Env.SLEEP_REGISTRY=e.getMs("SLEEP_REGISTRY","5s"),Env.TENANT_HEADER=e.getString("TENANT_HEADER","x-tenant-id"),Env.TOKEN_CRT=e.getFile("TOKEN_CRT"),Env.TOKEN_HEADER=e.getString("TOKEN_HEADER","authorization"),Env.TOKEN_KEY=e.getFile("TOKEN_KEY"),Env.TOKEN_TTL=e.getMs("TOKEN_TTL","1d"),Env.TOKEN_TTL_FORGOT=e.getMs("TOKEN_TTL_FORGOT","1d"),Env.TOKEN_TTL_RENEW=e.getMs("TOKEN_TTL_RENEW","1d"),Env.TOKEN_TYPE=e.getString("TOKEN_TYPE","bearer"),Env.API_BODYPARSER_STRICT=e.getBool("API_BODYPARSER_STRICT",!0),Env.API_BODYPARSER_INFLATE=e.getBool("API_BODYPARSER_INFLATE",!0),Env.API_BODYPARSER_LIMIT=e.getString("API_BODYPARSER_LIMIT","10mb"),Env.API_BODYPARSER_TYPE=e.getString("API_BODYPARSER_TYPE","json"),Env.API_HTTP_HYBRID=e.getBool("API_HTTP_HYBRID",!1),Env.API_HTTP_NOTFOUND=e.getString("API_HTTP_NOTFOUND",""),Env.API_HTTP_PATH=e.getString("API_HTTP_PATH","/api"),Env.API_HTTP_REDIRECT=e.getString("API_HTTP_REDIRECT",""),Env.API_KEY_HASH=e.getString("API_KEY_HASH",""),Env.API_SESSION_NAME=e.getString("API_SESSION_NAME","session.id"),Env.API_SESSION_LIFETIME=e.getMs("API_SESSION_LIFETIME","1d"),Env.API_SESSION_SECRET=e.getString("API_SESSION_SECRET","yoursecret"),Env.API_TOKEN_COOKIE=e.getString("API_TOKEN_COOKIE","authorization"),Env.API_TOKEN_COOKIE_SET=e.getBool("API_TOKEN_COOKIE_SET",!0),Env.API_USER_HISTORY=e.getBool("API_USER_HISTORY",!0),Env.API_WEBSOCKET_START=e.getBool("API_WEBSOCKET_START",!1);const y=new s.Sequelize({uri:Env.DATABASE_URI,logging:!!Env.DATABASE_LOG&&(e=>r.Log.console(r.LogColor.Magenta,"sql",e)),prefix:Env.DATABASE_PREFIX,timezone:Env.DATABASE_TIMEZONE});var x,E,C,M,f;exports.AuditTypes=void 0,(x=exports.AuditTypes||(exports.AuditTypes={})).CREATE="CREATE",x.DELETE="DELETE",x.UPDATE="UPDATE",exports.GroupTypes=void 0,(E=exports.GroupTypes||(exports.GroupTypes={})).SYSTEM="system",E.TENANT="tenant",exports.LogLevels=void 0,(C=exports.LogLevels||(exports.LogLevels={})).INFO="info",C.WARN="warn",C.ERROR="error",exports.TenantStatus=void 0,(M=exports.TenantStatus||(exports.TenantStatus={})).ACTIVE="active",M.PENDING="pending",M.SUSPENDED="suspended",M.DISABLED="disabled",M.ARCHIVED="archived",exports.UserStatus=void 0,(f=exports.UserStatus||(exports.UserStatus={})).ACTIVE="active",f.PENDING="pending",f.DISABLED="disabled",f.LOCKED="locked",f.ARCHIVED="archived";const S=e=>r=>(i,s,n)=>{t.Use(i=>m(void 0,void 0,void 0,function*(){var s;o.isUndefined(r)&&(r=o.isFunction(i.controller.name)?i.controller.name():null===(s=i.controller.constructor)||void 0===s?void 0:s.name);const{permissions:n=[]}=i.req;if(n.includes(`${r}.${e}`))return i.next();i.error(new t.UnauthorizedError("Access Denied"))}))(i,s,n)},A=S("create"),_=S("delete"),T=S("read"),O=S("update"),P=()=>(e,r,o)=>{t.Use(e=>m(void 0,void 0,void 0,function*(){yield(e=>m(void 0,void 0,void 0,function*(){var r,o,i,s;if(e.req.auth&&e.req.user)return e.next();const{[Env.KEY_HEADER]:n,[Env.TOKEN_HEADER]:d,[Env.TENANT_HEADER]:a,"user-agent":l}=e.getHeaders(),p=e.getQuery(Env.KEY_HEADER),u=(null===(r=n||p)||void 0===r?void 0:r.toString())||"";let c=e.getCookie(Env.API_TOKEN_COOKIE);c=`${Env.TOKEN_TYPE} ${c}`;const[g,v]=null!==(i=null===(o=d||c)||void 0===o?void 0:o.split(" "))&&void 0!==i?i:["",""];if(!(u||v&&g.toLowerCase()==Env.TOKEN_TYPE))return e.error(new t.UnauthorizedError("Invalid token"));const{authService:h,userService:m}=e.app,{auth:y,user:x}=null!==(s=yield(u?h.key(u.toString()):h.user(v)).catch(t=>{e.error(t)}))&&void 0!==s?s:{};if(!y||!x)return;if(!u&&y.user_agent&&y.user_agent!=l)return e.error(new t.UnauthorizedError("Invalid token"));e.req.auth=y,e.req.user=x;const E=a||null,C=yield m.getTenants(x.id);if(E&&!C.find(e=>e.id==E))return e.error(new t.UnauthorizedError("Invalid token"));const M=m.getGroups(x.id,E),f=m.getPermissions(x.id,E),[S,A]=yield Promise.all([M,f]);e.req.groups=S,e.req.permissions=A,e.req.tenants=C,e.next()}))(e)}))(e,r,o)},b=t.parameterFactory(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.auth}),I=t.parameterFactory(({ctx:e,key:t})=>{var r,o;return(null!==(o=null===(r=e.req)||void 0===r?void 0:r.groups)&&void 0!==o?o:[]).includes(t)}),w=t.parameterFactory(({ctx:e})=>{var t,r;return null!==(r=null===(t=e.req)||void 0===t?void 0:t.groups)&&void 0!==r?r:[]}),R=t.parameterFactory(({ctx:e,key:t})=>{var r,o;return(null!==(o=null===(r=e.req)||void 0===r?void 0:r.permissions)&&void 0!==o?o:[]).includes(t)}),U=t.parameterFactory(({ctx:e})=>{var t,r;return null!==(r=null===(t=e.req)||void 0===t?void 0:t.permissions)&&void 0!==r?r:[]}),D=t.parameterFactory(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.user}),j={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,ServerError:-32e3,InvalidSession:-32001};class McpError extends t.ResponseError{constructor(e,t=j.ServerError,r=200,o){super(e,r),this.code=t,this.data=o,this.name=this.constructor.name}}class McpParseError extends McpError{constructor(e="Parse error",t){super(e,j.ParseError,400,t)}}class McpInvalidRequestError extends McpError{constructor(e="Invalid Request",t){super(e,j.InvalidRequest,400,t)}}class McpMethodNotFoundError extends McpError{constructor(e){super(`Method not found: ${e}`,j.MethodNotFound,200)}}class McpInvalidParamsError extends McpError{constructor(e="Invalid params",t){super(e,j.InvalidParams,200,t)}}class McpServerError extends McpError{constructor(e="Server error",t){super(e,j.ServerError,500,t)}}class McpInvalidSessionError extends McpError{constructor(e="Invalid MCP session",t=404){super(e,j.InvalidSession,t)}}class McpToolNotFoundError extends McpError{constructor(e){super("Tool not found",j.InvalidParams,200,{toolName:e})}}const N=e=>o.isString(e)||o.isNumber(e),L=(e,t)=>({jsonrpc:"2.0",id:e,result:t}),V=(e,t)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t.code,message:t.message},void 0!==t.data?{data:t.data}:{})}),F=e=>{if(!o.isPlainObject(e))throw new McpInvalidRequestError("Invalid Request");if("2.0"!==e.jsonrpc)throw new McpInvalidRequestError("Invalid JSON-RPC version");if(!o.isString(e.method))throw new McpInvalidRequestError("Invalid method");if(void 0!==e.id&&!N(e.id))throw new McpInvalidRequestError("Invalid id");return e},H=["2025-11-25","2025-06-18"],B=H[0],G="MCP-Protocol-Version",q="MCP-Session-Id",k=["POST","DELETE","OPTIONS"],K=k.join(", "),z=e=>{if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode};class McpHttpHandler{constructor(e){var t,r,o;this.sessions=e.sessions,this.tools=e.tools,this.allowedOrigins=null!==(t=e.allowedOrigins)&&void 0!==t?t:[],this.logger=e.logger,this.serverName=null!==(r=e.serverName)&&void 0!==r?r:"andrewcaires-api-mcp",this.serverVersion=null!==(o=e.serverVersion)&&void 0!==o?o:"1.0.0"}post(e){return m(this,void 0,void 0,function*(){var t;const r=this.validateOrigin(e);if(r)return r;let o=null;try{const r=F(e.body);if(o=null!==(t=r.id)&&void 0!==t?t:null,"initialize"===r.method)return this.withTransportHeaders(this.initialize(r.id,r.params,e),e);if("notifications/initialized"===r.method)return this.withTransportHeaders(this.initialized(r.id,r.params,e),e);if("ping"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withSession(r.id,e,e=>({status:200,body:L(e,{})})),e);if("tools/list"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withInitializedSession(r.id,e,e=>({status:200,body:L(e,{tools:this.tools.list()})})),e);if("tools/call"===r.method)return this.withTransportHeaders(yield this.callTool(r.id,r.params,e),e);if(void 0===r.id)return this.withTransportHeaders({status:202},e);throw new McpMethodNotFoundError(r.method)}catch(t){return this.withTransportHeaders(this.errorResponse(o,t),e)}})}delete(e){const t=this.validateOrigin(e);if(t)return t;const r=this.getSessionHeader(e);if(!r)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError(`${q} header is required`,400)),e);const o=this.sessions.get(r);if(!o)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError),e);try{this.validateProtocolHeader(e,o.protocolVersion)}catch(t){return this.withTransportHeaders(this.errorResponse(null,t),e)}return this.sessions.delete(r),this.withTransportHeaders({status:204},e)}get(e){const t=this.validateOrigin(e);return t||this.withTransportHeaders({status:405},e)}options(e){const t=this.validateOrigin(e);return t||this.withTransportHeaders({status:204},e)}initialize(e,t,r){const o=this.requireRequestId({jsonrpc:"2.0",id:e,method:"initialize",params:t}),i=this.negotiateProtocolVersion(t),s=this.sessions.create(i,r.context);return{status:200,headers:{[q]:s.sessionId,[G]:s.protocolVersion},body:L(o,{protocolVersion:s.protocolVersion,capabilities:{tools:{listChanged:!1}},serverInfo:{name:this.serverName,version:this.serverVersion}})}}initialized(e,t,r){if(void 0!==e)throw new McpInvalidRequestError("notifications/initialized must not include id");this.validateObjectParams(t);const o=this.requireSession(r);return this.validateProtocolHeader(r,o.protocolVersion),this.sessions.markInitialized(o.sessionId),{status:202}}callTool(e,t,r){return m(this,void 0,void 0,function*(){return this.withInitializedSession(e,r,(e,r)=>m(this,void 0,void 0,function*(){var o;const i=this.parseToolCallParams(t),s=Date.now();let n,d=!1;try{const t=yield this.tools.call(i.name,i.arguments,r);return d=!t.isError,n=t.isError?"Tool execution failed":void 0,{status:200,body:L(e,t)}}catch(e){if(e instanceof McpError)throw n=e.message,e;throw n="Internal error",e}finally{null===(o=this.logger)||void 0===o||o.toolCall(Object.assign({sessionId:r.sessionId,userId:r.userId,toolName:i.name,durationMs:Date.now()-s,success:d},n?{error:n}:{}))}}))})}requireRequestId(e){if(!N(e.id))throw new McpInvalidRequestError("Request id is required");return e.id}withSession(e,t,r){const o=this.requireRequestId({jsonrpc:"2.0",id:e,method:"session"}),i=this.requireSession(t);return this.validateProtocolHeader(t,i.protocolVersion),r(o,i)}withInitializedSession(e,t,r){return this.withSession(e,t,(e,t)=>{if(!t.initialized)throw new McpInvalidRequestError("Session not initialized");return r(e,t)})}requireSession(e){const t=this.getSessionHeader(e);if(!t)throw new McpInvalidSessionError(`${q} header is required`,400);return this.sessions.require(t)}validateProtocolHeader(e,t){const r=this.getHeader(e,"mcp-protocol-version");if(r&&r!==t)throw new McpInvalidRequestError(`Invalid ${G} header`)}negotiateProtocolVersion(e){if(!o.isPlainObject(e)||!o.isString(e.protocolVersion))throw new McpInvalidParamsError("params.protocolVersion is required");return H.includes(e.protocolVersion)?e.protocolVersion:B}parseToolCallParams(e){if(!o.isPlainObject(e)||!o.isString(e.name))throw new McpInvalidParamsError("params.name is required");return{name:e.name,arguments:e.arguments}}validateObjectParams(e){if(void 0!==e&&!o.isPlainObject(e))throw new McpInvalidParamsError("params must be an object")}validateOrigin(e){if(this.getHeader(e,"origin")&&!this.getAllowedOrigin(e))return{status:403}}withTransportHeaders(e,t){var r;return Object.assign(Object.assign({},e),{headers:Object.assign(Object.assign({},this.transportHeaders(t)),null!==(r=e.headers)&&void 0!==r?r:{})})}transportHeaders(e){const t={Allow:K,"Access-Control-Allow-Methods":K,"Access-Control-Allow-Headers":`Content-Type, Accept, ${q}, ${G}`},r=this.getAllowedOrigin(e);return r&&(t["Access-Control-Allow-Origin"]=r),t}getAllowedOrigin(e){const t=this.getHeader(e,"origin");if(!t)return;if(this.allowedOrigins.includes("*"))return"*";if(this.allowedOrigins.includes(t))return t;const r=this.getHeader(e,"host");if(!this.allowedOrigins.length&&r)try{if(new URL(t).host===r)return t}catch(e){return}}getSessionHeader(e){return this.getHeader(e,"mcp-session-id")}getHeader(e,t){var r;return null===(r=Object.entries(e.headers).find(([e])=>e.toLowerCase()===t))||void 0===r?void 0:r[1]}errorResponse(e,t){if(t instanceof McpError)return{status:t.status,body:V(e,t)};const r=new McpServerError;return{status:r.status,body:V(e,r)}}}class McpRateLimiter{constructor(e=120,t=6e4,r=()=>Date.now()){this.entries=new Map,this.max=e,this.windowMs=t,this.now=r}consume(e){if(this.max<=0)return!0;const t=this.now(),r=this.entries.get(e);return!r||r.resetAt<=t?(this.entries.set(e,{count:1,resetAt:t+this.windowMs}),!0):(r.count++,r.count<=this.max)}}class McpSessionStore{constructor(e=18e5,t=()=>Date.now()){this.sessions=new Map,this.ttl=e,this.now=t}create(e,t){this.cleanup();const r=this.now(),i=Object.assign(Object.assign({},t),{sessionId:o.uuidv7(),createdAt:r,expiresAt:r+this.ttl,protocolVersion:e,initialized:!1});return this.sessions.set(i.sessionId,i),i}get(e){this.cleanup();const t=this.sessions.get(e);if(t){if(!this.isExpired(t))return t;this.sessions.delete(e)}}require(e){const t=this.get(e);if(!t)throw new McpInvalidSessionError;return t}markInitialized(e){const t=this.require(e);return t.initialized=!0,t}delete(e){return this.cleanup(),this.sessions.delete(e)}cleanup(){const e=this.now();for(const[t,r]of this.sessions)r.expiresAt<=e&&this.sessions.delete(t)}size(){return this.cleanup(),this.sessions.size}isExpired(e){return e.expiresAt<=this.now()}}const Y=Symbol.for("@andrewcaires/api:mcp:tool"),$=e=>{if(!o.isString(e.name)||!e.name.trim())throw new Error("MCP tool name is required");if(!o.isString(e.title)||!e.title.trim())throw new Error(`MCP tool "${e.name}" title is required`);if(!o.isString(e.description)||!e.description.trim())throw new Error(`MCP tool "${e.name}" description is required`);if(o.isUndefined(e.input))throw new Error(`MCP tool "${e.name}" input must be declared`)};class McpToolRegistry{constructor(e=[]){this.tools=new Map,e.forEach(e=>this.register(e))}register(e){var t,r;if($(e),this.tools.has(e.name))throw new Error(`Duplicate MCP tool name: ${e.name}`);const o=this.normalizeMcpValidation(null!==(t=e.input)&&void 0!==t?t:{},"object"),i=e.output?this.normalizeMcpValidation(null!==(r=e.output)&&void 0!==r?r:{},"any"):void 0;this.tools.set(e.name,{inputSchema:o.schema,inputValidation:o.validation,outputSchema:null==i?void 0:i.schema,outputValidation:null==i?void 0:i.validation,tool:e})}list(){return Array.from(this.tools.values()).map(({tool:e})=>{var t,r,o,i;return Object.assign({name:e.name,title:e.title,description:e.description,inputSchema:null!==(r=null===(t=this.tools.get(e.name))||void 0===t?void 0:t.inputSchema)&&void 0!==r?r:{}},(null===(o=this.tools.get(e.name))||void 0===o?void 0:o.outputSchema)?{outputSchema:null===(i=this.tools.get(e.name))||void 0===i?void 0:i.outputSchema}:{})})}call(e,t,r){return m(this,void 0,void 0,function*(){var i;const s=this.tools.get(e);if(!s)throw new McpToolNotFoundError(e);const n=null!=t?t:{};if(!o.isPlainObject(n))return this.toolInputValidationError(["arguments must be an object"]);const d={session:r,auth:r.auth,groups:r.groups,permissions:r.permissions,profile:r.profile,user:r.user,userId:r.userId};let a=n;const l=this.validateAdditionalProperties(s.inputSchema,n);if(l.length)return this.toolInputValidationError(l);if(s.inputValidation){const e=s.inputValidation.validate(n,d);if(e.error)return this.toolInputValidationError([e.error]);a=null!==(i=e.value)&&void 0!==i?i:{}}try{const e=yield s.tool.run(a,d);if(!s.outputValidation&&this.isCallToolResult(e))return e;let t=e;if(s.outputValidation){const r=s.outputValidation.validate(e,d);if(r.error)return this.outputValidationError();t=r.value}return{content:[{type:"text",text:JSON.stringify(t)}],structuredContent:t}}catch(e){return{isError:!0,content:[{type:"text",text:"Tool execution failed."}]}}})}isCallToolResult(e){return o.isPlainObject(e)&&o.isArray(e.content)}normalizeMcpValidation(e,t="object"){if(o.isValidationShape(e)){const t=o.Validation.object(e).parse();return{schema:t.toSchema(),validation:t}}const r="object"===t?o.Validation.object({}).parse():o.Validation.any();return{schema:r.toSchema(),validation:r}}outputValidationError(){return{isError:!0,content:[{type:"text",text:"Tool output validation failed."}]}}toolInputValidationError(e){return{isError:!0,content:[{type:"text",text:"Invalid tool arguments."}],structuredContent:{errors:e}}}validateAdditionalProperties(e,t){if("object"!==e.type||!1!==e.additionalProperties||!o.isPlainObject(e.properties))return[];const r=Object.keys(e.properties);return Object.keys(t).filter(e=>!r.includes(e)).map(e=>`additional property "${e}" is not allowed`)}}const W=e=>($(e),(t,r)=>{J(r)?r.addInitializer(function(){Q(this.constructor,r.name,e)}):Q(t,r,e)}),J=e=>"object"==typeof e&&null!==e&&"kind"in e&&"method"===e.kind&&"name"in e&&"addInitializer"in e,Q=(e,t,r)=>{const o=d.metadata(Y,e,[]),i=Object.assign(Object.assign({},r),{propertyKey:t});o.some(e=>e.propertyKey===i.propertyKey&&e.name===i.name)||o.push(i)},X=(e,r,o)=>{var i,s,n,d,a,l,p,u,c,g,v;const h=o.ctx instanceof t.Context?o.ctx:null,m=null!==(i=null==h?void 0:h.id)&&void 0!==i?i:null,y=null!==(a=null!==(d=null===(n=null===(s=null==h?void 0:h.req)||void 0===s?void 0:s.user)||void 0===n?void 0:n.id)&&void 0!==d?d:o.user_id)&&void 0!==a?a:null,x={type:e,model:null!==(l=null==r?void 0:r.getTableName())&&void 0!==l?l:null,source:null!==(p=Env.BASE_NAME)&&void 0!==p?p:"",request_id:m,user_id:y};return h?Object.assign(Object.assign({},x),{full_url:null!==(u=h.getUrl())&&void 0!==u?u:"",ip_address:null!==(c=h.getIp())&&void 0!==c?c:"",user_agent:null!==(v=null===(g=h.req)||void 0===g?void 0:g.headers["user-agent"])&&void 0!==v?v:""}):x},Z=e=>{const t=o.getConstructor(e),r=t.primaryKeyAttribute;return{model:t,record_id:r?e.getDataValue(r):null}},ee={afterCreate:(e,t)=>m(void 0,void 0,void 0,function*(){const{model:o,record_id:i}=Z(e);yield exports.AuditModel.create(Object.assign(Object.assign({},X(exports.AuditTypes.CREATE,o,t)),{record:i,currently:e.toJSON()})).catch(r.Log.catch)}),afterUpdate:(e,t)=>m(void 0,void 0,void 0,function*(){const{model:o,record_id:i}=Z(e),s={},n={},d=e.changed();d&&d.length&&d.forEach(t=>{s[t]=e.getDataValue(t),n[t]=e.previous(t)}),yield exports.AuditModel.create(Object.assign(Object.assign({},X(exports.AuditTypes.UPDATE,o,t)),{record:i,currently:s,previously:n})).catch(r.Log.catch)}),afterDestroy:(e,t)=>m(void 0,void 0,void 0,function*(){const{model:o,record_id:i}=Z(e);yield exports.AuditModel.create(Object.assign(Object.assign({},X(exports.AuditTypes.DELETE,o,t)),{record:i,currently:e.toJSON()})).catch(r.Log.catch)})},te=e=>(o.isUndefined(e)&&(e=Env.DATABASE_AUDIT),s.Hooks(e?ee:{}));exports.RegisterModel=class RegisterModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.RegisterModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.RegisterModel.prototype,"secret",void 0),g([s.Column.FullDate(),h("design:type",Number)],exports.RegisterModel.prototype,"expired_at",void 0),g([s.Column.Boolean(),h("design:type",Boolean)],exports.RegisterModel.prototype,"active",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.RegisterModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.RegisterModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.RegisterModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.RegisterModel.prototype,"user_id",void 0),exports.RegisterModel=g([s.Database(y),s.ModelName("register"),s.Version("5.3.1")],exports.RegisterModel),exports.UserAuthModel=class UserAuthModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.UserAuthModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.UserAuthModel.prototype,"secret",void 0),g([s.Column.String(),h("design:type",String)],exports.UserAuthModel.prototype,"ip_address",void 0),g([s.Column.String(),h("design:type",String)],exports.UserAuthModel.prototype,"user_agent",void 0),g([s.Column.FullDate(),h("design:type",Object)],exports.UserAuthModel.prototype,"revoked_at",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.UserAuthModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.UserAuthModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.UserAuthModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.UserAuthModel.prototype,"user_id",void 0),exports.UserAuthModel=g([s.Database(y),s.ModelName("users_auth"),s.Version("5.3.1")],exports.UserAuthModel),exports.PermissionModel=class PermissionModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.PermissionModel.prototype,"id",void 0),g([s.Column.String(),s.Index(),h("design:type",String)],exports.PermissionModel.prototype,"name",void 0),g([s.Column.Text(),h("design:type",String)],exports.PermissionModel.prototype,"description",void 0),g([s.Column.Boolean(),h("design:type",Boolean)],exports.PermissionModel.prototype,"active",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),h("design:type",Object)],exports.PermissionModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.PermissionModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.PermissionModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.PermissionModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.GroupPermissionModel),h("design:type",Array)],exports.PermissionModel.prototype,"groups_permissions",void 0),exports.PermissionModel=g([s.Database(y),s.ModelName("permission"),te(),s.Version("5.3.1")],exports.PermissionModel),exports.GroupPermissionModel=class GroupPermissionModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.GroupPermissionModel.prototype,"id",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.GroupPermissionModel.prototype,"created_at",void 0),g([s.Association.BelongsTo(()=>exports.GroupModel),h("design:type",String)],exports.GroupPermissionModel.prototype,"group_id",void 0),g([s.Association.BelongsTo(()=>exports.PermissionModel),h("design:type",String)],exports.GroupPermissionModel.prototype,"permission_id",void 0),exports.GroupPermissionModel=g([s.Database(y),s.ModelName("groups_permissions"),te(),s.Version("5.3.1")],exports.GroupPermissionModel),exports.GroupModel=class GroupModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.GroupModel.prototype,"id",void 0),g([s.Column.String(),s.Index(),h("design:type",String)],exports.GroupModel.prototype,"name",void 0),g([s.Column.Text(),h("design:type",String)],exports.GroupModel.prototype,"description",void 0),g([s.Column.Enum(exports.GroupTypes),s.DefaultValue(exports.GroupTypes.SYSTEM),h("design:type",String)],exports.GroupModel.prototype,"type",void 0),g([s.Column.Boolean(),h("design:type",Boolean)],exports.GroupModel.prototype,"active",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),h("design:type",Object)],exports.GroupModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.GroupModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.GroupModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.GroupModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.UserGroupModel),h("design:type",Array)],exports.GroupModel.prototype,"users_groups",void 0),g([s.Association.HasMany(()=>exports.GroupPermissionModel),h("design:type",Array)],exports.GroupModel.prototype,"groups_Permission",void 0),exports.GroupModel=g([s.Database(y),s.ModelName("group"),te(),s.Version("5.3.1")],exports.GroupModel),exports.UserTenantModel=class UserTenantModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.UserTenantModel.prototype,"id",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.UserTenantModel.prototype,"created_at",void 0),g([s.Association.BelongsTo(()=>exports.TenantModel),h("design:type",String)],exports.UserTenantModel.prototype,"tenant_id",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.UserTenantModel.prototype,"user_id",void 0),exports.UserTenantModel=g([s.Database(y),s.ModelName("users_tenants"),te(),s.Version("5.3.1")],exports.UserTenantModel),exports.TenantModel=class TenantModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.TenantModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.TenantModel.prototype,"name",void 0),g([s.Column.Enum(exports.TenantStatus),s.DefaultValue(exports.TenantStatus.ACTIVE),h("design:type",String)],exports.TenantModel.prototype,"status",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),h("design:type",Object)],exports.TenantModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.TenantModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.TenantModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.TenantModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.UserTenantModel),h("design:type",Array)],exports.TenantModel.prototype,"users_tenants",void 0),exports.TenantModel=g([s.Database(y),s.ModelName("tenant"),te(),s.Version("5.3.1")],exports.TenantModel),exports.UserGroupModel=class UserGroupModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.UserGroupModel.prototype,"id",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.UserGroupModel.prototype,"created_at",void 0),g([s.Association.BelongsTo(()=>exports.GroupModel),h("design:type",String)],exports.UserGroupModel.prototype,"group_id",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.UserGroupModel.prototype,"user_id",void 0),g([s.Association.BelongsTo(()=>exports.TenantModel),h("design:type",String)],exports.UserGroupModel.prototype,"tenant_id",void 0),exports.UserGroupModel=g([s.Database(y),s.ModelName("users_groups"),te(),s.Version("5.3.1")],exports.UserGroupModel),exports.UserPasswordModel=class UserPasswordModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.UserPasswordModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.UserPasswordModel.prototype,"hash",void 0),g([s.Column.FullDate(),h("design:type",Object)],exports.UserPasswordModel.prototype,"revoked_at",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.UserPasswordModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.UserPasswordModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.UserPasswordModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.UserPasswordModel.prototype,"user_id",void 0),exports.UserPasswordModel=g([s.Database(y),s.ModelName("users_password"),te(),s.Version("5.3.1")],exports.UserPasswordModel),exports.UserModel=class UserModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.UserModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.UserModel.prototype,"name",void 0),g([s.Column.String(),h("design:type",String)],exports.UserModel.prototype,"username",void 0),g([s.Column.String(),h("design:type",String)],exports.UserModel.prototype,"email",void 0),g([s.Column.Text(),h("design:type",String)],exports.UserModel.prototype,"notes",void 0),g([s.Column.Enum(exports.UserStatus),s.DefaultValue(exports.UserStatus.ACTIVE),h("design:type",String)],exports.UserModel.prototype,"status",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),h("design:type",Object)],exports.UserModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.UserModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.UserModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.UserModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.AuditModel),h("design:type",Array)],exports.UserModel.prototype,"audits",void 0),g([s.Association.HasMany(()=>exports.UserAuthModel),h("design:type",Array)],exports.UserModel.prototype,"users_auths",void 0),g([s.Association.HasMany(()=>exports.RegisterModel),h("design:type",Array)],exports.UserModel.prototype,"registers",void 0),g([s.Association.HasMany(()=>exports.UserGroupModel),h("design:type",Array)],exports.UserModel.prototype,"users_groups",void 0),g([s.Association.HasMany(()=>exports.UserPasswordModel),h("design:type",Array)],exports.UserModel.prototype,"users_passwords",void 0),g([s.Association.HasMany(()=>exports.UserTenantModel),h("design:type",Array)],exports.UserModel.prototype,"users_tenants",void 0),exports.UserModel=g([s.Database(y),s.ModelName("user"),te(),s.Version("5.3.1")],exports.UserModel),exports.AuditModel=class AuditModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.AuditModel.prototype,"id",void 0),g([s.Column.Enum(exports.AuditTypes),h("design:type",String)],exports.AuditModel.prototype,"type",void 0),g([s.Column.String(),h("design:type",String)],exports.AuditModel.prototype,"model",void 0),g([s.Column.String(),h("design:type",String)],exports.AuditModel.prototype,"record",void 0),g([s.Column.Json(),h("design:type",Object)],exports.AuditModel.prototype,"currently",void 0),g([s.Column.Json(),h("design:type",Object)],exports.AuditModel.prototype,"previously",void 0),g([s.Column.String(36),h("design:type",String)],exports.AuditModel.prototype,"request_id",void 0),g([s.Column.Text(),h("design:type",String)],exports.AuditModel.prototype,"full_url",void 0),g([s.Column.String(),h("design:type",String)],exports.AuditModel.prototype,"ip_address",void 0),g([s.Column.Text(),h("design:type",String)],exports.AuditModel.prototype,"user_agent",void 0),g([s.Column.String(),h("design:type",String)],exports.AuditModel.prototype,"source",void 0),g([s.Column.FullDate(),h("design:type",Object)],exports.AuditModel.prototype,"reverted_at",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.AuditModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.AuditModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.AuditModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.AuditModel.prototype,"user_id",void 0),exports.AuditModel=g([s.Database(y),s.ModelName("audit"),s.Version("5.3.1")],exports.AuditModel),exports.ConfigModel=class ConfigModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.ConfigModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.ConfigModel.prototype,"key",void 0),g([s.Column.Text(),h("design:type",String)],exports.ConfigModel.prototype,"value",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.ConfigModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.ConfigModel.prototype,"updated_at",void 0),exports.ConfigModel=g([s.Database(y),s.ModelName("configs"),s.Version("5.3.1")],exports.ConfigModel),exports.ForgotModel=class ForgotModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.ForgotModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.ForgotModel.prototype,"secret",void 0),g([s.Column.FullDate(),h("design:type",Number)],exports.ForgotModel.prototype,"expired_at",void 0),g([s.Column.Boolean(),h("design:type",Boolean)],exports.ForgotModel.prototype,"active",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.ForgotModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.ForgotModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),h("design:type",Object)],exports.ForgotModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),h("design:type",String)],exports.ForgotModel.prototype,"user_id",void 0),exports.ForgotModel=g([s.Database(y),s.ModelName("forgot"),s.Version("5.3.1")],exports.ForgotModel),exports.LogModel=class LogModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.LogModel.prototype,"id",void 0),g([s.Column.Enum(exports.LogLevels),s.DefaultValue(exports.LogLevels.INFO),h("design:type",String)],exports.LogModel.prototype,"level",void 0),g([s.Column.Text(),h("design:type",String)],exports.LogModel.prototype,"message",void 0),g([s.Column.String(),h("design:type",String)],exports.LogModel.prototype,"source",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.LogModel.prototype,"created_at",void 0),exports.LogModel=g([s.Database(y),s.ModelName("log"),s.Version("5.3.1")],exports.LogModel),exports.MigrationModel=class MigrationModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.MigrationModel.prototype,"id",void 0),g([s.Column.String(),h("design:type",String)],exports.MigrationModel.prototype,"model",void 0),g([s.Column.String(),h("design:type",String)],exports.MigrationModel.prototype,"version",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.MigrationModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.MigrationModel.prototype,"updated_at",void 0),exports.MigrationModel=g([s.Database(y),s.ModelName("migration"),s.Version("5.3.1")],exports.MigrationModel),exports.SessionModel=class SessionModel extends s.Model{},g([s.Column.Id(7),h("design:type",String)],exports.SessionModel.prototype,"id",void 0),g([s.Column.Json(),h("design:type",Object)],exports.SessionModel.prototype,"data",void 0),g([s.Column.FullDate(),h("design:type",Date)],exports.SessionModel.prototype,"expired_at",void 0),g([s.Column.CreatedAt(),h("design:type",Date)],exports.SessionModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),h("design:type",Date)],exports.SessionModel.prototype,"updated_at",void 0),exports.SessionModel=g([s.Database(y),s.ModelName("session"),s.Version("5.3.1")],exports.SessionModel);class Log{static error(e,t,r){return m(this,void 0,void 0,function*(){yield this.writeRaw("error",e,t,r)})}static info(e,t,r){return m(this,void 0,void 0,function*(){yield this.writeRaw("info",e,t,r)})}static warn(e,t,r){return m(this,void 0,void 0,function*(){yield this.writeRaw("warn",e,t,r)})}static writeRaw(e,t,o,i){return m(this,void 0,void 0,function*(){var s;i&&r.Log.console(null!==(s=this.colors[e])&&void 0!==s?s:r.LogColor.White,e,t),y&&(yield exports.LogModel.create({level:e,message:t,source:null!=o?o:""}).catch(r.Log.catch))})}}Log.colors={error:r.LogColor.Red,info:r.LogColor.Cyan,warn:r.LogColor.Yellow};class Loggable{get log(){return e=>Loggable.logInfo(this,e)}static get log(){return e=>this.logInfo(this,e)}get error(){return e=>Loggable.logError(this,e)}static get error(){return e=>this.logError(this,e)}static logError(e,t){var r,o;Log.error(null!==(o=null!==(r=null==t?void 0:t.message)&&void 0!==r?r:t)&&void 0!==o?o:"",this.source(e),Env.CONSOLE_ERROR)}static logInfo(e,t){Log.info(null!=t?t:"",this.source(e),Env.CONSOLE_ERROR)}static source(e){var t,r,o;const i=null!==(o=null!==(r=null===(t=null==e?void 0:e.constructor)||void 0===t?void 0:t.name)&&void 0!==r?r:null==e?void 0:e.name)&&void 0!==o?o:"null";return Env.BASE_NAME?`${Env.BASE_NAME}.${i}`:i}}class SessionStore extends a.Store{constructor(){super(),this.all=e=>m(this,void 0,void 0,function*(){e=e||o.noop;const t=yield exports.SessionModel.findAll({attributes:["id","expired_at"],where:{expired_at:{[s.Op.gte]:new Date}}}).catch(t=>(e(t),null));t&&e(null,t.map(e=>e.id)),e()}),this.clear=e=>m(this,void 0,void 0,function*(){yield exports.SessionModel.destroy().catch(r.Log.catch),e&&e()}),this.destroy=(e,t)=>m(this,void 0,void 0,function*(){yield exports.SessionModel.destroy({where:{id:e}}).catch(r.Log.catch),t&&t()}),this.expired=()=>m(this,void 0,void 0,function*(){yield exports.SessionModel.destroy({where:{expired_at:{[s.Op.lt]:new Date}}}).catch(r.Log.catch)}),this.get=(e,t)=>m(this,void 0,void 0,function*(){t=t||o.noop;const i=yield exports.SessionModel.findOne({where:{id:e,expired_at:{[s.Op.gte]:new Date}}}).catch(e=>(t(e),null));if(i){if(i.data.cookie){if(new Date(i.data.cookie.expires).getTime()<=Date.now())return yield i.destroy().catch(r.Log.catch),void t(null)}t(null,i.data)}else t(null)}),this.length=e=>m(this,void 0,void 0,function*(){e&&e(null,(yield exports.SessionModel.count().catch(r.Log.catch))||0)}),this.set=(e,t,i)=>m(this,void 0,void 0,function*(){i=i||o.noop;const s=new Date;s.setTime(s.getTime()+Env.API_SESSION_LIFETIME);const[n,d]=(yield exports.SessionModel.findOrCreate({where:{id:e},defaults:{id:e,data:t,expired_at:s}}).catch(r.Log.catch))||[];n?(d||(n.data=t,n.expired_at=s,yield n.save().catch(r.Log.catch)),i()):i()}),setInterval(this.expired,6e4)}}exports.Service=class Service{},exports.Service=g([d.Trait(Loggable)],exports.Service),exports.AuthService=class AuthService extends exports.Service{constructor(){super(...arguments),this.userAttributes={exclude:["username","notes","deleted_at"]}}create(e){return m(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new t.NotFoundError("TOKEN_KEY not found");const{id:r}=e,i=o.uuidv7(),s=yield exports.UserAuthModel.create({secret:i,user_id:r}).catch(this.error);if(!s)throw new t.InternalServerError;return{auth:s,token:l.sign({id:r,secret:i},Env.TOKEN_KEY,this.options())}})}destroy(e){return m(this,void 0,void 0,function*(){return!(!e||e.revoked_at)&&(e.revoked_at=new Date,yield e.save(),!0)})}renew(e){return m(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new t.NotFoundError("TOKEN_KEY not found");const{decode:r}=yield this.verify(e,Env.TOKEN_TTL_RENEW/1e3);if(!r)throw new t.UnauthorizedError("Invalid token");const{id:i,secret:s}=r;if(i&&s){const e=yield exports.UserModel.findOne({where:{id:i,status:exports.UserStatus.ACTIVE}}).catch(this.error);if(e){const t=yield exports.UserAuthModel.findOne({where:{secret:s,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at){t.secret=o.uuidv7(),yield t.save().catch(this.error);return{auth:t,token:l.sign({id:i,secret:t.secret},Env.TOKEN_KEY,this.options())}}}}throw new t.UnauthorizedError("Invalid token")})}user(e){return m(this,void 0,void 0,function*(){const{decode:r}=yield this.verify(e);if(!r)throw new t.UnauthorizedError("Invalid token");const{id:o,secret:i}=r;if(o&&i){const e=yield exports.UserModel.findOne({attributes:this.userAttributes,where:{id:o,status:exports.UserStatus.ACTIVE}}).catch(this.error);if(e){const t=yield exports.UserAuthModel.findOne({where:{secret:i,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at)return{auth:t,user:e}}}throw new t.UnauthorizedError("Invalid token")})}options(){return{algorithm:"RS256",expiresIn:`${Env.TOKEN_TTL}ms`}}verify(e,r){return m(this,void 0,void 0,function*(){if(!Env.TOKEN_CRT)throw new t.NotFoundError("TOKEN_CRT not found");if(!e||e.split(".").length<3)throw new t.UnauthorizedError("Invalid token");try{return{decode:l.verify(e,Env.TOKEN_CRT,{clockTolerance:r})}}catch(e){throw new t.UnauthorizedError("Invalid token")}})}key(e){return m(this,void 0,void 0,function*(){if(!e)throw new t.UnauthorizedError("Invalid token");const r=yield exports.UserModel.findOne({attributes:this.userAttributes,where:{token:e,status:exports.UserStatus.ACTIVE}}).catch(this.error);if(r){const t=e.replace(/(-[\w]{4})/g,"-****"),[o]=(yield exports.UserAuthModel.findOrCreate({where:{secret:t,user_id:r.id},defaults:{secret:t,user_id:r.id}}).catch(this.error))||[];if(o)return o.revoked_at&&(o.revoked_at=null,yield o.save().catch(this.error)),{auth:o,user:r}}throw new t.UnauthorizedError("Invalid token")})}},exports.AuthService=g([d.Singleton()],exports.AuthService);class ModelService extends exports.Service{constructor(e,t){var r,o;super(),this.attributes=[],this.permissions=[],this.search=[],this.model=e,(null==t?void 0:t.permissions)&&(this.permissions=t.permissions);const i=Object.keys(e.getAttributes());this.attributes=this.filterAttributes(i,null!==(r=null==t?void 0:t.attributes)&&void 0!==r?r:[]),this.search=this.filterAttributes(i,null!==(o=null==t?void 0:t.search)&&void 0!==o?o:this.attributes)}applySelect(e,t,r){if(!t)return;const i=null==e?void 0:e.getQuery(r?`${r}_select`:"select"),s=t.attributes,n=e=>s.includes(e);t.attributes=[],o.isString(i)&&i.length&&t.attributes.push(...i.split(/\s*,\s*/g).filter(n)),t.attributes.length||(t.attributes=s)}applyOrders(e,t){if(!t)return;const r=null==e?void 0:e.getQuery("asc"),i=null==e?void 0:e.getQuery("desc"),s=[],n=t.attributes,d=e=>n.includes(e);o.isString(r)&&r.length&&s.push(...r.split(/\s*,\s*/g).filter(d).map(e=>[e,"ASC"])),o.isString(i)&&i.length&&s.push(...i.split(/\s*,\s*/g).filter(d).map(e=>[e,"DESC"])),s.length&&(t.order=s)}applyPagination(e,t){if(!t)return;const r=null==e?void 0:e.getQuery("limit"),i=null==e?void 0:e.getQuery("offset");o.isUndefined(t.limit)&&(t.limit=Env.MODEL_LIMIT,o.isString(r)&&(t.limit=parseInt(r)||0),t.limit=o.clamp(t.limit,-1,Env.MODEL_LIMIT_MAX)),t.limit<0&&(t.limit=void 0),o.isString(i)&&(t.offset=parseInt(i)||0,t.offset<0&&(t.offset=void 0))}applySearch(e,t){var r;if(!t)return;const i=null==e?void 0:e.getQuery("search");i&&o.isString(i)&&(t.where=Object.assign(Object.assign({},null!==(r=t.where)&&void 0!==r?r:{}),{[s.Op.or]:this.search.map(e=>({[e]:{[s.Op.substring]:i}}))}))}applyWhere(e,r,i){var n,d;if(!r)return null;const a=null==e?void 0:e.getQuery(i?`${i}_where`:"where");if(!o.isString(a))return null;const l=r.attributes,p=s.Where.parse(l,a);return o.isUndefined(p.error)?(r.where=Object.assign(Object.assign({},null!==(n=r.where)&&void 0!==n?n:{}),null!==(d=p.value)&&void 0!==d?d:{}),null):new t.ValidationError(p.error.join(", "))}countAll(e){return m(this,void 0,void 0,function*(){var r,i;const{ctx:s,options:n={}}=e,d=o.merge({},n);d.attributes=this.getAttributes(null!==(r=null==d?void 0:d.attributes)&&void 0!==r?r:[]),this.applySearch(s,d);const a=this.applyWhere(s,d);if(a)return null==s||s.error(a),0;this.applySelect(s,d);const l=null!==(i=yield this.model.count(Object.assign(Object.assign({},d),{distinct:!!d.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error))&&void 0!==i?i:0;return null==s||s.prepare(t.StatusCodes.OK,{count:l}),l})}create(e){return m(this,void 0,void 0,function*(){var r,i;const{body:s={},ctx:n,options:d={}}=e,a=o.merge({},d),l=yield this.model.create(Object.assign({},o.merge({},null!==(i=null===(r=null==n?void 0:n.req)||void 0===r?void 0:r.body)&&void 0!==i?i:{},s)),Object.assign(Object.assign({},a),{ctx:n})).catch(this.error);if(!l)return null==n||n.error(new t.InternalServerError),null;const{primaryKeyAttribute:p}=this.model;return null==n||n.prepare(t.StatusCodes.OK,{[p]:l.getDataValue(p)}),l})}delete(e){return m(this,void 0,void 0,function*(){var r,i;const{ctx:n,id:d,options:a={}}=e,{primaryKeyAttribute:l}=this.model,p=null!==(r=null==n?void 0:n.getParam(l))&&void 0!==r?r:d;if(o.isUndefined(p))return null==n||n.error(new t.BadRequestError),0;const u=o.merge({},a),c=yield this.model.destroy(Object.assign(Object.assign(Object.assign({},u),{where:{[s.Op.and]:Object.assign({[l]:p},null!==(i=null==u?void 0:u.where)&&void 0!==i?i:{})},individualHooks:!0}),{ctx:n})).catch(this.error);return c?(null==n||n.success("OK"),c):(null==n||n.error(new t.NotFoundError),0)})}filterAttributes(e,t){if(o.isArray(t))return t.length?t.filter(t=>o.isString(t)&&e.includes(t)):e;const{exclude:r,include:i}=t,s=o.isUndefined(i)?e:i.filter(t=>o.isString(t)&&e.includes(t)),n=null!=r?r:[];return n.length?s.filter(e=>!n.includes(e)):s}findAll(e){return m(this,void 0,void 0,function*(){var r,i;const{ctx:s,callback:n,options:d={},query:a=!0}=e,l=o.merge({},d);if(l.attributes=this.getAttributes(null!==(r=null==l?void 0:l.attributes)&&void 0!==r?r:[]),a&&this.applySelect(s,l),this.applyOrders(s,l),this.applyPagination(s,l),(null!==(i=null==l?void 0:l.limit)&&void 0!==i?i:0)>Env.MODEL_LIMIT_MAX&&(l.limit=Env.MODEL_LIMIT_MAX),this.applySearch(s,l),a){const e=this.applyWhere(s,l);if(e)return null==s||s.error(e),{count:0,records:[]}}const[p,u]=yield Promise.all([this.model.count(Object.assign(Object.assign({},l),{distinct:!!l.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error).then(e=>null!=e?e:0),this.model.findAll(l).catch(this.error).then(e=>null!=e?e:[])]),c={count:p,records:n?yield n(u):u};return null==s||s.prepare(t.StatusCodes.OK,c),c})}findOne(e){return m(this,void 0,void 0,function*(){var r,i,n;const{callback:d,ctx:a,id:l,options:p={},query:u=!0}=e,{primaryKeyAttribute:c}=this.model,g=null!==(r=null==a?void 0:a.getParam(c))&&void 0!==r?r:l;if(o.isUndefined(g))return null==a||a.error(new t.BadRequestError),null;const v=o.merge({},p);v.attributes=this.getAttributes(null!==(i=null==v?void 0:v.attributes)&&void 0!==i?i:[]),u&&this.applySelect(a,v);const h=yield this.model.findOne(Object.assign(Object.assign({},v),{where:{[s.Op.and]:Object.assign({[c]:g},null!==(n=null==v?void 0:v.where)&&void 0!==n?n:{})}})).catch(this.error);return h?(null==a||a.prepare(t.StatusCodes.OK,d?yield d(h):h.toJSON()),h):(null==a||a.error(new t.NotFoundError),null)})}getAttributes(e){return this.filterAttributes(this.attributes,e)}include(e,t){var r;const i=o.clone(t),{ctx:s}=null!=t?t:{};i.attributes=this.filterAttributes(Object.keys(e.getAttributes()),null!==(r=i.attributes)&&void 0!==r?r:[]),this.applySearch(s,i);const n=this.applyWhere(s,i,t.name);return n?(null==s||s.error(n),null):(this.applySelect(s,i,t.name),Object.assign({model:e},i))}name(){return this.model.tableName}sync(){return m(this,void 0,void 0,function*(){if(!this.permissions.length)return;const e=this.name().toLowerCase(),t={description:"",active:!0};yield o.forEachAsync(this.permissions,r=>m(this,void 0,void 0,function*(){const i=`${e}.${r}`,s=o.upperCamelCase(e.replace(/_/g," ")," ");yield exports.PermissionModel.findOrCreate({where:{key:i},defaults:Object.assign({name:`${s} ${o.upperCamelCase(r," ")}`,key:i,tags:s},t)})}))})}update(e){return m(this,void 0,void 0,function*(){var r,i,n,d;const{ctx:a,body:l,id:p,options:u={}}=e,{primaryKeyAttribute:c}=this.model,g=null!==(r=null==a?void 0:a.getParam(c))&&void 0!==r?r:p;if(o.isUndefined(g))return null==a||a.error(new t.BadRequestError),!1;const v=o.merge({},u),h=o.merge({},null!==(n=null===(i=null==a?void 0:a.req)||void 0===i?void 0:i.body)&&void 0!==n?n:{},null!=l?l:{}),m=yield this.model.findOne(Object.assign(Object.assign({},v),{attributes:this.getAttributes([c,...Object.keys(h)]),where:{[s.Op.and]:Object.assign({[c]:g},null!==(d=null==v?void 0:v.where)&&void 0!==d?d:{})}})).catch(this.error);return m?(m.set(h),m.changed()?(null==a||a.success("OK"),yield m.save(Object.assign({},{ctx:a})).catch(this.error),!0):(null==a||a.success("Record not changed"),!1)):(null==a||a.error(new t.NotFoundError),!1)})}}exports.UserService=class UserService extends exports.Service{constructor(){super(...arguments),this.hashOptions={algorithm:Env.PASSWORD_ALGORITHM,memoryCost:Env.PASSWORD_MEMORY_COST,parallelism:Env.PASSWORD_PARALLELISM,timeCost:Env.PASSWORD_TIME_COST}}createPassword(e,t,r){return m(this,void 0,void 0,function*(){yield exports.UserPasswordModel.update({revoked_at:new Date},{where:{revoked_at:null,user_id:e}}).catch(this.error);const o=p.hashSync(t+Env.PASSWORD_PEPPER,this.hashOptions);yield exports.UserPasswordModel.create({hash:o,user_id:e},Object.assign({},{ctx:r})).catch(this.error)})}getGroups(e,t){return m(this,void 0,void 0,function*(){var r;return o.uniqueArray((null!==(r=yield exports.GroupModel.findAll({attributes:["name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||o.isNull(t)?{tenant_id:t}:{})}]}).catch(this.error))&&void 0!==r?r:[]).map(e=>e.name))})}getPermissions(e,t){return m(this,void 0,void 0,function*(){var r;return(null!==(r=yield exports.PermissionModel.findAll({attributes:["name"],where:{active:!0},include:[{association:"groups_permissions",required:!0,include:[{association:"group",required:!0,attributes:["id","name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||o.isNull(t)?{tenant_id:t}:{})}]}]}]}).catch(this.error))&&void 0!==r?r:[]).map(e=>e.name)})}getTenants(e){return m(this,void 0,void 0,function*(){var t;return(null!==(t=yield exports.TenantModel.findAll({attributes:["id","name"],where:{status:exports.TenantStatus.ACTIVE},include:[{association:"users_tenants",required:!0,where:{user_id:e}}]}).catch(this.error))&&void 0!==t?t:[]).map(e=>({id:e.id,name:e.name}))})}},exports.UserService=g([d.Singleton()],exports.UserService);class Application extends t.Application{constructor(e,t){super(e,o.merge({},{cross:!!Env.HTTP_CROSS&&("*"===Env.HTTP_CROSS||{origin:Env.HTTP_CROSS.split(",")}),hybrid:Env.API_HTTP_HYBRID,json:{strict:Env.API_BODYPARSER_STRICT,inflate:Env.API_BODYPARSER_INFLATE,limit:Env.API_BODYPARSER_LIMIT,type:Env.API_BODYPARSER_TYPE},notfound:Env.API_HTTP_NOTFOUND,path:Env.API_HTTP_PATH,port:Env.HTTP_PORT,public:Env.HTTP_PUBLIC,redirect:Env.API_HTTP_REDIRECT,session:{store:new SessionStore,name:Env.API_SESSION_NAME,secret:Env.API_SESSION_SECRET,cookie:{maxAge:Env.API_SESSION_LIFETIME},genid:o.uuidv7},tls:{ca:Env.HTTP_TLS_CA,cert:Env.HTTP_TLS_CRT,key:Env.HTTP_TLS_KEY}},null!=t?t:{})),this.hash=new r.Hash(Env.API_KEY_HASH)}error(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.error(e.message,t,Env.CONSOLE_ERROR)}log(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.info(e,t,!0)}listen(){const e=Object.create(null,{listen:{get:()=>super.listen}});return m(this,void 0,void 0,function*(){yield y.sync(),yield this.migrations(y),yield o.forEachSeries(this.controllers,e=>m(this,void 0,void 0,function*(){o.isFunction(e.sync)&&(yield e.sync(this))})),this.authService=new exports.AuthService,this.userService=new exports.UserService,yield e.listen.call(this),Env.API_WEBSOCKET_START&&this.server&&(this._webSocket=new i.WebSocketServer({server:this.server,verifyClient:(e,t)=>t(Env.API_WEBSOCKET_START)}),this._webSocket.on("connection",(e,t)=>m(this,void 0,void 0,function*(){t.url||(t.url=""),e.on("close",()=>{}),yield o.sleep(2e3)})))})}migrations(e){return m(this,void 0,void 0,function*(){const t=[];yield o.forEachSeries(Object.keys(e.models),r=>m(this,void 0,void 0,function*(){var o;const i=e.models[r],s=i.version();if(!s)return;const[n,d]=null!==(o=yield exports.MigrationModel.findOrCreate({where:{model:i.tableName},defaults:{model:i.tableName,version:""}}).catch(this.error))&&void 0!==o?o:[];n&&(d||n.version!=s)&&(n.version=s,yield n.save().catch(this.error),t.push(i))})),yield o.forEachSeries(t,e=>m(this,void 0,void 0,function*(){return yield e.updateAttributes()}))})}websocket(){return this._webSocket}}exports.BaseController=class BaseController extends o.EventEmitter{constructor(){super(...arguments),this.permissions=[]}name(){var e,t;return(null!==(t=null===(e=this.constructor)||void 0===e?void 0:e.name)&&void 0!==t?t:"api").replace(/(([a-z])([A-Z]))/g,"$2_$3")}session(e,t,r){return m(this,void 0,void 0,function*(){r.auth&&r.user&&(r.user_agent?r.user_agent!=t&&r.regenerate(o.noop):(r.user_agent=t,r.save(o.noop))),e.next()})}sync(){return m(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=o.upperCamelCase(e.replace(/_/g," ")," ");yield o.forEachSeries(this.permissions,r=>m(this,void 0,void 0,function*(){const i=`${e}.${r}`;yield exports.PermissionModel.findOrCreate({where:{name:i},defaults:{name:i,description:`${t} ${o.upperCamelCase(r," ")}`,active:!0}})}))})}},g([v(0,t.Ctx()),v(1,t.Headers("user-agent")),v(2,t.Session()),h("design:type",Function),h("design:paramtypes",[t.Context,String,Object]),h("design:returntype",Promise)],exports.BaseController.prototype,"session",null),exports.BaseController=g([d.Trait(Loggable)],exports.BaseController),exports.ModelController=class ModelController extends exports.BaseController{constructor(){super(...arguments),this.attributes=[],this.permissions=["create","read","update","delete"],this.search=[]}countAll(e){return m(this,void 0,void 0,function*(){return yield this.service.countAll(e)})}create(e){return m(this,void 0,void 0,function*(){return yield this.service.create(e)})}delete(e){return m(this,void 0,void 0,function*(){return yield this.service.delete(e)})}findAll(e){return m(this,void 0,void 0,function*(){return yield this.service.findAll(e)})}findOne(e){return m(this,void 0,void 0,function*(){return yield this.service.findOne(e)})}include(e,t){return this.service.include(e,t)}sync(){return m(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=o.upperCamelCase(e.replace(/_/g," ")," ");yield o.forEachSeries(this.permissions,r=>m(this,void 0,void 0,function*(){const i=`${e}.${r}`;yield exports.PermissionModel.findOrCreate({where:{name:i},defaults:{name:i,description:`${t} ${o.upperCamelCase(r," ")}`,active:!0}})})),this.service=new ModelService(this.model,{attributes:this.attributes.length?this.attributes:void 0,search:this.search.length?this.search:void 0})})}update(e){return m(this,void 0,void 0,function*(){return yield this.service.update(e)})}name(){return this.model.tableName}},exports.ModelController=g([t.Extends(exports.BaseController)],exports.ModelController),exports.AuditsController=class AuditsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.AuditModel,this.permissions=["read"]}all(e,t,r){return m(this,void 0,void 0,function*(){const o={};t&&(o.type=t),r&&(o.table=r),yield this.findAll({ctx:e,options:{attributes:{exclude:["currently","previously"]},where:o,order:[["created_at","DESC"]]}})})}get(e){return m(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}},g([t.Get(),P(),T(),v(0,t.Ctx()),v(1,t.Query("type")),v(2,t.Query("table")),h("design:type",Function),h("design:paramtypes",[t.Context,String,String]),h("design:returntype",Promise)],exports.AuditsController.prototype,"all",null),g([t.Get("/:id"),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.AuditsController.prototype,"get",null),exports.AuditsController=g([t.Controller("/audits"),t.Extends(exports.ModelController)],exports.AuditsController),exports.AuthController=class AuthController extends exports.BaseController{constructor(){super(...arguments),this.authService=new exports.AuthService}login(e,r,i,n,d,a){return m(this,void 0,void 0,function*(){var l;yield o.sleep(Env.SLEEP_AUTH);const u=yield exports.UserModel.findOne({where:{[s.Op.or]:[{email:i},{username:i}]}}).catch(this.error);if(!u)return e.error(new t.UnauthorizedError("Invalid credentials")),a.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const c=yield exports.UserPasswordModel.findOne({where:{revoked_at:null,user_id:u.id}}).catch(this.error);if(n+=Env.PASSWORD_PEPPER,!c||!(yield p.verify(c.hash,n).catch(o.noop)))return e.error(new t.UnauthorizedError("Invalid credentials")),a.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const g=yield exports.RegisterModel.findOne({where:{active:!0,user_id:u.id}}).catch(this.error);if(g)return e.error(new t.UnauthorizedError("Activation Required")),a.emit("auth.activation",{ctx:e,register:g,user:u}),void this.emit("auth.activation",{ctx:e,register:g,user:u});if(u.status!=exports.UserStatus.ACTIVE)return e.error(new t.UnauthorizedError("Invalid credentials")),a.emit("auth.failure",{ctx:e,user:u}),void this.emit("auth.failure",{ctx:e,user:u});const{auth:v,token:h}=null!==(l=yield this.authService.create(u).catch(t=>{e.error(t),a.emit("auth.failure",{ctx:e}),this.emit("auth.failure",{ctx:e})}))&&void 0!==l?l:{};v&&h&&(v.user_agent=r,v.ip_address=e.getIp(),yield v.save().catch(this.error),Env.API_TOKEN_COOKIE_SET&&e.setCookie(Env.API_TOKEN_COOKIE,h,{maxAge:d?Env.TOKEN_TTL:void 0}),e.json({token:h}),a.emit("auth.login",{ctx:e,auth:v,user:u}),this.emit("auth.login",{ctx:e,auth:v,user:u}))})}logout(e,r,o,i){return m(this,void 0,void 0,function*(){if(yield this.authService.destroy(r))return Env.API_TOKEN_COOKIE_SET&&e.clearCookie(Env.API_TOKEN_COOKIE),e.success("OK"),i.emit("auth.logout",{auth:r,ctx:e,user:o}),void this.emit("auth.logout",{auth:r,ctx:e,user:o});e.error(new t.UnauthorizedError("Access Denied"))})}renew(e,t,r,o){return m(this,void 0,void 0,function*(){var i;const{auth:s,token:n}=null!==(i=yield this.authService.renew(r).catch(t=>{e.error(t)}))&&void 0!==i?i:{};s&&n&&(s.user_agent=t,yield s.save().catch(this.error),e.json({token:n}),o.emit("auth.renew",{auth:s,ctx:e}),this.emit("auth.renew",{auth:s,ctx:e}))})}user(e,r){return m(this,void 0,void 0,function*(){const{groups:o,permissions:i,tenants:s}=e.req;if(!o||!i||!s)return e.error(new t.InternalServerError);e.json(Object.assign(Object.assign({},r.toJSON()),{groups:o,permissions:i,tenants:s}))})}},g([t.Post("/login"),t.Validate(e=>({username:e.string().min(3),password:e.string().min(5),remember:e.boolean().parse().default(!1)})),v(0,t.Ctx()),v(1,t.Headers("user-agent")),v(2,t.Body("username")),v(3,t.Body("password")),v(4,t.Body("remember")),v(5,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,String,String,String,Boolean,Application]),h("design:returntype",Promise)],exports.AuthController.prototype,"login",null),g([t.Get("/logout"),P(),v(0,t.Ctx()),v(1,b()),v(2,D()),v(3,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,exports.UserAuthModel,exports.UserModel,Application]),h("design:returntype",Promise)],exports.AuthController.prototype,"logout",null),g([t.Post("/renew"),t.Validate(e=>({token:e.string()})),v(0,t.Ctx()),v(1,t.Headers("user-agent")),v(2,t.Body("token")),v(3,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,String,String,Application]),h("design:returntype",Promise)],exports.AuthController.prototype,"renew",null),g([t.Get(),t.Get("/me"),P(),v(0,t.Ctx()),v(1,D()),h("design:type",Function),h("design:paramtypes",[t.Context,exports.UserModel]),h("design:returntype",Promise)],exports.AuthController.prototype,"user",null),exports.AuthController=g([t.Controller("/auth"),t.Extends(exports.BaseController)],exports.AuthController),exports.CrudController=class CrudController extends exports.ModelController{constructor(){super(...arguments),this._crud={}}CrudArgumentsCountAll(e){return{ctx:e}}CrudArgumentsCreate(e){return{ctx:e}}CrudArgumentsFindAll(e){return{ctx:e}}CrudArgumentsFindOne(e){return{ctx:e}}CrudArgumentsDelete(e){return{ctx:e}}CrudArgumentsUpdate(e){return{ctx:e}}CrudValidateCreate(){return this._crud}CrudValidateUpdate(){return this._crud}add(e){return m(this,void 0,void 0,function*(){yield this.create(this.CrudArgumentsCreate(e))})}all(e){return m(this,void 0,void 0,function*(){yield this.findAll(this.CrudArgumentsFindAll(e))})}rows(e){return m(this,void 0,void 0,function*(){yield this.countAll(this.CrudArgumentsCountAll(e))})}del(e){return m(this,void 0,void 0,function*(){yield this.delete(this.CrudArgumentsDelete(e))})}get(e){return m(this,void 0,void 0,function*(){yield this.findOne(this.CrudArgumentsFindOne(e))})}set(e){return m(this,void 0,void 0,function*(){yield this.update(this.CrudArgumentsUpdate(e))})}validate(e,r){var i,s;const n=o.Validation.object(r).parse().validate(null!==(s=null===(i=e.req)||void 0===i?void 0:i.body)&&void 0!==s?s:{});if(n.error)return e.error(new t.ValidationError(n.message||n.error));e.req.body=n.value,e.next()}validateCreate(e){const r=this.CrudValidateCreate();if(r==this._crud)return e.error(new t.InternalServerError);this.validate(e,r)}validateUpdate(e){const r=this.CrudValidateUpdate();if(r==this._crud)return e.error(new t.InternalServerError);this.validate(e,r)}},g([t.Post(),P(),A(),t.Middleware("validateCreate"),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.CrudController.prototype,"add",null),g([t.Get(),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.CrudController.prototype,"all",null),g([t.Get("/count"),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.CrudController.prototype,"rows",null),g([t.Delete("/:id"),P(),_(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.CrudController.prototype,"del",null),g([t.Get("/:id"),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.CrudController.prototype,"get",null),g([t.Put("/:id"),P(),O(),t.Middleware("validateUpdate"),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.CrudController.prototype,"set",null),g([v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",void 0)],exports.CrudController.prototype,"validateCreate",null),g([v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",void 0)],exports.CrudController.prototype,"validateUpdate",null),exports.CrudController=g([t.Extends(exports.ModelController)],exports.CrudController),exports.FilesController=class FilesController extends exports.BaseController{constructor(){super(...arguments),this.directory=Env.HTTP_PUBLIC||"./",this.permissions=["delete","download","edit","list","read","rename","upload","write"]}files(e){return m(this,void 0,void 0,function*(){let{path:r}=e.req;r=r.replace(/(^\/path(\/)?)|([\\.]{1,2}\/)/g,"");const i=c.join(this.directory,r);if(!u.existsSync(i)||!u.statSync(i).isDirectory())return e.error(new t.NotFoundError);let s;return s=u.readdirSync(i),s=s.map(e=>this.info(c.join(i,e))),s=s.filter(o.isDef),Object.assign(Object.assign({},this.info(i)),{files:s})})}info(e){if(!u.existsSync(e))return null;const t=u.statSync(e),r=e.split("/").pop();e=e.replace(this.directory,"/").replace(/^\/\//,"/");const o=t.isDirectory();return{name:r,path:e.replace(/^\/\//,"/"),size:t.size,extension:o?"":"."+e.split(".").pop(),created:t.birthtime,modified:t.mtime,directory:o,symlink:t.isSymbolicLink()}}name(){return"files"}sync(){return m(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=o.upperCamelCase(e.replace(/_/g," ")," ");yield o.forEachSeries(this.permissions,r=>m(this,void 0,void 0,function*(){const i=`${e}.${r}`;yield exports.PermissionModel.findOrCreate({where:{name:i},defaults:{name:i,description:`${t} ${o.upperCamelCase(r," ")}`,active:!0}})}))})}},g([t.Get("/path"),t.Get("/path/*path"),P(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.FilesController.prototype,"files",null),exports.FilesController=g([t.Controller("/files"),t.Extends(exports.BaseController)],exports.FilesController),exports.ForgotController=class ForgotController extends exports.BaseController{check(e,r){return m(this,void 0,void 0,function*(){const i=yield this.find(r);if(!i||!i.user)return e.error(new t.NotFoundError);i.secret=o.uniqueID(),yield i.save(),e.json({token:i.secret})})}forgot(e,r,i){return m(this,void 0,void 0,function*(){yield o.sleep(Env.SLEEP_FORGOT);const n=r,d=yield exports.UserModel.findOne({where:{[s.Op.or]:[{email:n},{username:r}]}}).catch(this.error);if(!d)return e.error(new t.NotFoundError);const a=o.uniqueID(),l=Date.now()+6e4*Env.TOKEN_TTL_FORGOT,p=yield exports.ForgotModel.create({token:a,timestamp:l,active:!0,user_id:d.id});e.success("OK"),i.emit("forgot.send",{ctx:e,forgot:p,user:d}),this.emit("forgot.send",{ctx:e,forgot:p,user:d})})}reset(e,r,o,i){return m(this,void 0,void 0,function*(){const o=yield this.find(r);if(!o)return e.error(new t.NotFoundError);o.active=!1,yield o.save().catch(this.error),yield o.user.save().catch(this.error),e.success("OK"),i.emit("forgot.reset",{ctx:e,user:o.user}),this.emit("forgot.reset",{ctx:e,user:o.user})})}find(e){return m(this,void 0,void 0,function*(){return yield exports.ForgotModel.findOne({where:{token:e,active:!0},include:[{association:"users",required:!0}]}).catch(this.error)})}},g([t.Get("/check"),t.Validate(e=>({token:e.string()})),v(0,t.Ctx()),v(1,t.Body("token")),h("design:type",Function),h("design:paramtypes",[t.Context,String]),h("design:returntype",Promise)],exports.ForgotController.prototype,"check",null),g([t.Post(),t.Validate(e=>({username:e.string().min(4)})),v(0,t.Ctx()),v(1,t.Body("username")),v(2,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,String,Application]),h("design:returntype",Promise)],exports.ForgotController.prototype,"forgot",null),g([t.Post("/reset"),t.Validate(e=>({token:e.string(),password:e.string().min(5)})),v(0,t.Ctx()),v(1,t.Body("token")),v(2,t.Body("password")),v(3,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,String,String,Application]),h("design:returntype",Promise)],exports.ForgotController.prototype,"reset",null),exports.ForgotController=g([t.Controller("/forgot"),t.Extends(exports.BaseController)],exports.ForgotController),exports.GroupsController=class GroupsController extends exports.CrudController{constructor(){super(...arguments),this.model=exports.GroupModel,this.schemaCreate={name:o.Validation.string(),description:o.Validation.string().default(""),type:o.Validation.enum(Object.keys(exports.GroupTypes)).default(exports.GroupTypes.SYSTEM),active:o.Validation.boolean().parse(),metadata:o.Validation.object().parse().default({})},this.schemaUpdate={description:o.Validation.string().optional(),type:o.Validation.enum(Object.keys(exports.GroupTypes)).optional(),active:o.Validation.boolean().parse().optional(),metadata:o.Validation.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}},exports.GroupsController=g([t.Controller("/groups"),t.Extends(exports.CrudController)],exports.GroupsController),exports.GroupsPermissionsController=class GroupsPermissionsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.GroupPermissionModel,this.permissions=[]}all(e,t){return m(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{where:{group_id:t},include:[{association:"permission"}]},callback:e=>e.map(e=>e.permission),query:!1})})}set(e,r,i){return m(this,void 0,void 0,function*(){const n=yield exports.GroupModel.findByPk(r,{attributes:["id"]}).catch(this.error);if(!n)return e.error(new t.NotFoundError);const d=n.id,a=[];yield o.forEachSeries(o.uniqueArray(i),t=>m(this,void 0,void 0,function*(){var r;if(!(yield exports.PermissionModel.count({where:{id:t}})))return;const[o]=null!==(r=yield exports.GroupPermissionModel.findOrCreate(Object.assign({where:{group_id:d,permission_id:t},defaults:{group_id:d,permission_id:t}},{ctx:e})).catch(this.error))&&void 0!==r?r:[];o&&a.push(t)})),yield exports.GroupPermissionModel.destroy(Object.assign({where:{group_id:d,permission_id:{[s.Op.notIn]:a}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}},g([t.Get("/:id/permissions"),P(),T("groups"),v(0,t.Ctx()),v(1,t.Params("id")),h("design:type",Function),h("design:paramtypes",[t.Context,String]),h("design:returntype",Promise)],exports.GroupsPermissionsController.prototype,"all",null),g([t.Put("/:id/permissions"),P(),O("groups"),t.Validate(e=>({permissions:e.array(e.string().uuid())})),v(0,t.Ctx()),v(1,t.Params("id")),v(2,t.Body("permissions")),h("design:type",Function),h("design:paramtypes",[t.Context,String,Array]),h("design:returntype",Promise)],exports.GroupsPermissionsController.prototype,"set",null),exports.GroupsPermissionsController=g([t.Controller("/groups"),t.Extends(exports.ModelController)],exports.GroupsPermissionsController),exports.HealthController=class HealthController{ping(e){return m(this,void 0,void 0,function*(){e.json({status:"ok",timestamp:Date.now(),uptime:process.uptime()})})}},g([t.All("/"),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.HealthController.prototype,"ping",null),exports.HealthController=g([t.Controller("/health")],exports.HealthController),exports.LogsController=class LogsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.LogModel,this.permissions=["read"]}all(e){return m(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}},g([t.Get(),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.LogsController.prototype,"all",null),exports.LogsController=g([t.Controller("/logs"),t.Extends(exports.ModelController)],exports.LogsController),exports.McpController=class McpController extends exports.BaseController{constructor(){super(...arguments),this.tools=new McpToolRegistry,this.toolsRegistered=!1,this.handler=new McpHttpHandler({sessions:new McpSessionStore(Env.MCP_SESSION_TTL),tools:this.tools,allowedOrigins:Env.MCP_ALLOWED_ORIGINS?Env.MCP_ALLOWED_ORIGINS.split(",").map(e=>e.trim()).filter(Boolean):[],logger:{toolCall:e=>m(this,void 0,void 0,function*(){yield Log.info(JSON.stringify(e),"mcp")})}}),this.rateLimiter=new McpRateLimiter(Env.MCP_RATE_LIMIT_MAX,Env.MCP_RATE_LIMIT_WINDOW)}sync(e){const t=Object.create(null,{sync:{get:()=>super.sync}});return m(this,void 0,void 0,function*(){yield t.sync.call(this),this.toolsRegistered||(this.toolsRegistered=!0,e&&(e.instance.use((e,t,r,o)=>{if(!this.isMcpEndpoint(t))return o(e);const i=this.jsonParseErrorResponse(e);if(!i)return o(e);r.status(i.status).json(i.body)}),e.instance.use((e,t,r)=>{if(!this.isMcpEndpoint(e)||!["GET","HEAD"].includes(e.method))return r();t.setHeader("Allow",K),t.status(405).end()}),this.discoverMcpTools(e.controllers).forEach(e=>this.tools.register(e))))})}options(e){return m(this,void 0,void 0,function*(){this.respond(e,this.handler.options(this.request(e)))})}post(e){return m(this,void 0,void 0,function*(){this.rateLimiter.consume(e.getIp()||"unknown")?this.respond(e,yield this.handler.post(this.request(e))):e.res.status(429).end()})}delete(e){return m(this,void 0,void 0,function*(){this.respond(e,this.handler.delete(this.request(e)))})}getMcpToolMetadata(e){const t=d.metadata(Y,e,[]);return t.length||"function"==typeof e?t:d.metadata(Y,Object.getPrototypeOf(e),[])}discoverMcpTools(e){const t=[];for(const r of e)for(const e of this.getMcpToolMetadata(r))t.push(this.createMcpToolFromMetadata(r,e));return t}createMcpToolFromMetadata(e,t){const r=e[t.propertyKey];if(!o.isFunction(r))throw new Error(`MCP tool "${t.name}" handler was not found`);return $(t),Object.assign(Object.assign(Object.assign({name:t.name,title:t.title,description:t.description},void 0!==t.input?{input:t.input}:{}),void 0!==t.output?{output:t.output}:{}),{run:(t,o)=>r.call(e,t,o)})}request(e){const t=e.req.user;return{body:e.getBody(),headers:e.getHeaders(),ip:e.getIp(),context:{auth:e.req.auth,groups:e.req.groups,permissions:e.req.permissions,profile:e.req.profile,user:t,userId:null==t?void 0:t.id}}}isJsonParseError(e){if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode}isMcpEndpoint(e){const t=(e.originalUrl||e.url).split("?")[0].replace(/\/+$/g,"")||"/";return t===`${(Env.API_HTTP_PATH||"/").replace(/\/+$/g,"")||""}/mcp`.replace(/\/+/g,"/")||"/mcp"===t}jsonParseErrorResponse(e){if(this.isJsonParseError(e))return{status:400,body:V(null,new McpParseError("Parse error",{message:e.message}))}}respond(e,t){var r;for(const[o,i]of Object.entries(null!==(r=t.headers)&&void 0!==r?r:{}))e.res.setHeader(o,i);void 0!==t.body?e.res.status(t.status).json(t.body):e.res.status(t.status).end()}},g([t.Options(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.McpController.prototype,"options",null),g([t.Post(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.McpController.prototype,"post",null),g([t.Delete(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.McpController.prototype,"delete",null),exports.McpController=g([t.Controller("/mcp"),t.Extends(exports.BaseController)],exports.McpController),exports.PermissionsController=class PermissionsController extends exports.CrudController{constructor(){super(...arguments),this.model=exports.PermissionModel,this.schemaCreate={name:o.Validation.string(),description:o.Validation.string().default(""),active:o.Validation.boolean().parse(),metadata:o.Validation.object().parse().default({})},this.schemaUpdate={description:o.Validation.string().optional(),active:o.Validation.boolean().parse().optional(),metadata:o.Validation.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}},exports.PermissionsController=g([t.Controller("/permissions"),t.Extends(exports.CrudController)],exports.PermissionsController),exports.RegisterController=class RegisterController extends exports.BaseController{register(e,i,n){return m(this,void 0,void 0,function*(){yield o.sleep(Env.SLEEP_REGISTRY);const{name:d,date:a,email:l,username:p,password:u,confirm:c}=i,g=p||l,v=r.sha256(u);if(yield exports.UserModel.count({where:{[s.Op.or]:[{email:l},{username:g}]}}).catch(this.error))return e.error("INVALID EMAIL OR USERNAME");if(v!=r.sha256(c))return e.error("INVALID PASSWORD");const h=yield exports.UserModel.create({name:d,email:l,username:g,password:v,avatar:"",date:a,description:"",status:exports.UserStatus.PENDING}).catch(this.error);if(!h)return e.error(new t.InternalServerError);const m=yield exports.RegisterModel.create({token:yield this.getId(),active:!0,user_id:h.id}).catch(this.error);if(!m)return yield h.destroy().catch(this.error),e.error(new t.InternalServerError);e.success("OK"),n.emit("register.user",{ctx:e,register:m,user:h}),this.emit("register.user",{ctx:e,register:m,user:h})})}confirm(e,r,o){return m(this,void 0,void 0,function*(){const i=yield exports.RegisterModel.findOne({where:{token:r,active:!0},include:[{association:"users",required:!0}]}).catch(this.error);if(!i)return e.error(new t.NotFoundError);i.active=!1,yield i.save().catch(this.error),i.user.status=exports.UserStatus.ACTIVE,yield i.user.save().catch(this.error),e.success("OK"),o.emit("register.confirm",{ctx:e,register:i,user:i.user}),this.emit("register.confirm",{ctx:e,register:i,user:i.user})})}send(e,r,o){return m(this,void 0,void 0,function*(){const i=r,n=yield exports.RegisterModel.findOne({where:{active:!0},include:[{model:exports.UserModel,required:!0,where:{[s.Op.or]:[{email:i},{username:r}]}}]}).catch(this.error);if(!n)return e.error(new t.NotFoundError);e.success("OK"),o.emit("register.send",{ctx:e,register:n,user:n.user}),this.emit("register.send",{ctx:e,register:n,user:n.user})})}getId(){return m(this,void 0,void 0,function*(){const e=o.uuidv7();return(yield exports.RegisterModel.count({where:{token:e}}))?this.getId():e})}},g([t.Post(),t.Validate(e=>({name:e.string(),date:e.date(),email:e.string().email(),username:e.string().min(4).default(e.ref("email")),password:e.string().min(5),confirm:e.string().min(5)})),v(0,t.Ctx()),v(1,t.Body()),v(2,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,Object,Application]),h("design:returntype",Promise)],exports.RegisterController.prototype,"register",null),g([t.Post("/confirm"),t.Validate(e=>({token:e.string()})),v(0,t.Ctx()),v(1,t.Body("token")),v(2,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,String,Application]),h("design:returntype",Promise)],exports.RegisterController.prototype,"confirm",null),g([t.Post("/send"),t.Validate(e=>({username:e.string().min(4)})),v(0,t.Ctx()),v(1,t.Body("username")),v(2,t.App()),h("design:type",Function),h("design:paramtypes",[t.Context,String,Application]),h("design:returntype",Promise)],exports.RegisterController.prototype,"send",null),exports.RegisterController=g([t.Controller("/register"),t.Extends(exports.BaseController)],exports.RegisterController),exports.SetupController=class SetupController extends exports.BaseController{constructor(){super(...arguments),this.userService=new exports.UserService}setup(e){return m(this,void 0,void 0,function*(){var r;if(yield exports.UserModel.count())return e.error(new t.NotFoundError("Endpoint Not Found"));const i=yield exports.UserModel.create({name:"Admin",username:"admin",email:"admin@localhost.com",notes:"",status:exports.UserStatus.ACTIVE},Object.assign({},{ctx:e})).catch(this.error);if(!i)return e.error(new t.InternalServerError);yield this.userService.createPassword(i.id,"admin",e);const s=yield exports.GroupModel.create({name:"root",description:"Root",active:!0},Object.assign({},{ctx:e}));yield exports.UserGroupModel.create({user_id:i.id,group_id:s.id},Object.assign({},{ctx:e})),yield exports.GroupModel.create({name:"admin",description:"Admin",active:!0},Object.assign({},{ctx:e})),yield exports.GroupModel.create({name:"user",description:"User",active:!0},Object.assign({},{ctx:e}));const n=null!==(r=yield exports.PermissionModel.findAll({where:{active:!0}}).catch(this.error))&&void 0!==r?r:[];yield o.forEachSeries(n,t=>m(this,void 0,void 0,function*(){yield exports.GroupPermissionModel.create({group_id:s.id,permission_id:t.id},Object.assign({},{ctx:e}))})),e.success("OK")})}},g([t.Get(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.SetupController.prototype,"setup",null),exports.SetupController=g([t.Controller("/setup"),t.Extends(exports.BaseController)],exports.SetupController),exports.TestController=class TestController extends exports.BaseController{json(e){return m(this,void 0,void 0,function*(){e.json({ok:!0,message:"hello",timestamp:Date.now()})})}sum(e,t){return m(this,void 0,void 0,function*(){const{a:t,b:r}=e;return{value:t+r}})}multiply(e,t){return m(this,void 0,void 0,function*(){const{a:t,b:r}=e;return{value:t*r}})}average(e,t){return m(this,void 0,void 0,function*(){const t=e.values;return{value:t.reduce((e,t)=>e+t,0)/t.length,count:t.length}})}validationString(e,t){return m(this,void 0,void 0,function*(){const t=e.text;return{length:t.length,normalized:t.trim()}})}validationNumber(e,t){return m(this,void 0,void 0,function*(){return{doubled:2*e.value}})}validationBoolean(e,t){return m(this,void 0,void 0,function*(){return{active:e.active}})}validationArray(e,t){return m(this,void 0,void 0,function*(){return{count:e.tags.length}})}validationObject(e,t){return m(this,void 0,void 0,function*(){const t=e.profile;return{summary:{name:t.name,adult:t.age>=18}}})}validationEnum(e,t){return m(this,void 0,void 0,function*(){return{status:e.status}})}validationDate(e,t){return m(this,void 0,void 0,function*(){const t=e.date;return{iso:t.toISOString(),timestamp:t.getTime()}})}validationOptional(e,t){return m(this,void 0,void 0,function*(){const t=e.nickname;return Object.assign({name:e.name,hasNickname:Boolean(t)},t?{nickname:t}:{})})}validationDefaults(e,t){return m(this,void 0,void 0,function*(){return{name:e.name,limit:e.limit}})}validationParse(e,t){return m(this,void 0,void 0,function*(){return{active:e.active,amount:e.amount}})}validationNested(e,t){return m(this,void 0,void 0,function*(){const t=e.payload;return{userId:t.user.id,scoreCount:t.scores.length}})}},g([t.Get(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.TestController.prototype,"json",null),g([W({name:"sum",title:"Somar numeros",description:"Soma dois numeros.",input:{a:o.Validation.number().description("valor a"),b:o.Validation.number().description("valor b")},output:{value:o.Validation.number().description("resultado da soma de a + b")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"sum",null),g([W({name:"multiply",title:"Multiplicar numeros",description:"Multiplica dois numeros.",input:{a:o.Validation.number().description("valor a"),b:o.Validation.number().description("valor b")},output:{value:o.Validation.number().description("resultado da multiplicação de a * b")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"multiply",null),g([W({name:"average",title:"Calcular media",description:"Calcula a media de uma lista de numeros.",input:{values:o.Validation.array(o.Validation.number().description("numero usado no calculo da media")).min(1).max(10).description("lista de numeros para calcular a media")},output:{value:o.Validation.number().description("media calculada"),count:o.Validation.number().description("quantidade de numeros usados")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"average",null),g([W({name:"validation.string",title:"Validacao de string",description:"Exemplo de validacao de texto com tamanho minimo e maximo.",input:{text:o.Validation.string().min(5).max(50).description("Texto entre 5 e 50 caracteres.")},output:{length:o.Validation.number().description("Quantidade de caracteres do texto."),normalized:o.Validation.string().description("Texto normalizado sem espacos nas pontas.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationString",null),g([W({name:"validation.number",title:"Validacao de number",description:"Exemplo de validacao numerica com minimo e maximo.",input:{value:o.Validation.number().min(0).max(100).description("Numero entre 0 e 100.")},output:{doubled:o.Validation.number().description("Numero multiplicado por dois.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationNumber",null),g([W({name:"validation.boolean",title:"Validacao de boolean",description:"Exemplo de validacao de booleano sem parse implicito.",input:{active:o.Validation.boolean().description("Indica se o registro esta ativo.")},output:{active:o.Validation.boolean().description("Booleano validado.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationBoolean",null),g([W({name:"validation.array",title:"Validacao de array",description:"Exemplo de validacao de array com limites e item tipado.",input:{tags:o.Validation.array(o.Validation.string().min(2).max(20).description("Tag entre 2 e 20 caracteres.")).min(1).max(5).description("Lista de tags entre 1 e 5 itens.")},output:{count:o.Validation.number().description("Quantidade de tags recebidas.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationArray",null),g([W({name:"validation.object",title:"Validacao de object",description:"Exemplo de validacao de objeto simples.",input:{profile:o.Validation.object({name:o.Validation.string().min(2).max(60).description("Nome do perfil."),age:o.Validation.number().min(0).max(120).description("Idade do perfil."),nickname:o.Validation.string().empty().max(30).description("Apelido opcional do perfil.")}).description("Objeto de perfil.")},output:{summary:o.Validation.object({name:o.Validation.string().description("Nome validado."),adult:o.Validation.boolean().description("Indica se a idade e maior ou igual a 18.")}).description("Resumo do perfil.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationObject",null),g([W({name:"validation.enum",title:"Validacao de enum",description:"Exemplo de validacao de lista fechada de valores.",input:{status:o.Validation.enum(["draft","active","archived"]).description("Status permitido.")},output:{status:o.Validation.string().description("Status validado.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationEnum",null),g([W({name:"validation.date",title:"Validacao de date",description:"Exemplo de validacao e parse de data.",input:{date:o.Validation.date().parse().description("Data em formato aceito pelo Date.")},output:{iso:o.Validation.string().description("Data em ISO string."),timestamp:o.Validation.number().description("Data em timestamp Unix em milissegundos.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationDate",null),g([W({name:"validation.optional",title:"Validacao de campo opcional",description:"Exemplo de campo opcional aceitando ausencia.",input:{name:o.Validation.string().min(2).description("Nome obrigatorio."),nickname:o.Validation.string().empty().max(30).description("Apelido opcional.")},output:{name:o.Validation.string().description("Nome validado."),hasNickname:o.Validation.boolean().description("Indica se apelido foi enviado."),nickname:o.Validation.string().empty().description("Apelido validado quando enviado.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationOptional",null),g([W({name:"validation.defaults",title:"Validacao de valores padrao",description:"Exemplo de campos opcionais com valores padrao.",input:{name:o.Validation.string().default("guest").description("Nome opcional com valor padrao."),limit:o.Validation.number().parse().default(10).min(1).max(100).description("Limite opcional com valor padrao.")},output:{name:o.Validation.string().description("Nome final."),limit:o.Validation.number().description("Limite final.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationDefaults",null),g([W({name:"validation.parse",title:"Validacao com parse",description:"Exemplo de parse de boolean e number antes da validacao final.",input:{active:o.Validation.boolean().parse().default(!1).description("Booleano aceitando valores parseaveis."),amount:o.Validation.number().parse().min(1).max(1e3).description("Numero aceitando string numerica.")},output:{active:o.Validation.boolean().description("Booleano parseado."),amount:o.Validation.number().description("Numero parseado.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationParse",null),g([W({name:"validation.nested",title:"Validacao de objeto aninhado",description:"Exemplo de objeto aninhado com array interno.",input:{payload:o.Validation.object({user:o.Validation.object({id:o.Validation.string().min(3).max(30).description("Identificador do usuario."),email:o.Validation.string().email().description("Email do usuario.")}).description("Usuario do payload."),scores:o.Validation.array(o.Validation.number().min(0).max(100).description("Pontuacao individual.")).min(1).max(3).description("Pontuacoes do usuario.")}).description("Payload aninhado.")},output:{userId:o.Validation.string().description("Identificador validado."),scoreCount:o.Validation.number().description("Quantidade de pontuacoes.")}}),h("design:type",Function),h("design:paramtypes",[Object,Object]),h("design:returntype",Promise)],exports.TestController.prototype,"validationNested",null),exports.TestController=g([t.Controller("/test"),t.Extends(exports.BaseController)],exports.TestController),exports.UsersController=class UsersController extends exports.ModelController{constructor(){super(),this.model=exports.UserModel,this.path=Env.HTTP_PUBLIC+"/avatar",Env.HTTP_PUBLIC&&u.existsSync(Env.HTTP_PUBLIC)&&!u.existsSync(this.path)&&u.mkdirSync(this.path)}avatar(e,r){return m(this,void 0,void 0,function*(){var o;const i=e.getFiles();if(i.file&&i.file.length){const{filename:s,path:n}=null!==(o=i.file[0])&&void 0!==o?o:{};if(s){const o=yield exports.UserModel.findOne({where:{id:r.id}}).catch(this.error);if(!o)return u.lstatSync(n).isFile()&&u.rmSync(n),e.error(new t.InternalServerError);const i=this.path+"/"+o.metadata.avatar_url;if(u.existsSync(i)&&u.lstatSync(i).isFile()&&u.rmSync(i),o.changed("metadata",!0),o.metadata.avatar_url=s,yield o.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK")}}e.success("Record not Changed")})}token_new(){return m(this,void 0,void 0,function*(){var e;const t=o.uuidv7();return(null!==(e=yield this.model.count({where:{token:t}}).catch(this.error))&&void 0!==e?e:0)?this.token_new():t})}add(e){return m(this,void 0,void 0,function*(){yield this.create({ctx:e})})}all(e){return m(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}rows(e){return m(this,void 0,void 0,function*(){yield this.countAll({ctx:e})})}del(e,r,o){return m(this,void 0,void 0,function*(){if(o.id==r)return e.error(new t.NotFoundError);yield this.delete({ctx:e})})}get(e){return m(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}set(e){return m(this,void 0,void 0,function*(){yield this.update({ctx:e})})}},g([t.Post("/avatar"),P(),t.Upload({file:{count:1,path:`${Env.HTTP_PUBLIC}/avatar`,types:["image/bmp","image/jpeg","image/png"],size:32}}),v(0,t.Ctx()),v(1,D()),h("design:type",Function),h("design:paramtypes",[t.Context,exports.UserModel]),h("design:returntype",Promise)],exports.UsersController.prototype,"avatar",null),g([t.Post(),P(),A(),t.Validate(e=>({name:e.string(),email:e.string().email(),username:e.string().min(3),notes:e.string().default(""),status:e.enum(Object.keys(exports.UserStatus)).default(exports.UserStatus.ACTIVE),metadata:e.object().parse().default({})})),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.UsersController.prototype,"add",null),g([t.Get(),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.UsersController.prototype,"all",null),g([t.Get("/count"),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.UsersController.prototype,"rows",null),g([t.Delete("/:id"),P(),_(),v(0,t.Ctx()),v(1,t.Params("id")),v(2,D()),h("design:type",Function),h("design:paramtypes",[t.Context,String,exports.UserModel]),h("design:returntype",Promise)],exports.UsersController.prototype,"del",null),g([t.Get("/:id"),P(),T(),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.UsersController.prototype,"get",null),g([t.Put("/:id"),P(),O(),t.Validate(e=>({name:e.string().optional(),email:e.string().email().optional(),username:e.string().min(3).optional(),notes:e.string().optional(),status:e.enum(Object.keys(exports.UserStatus)).optional(),metadata:e.object().parse().optional()})),v(0,t.Ctx()),h("design:type",Function),h("design:paramtypes",[t.Context]),h("design:returntype",Promise)],exports.UsersController.prototype,"set",null),exports.UsersController=g([t.Controller("/users"),t.Extends(exports.ModelController),h("design:paramtypes",[])],exports.UsersController),exports.UsersGroupsController=class UsersGroupsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.UserGroupModel,this.permissions=[]}all(e,r){return m(this,void 0,void 0,function*(){if(!(yield exports.UserModel.findByPk(r,{attributes:["id"]}).catch(this.error)))return e.error(new t.NotFoundError("User Not Found"));yield this.findAll({ctx:e,options:{where:{user_id:r},include:[{association:"group"}]},callback:e=>e.map(e=>e.group),query:!1})})}set(e,r,i){return m(this,void 0,void 0,function*(){const n=yield exports.UserModel.findByPk(r,{attributes:["id"]}).catch(this.error);if(!n)return e.error(new t.NotFoundError("User Not Found"));const d=n.id,a=[];yield o.forEachSeries(o.uniqueArray(i),t=>m(this,void 0,void 0,function*(){var r;if(!(yield exports.GroupModel.count({where:{id:t}})))return;const[o]=null!==(r=yield exports.UserGroupModel.findOrCreate(Object.assign({where:{user_id:d,group_id:t},defaults:{user_id:d,group_id:t}},{ctx:e})).catch(this.error))&&void 0!==r?r:[];o&&a.push(t)})),yield exports.UserGroupModel.destroy(Object.assign({where:{user_id:d,group_id:{[s.Op.notIn]:a}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}},g([t.Get("/:id/groups"),P(),T("users"),v(0,t.Ctx()),v(1,t.Params("id")),h("design:type",Function),h("design:paramtypes",[t.Context,String]),h("design:returntype",Promise)],exports.UsersGroupsController.prototype,"all",null),g([t.Put("/:id/groups"),P(),O("users"),t.Validate(e=>({groups:e.array(e.string().uuid())})),v(0,t.Ctx()),v(1,t.Params("id")),v(2,t.Body("groups")),h("design:type",Function),h("design:paramtypes",[t.Context,String,Array]),h("design:returntype",Promise)],exports.UsersGroupsController.prototype,"set",null),exports.UsersGroupsController=g([t.Controller("/users"),t.Extends(exports.ModelController)],exports.UsersGroupsController),exports.Application=Application,exports.Audit=te,exports.CanCreate=A,exports.CanDelete=_,exports.CanRead=T,exports.CanUpdate=O,exports.Config=class Config extends Loggable{static all(e){return m(this,void 0,void 0,function*(){var t;const r=null!==(t=yield exports.ConfigModel.findAll({where:(null==e?void 0:e.length)?{key:{[s.Op.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[];return Object.fromEntries(r.map(e=>[e.key,e.value]))})}static del(e){return m(this,void 0,void 0,function*(){return((yield exports.ConfigModel.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return m(this,arguments,void 0,function*(e,t=""){const[r]=(yield exports.ConfigModel.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];return r?r.value:t})}static set(e,t){return m(this,void 0,void 0,function*(){const[r,o]=(yield exports.ConfigModel.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];r&&!o&&(r.value=t,yield r.save().catch(this.error))})}},exports.Env=Env,exports.HasGroups=(...e)=>(r,i,s)=>{t.Use(r=>m(void 0,void 0,void 0,function*(){const{groups:i=[]}=r.req;if(o.includesArray(e,i))return r.next();r.error(new t.UnauthorizedError("Access Denied"))}))(r,i,s)},exports.HasPermissions=(...e)=>(r,i,s)=>{t.Use(r=>m(void 0,void 0,void 0,function*(){const{permissions:i}=r.req;if(o.includesArray(e,null!=i?i:[]))return r.next();r.error(new t.UnauthorizedError("Access Denied"))}))(r,i,s)},exports.IsAuthenticated=P,exports.Log=Log,exports.Loggable=Loggable,exports.MCP_DEFAULT_PROTOCOL_VERSION=B,exports.MCP_HTTP_ALLOW=K,exports.MCP_HTTP_ALLOWED_METHODS=k,exports.MCP_PROTOCOL_VERSION_HEADER=G,exports.MCP_SESSION_ID_HEADER=q,exports.MCP_SUPPORTED_PROTOCOL_VERSIONS=H,exports.MCP_TOOL_METADATA=Y,exports.McpError=McpError,exports.McpErrorCode=j,exports.McpHttpHandler=McpHttpHandler,exports.McpInternalError=class McpInternalError extends McpError{constructor(e="Internal error",t){super(e,j.InternalError,200,t)}},exports.McpInvalidParamsError=McpInvalidParamsError,exports.McpInvalidRequestError=McpInvalidRequestError,exports.McpInvalidSessionError=McpInvalidSessionError,exports.McpMethodNotFoundError=McpMethodNotFoundError,exports.McpParseError=McpParseError,exports.McpRateLimiter=McpRateLimiter,exports.McpServerError=McpServerError,exports.McpSessionStore=McpSessionStore,exports.McpTool=W,exports.McpToolNotFoundError=McpToolNotFoundError,exports.McpToolRegistry=McpToolRegistry,exports.ModelService=ModelService,exports.ReqAuth=b,exports.ReqGroup=I,exports.ReqGroups=w,exports.ReqPermission=R,exports.ReqPermissions=U,exports.ReqUser=D,exports.SessionStore=SessionStore,exports.assertValidMcpToolDefinition=$,exports.canFactory=S,exports.isJsonParseError=z,exports.isJsonRpcId=N,exports.jsonParseErrorResponse=e=>{if(z(e))return{status:400,body:V(null,new McpParseError("Parse error",{message:e.message}))}},exports.jsonRpcError=V,exports.jsonRpcErrorFromCode=(e,t,r,o)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t,message:r},void 0!==o?{data:o}:{})}),exports.jsonRpcResult=L,exports.parseJsonRpcRequest=F,exports.sequelize=y;
+"use strict";var e,t=require("@andrewcaires/express"),r=require("@andrewcaires/node"),o=require("@andrewcaires/utils.js"),i=require("ws"),s=require("@andrewcaires/sequelize"),n=require("dotenv"),d=require("@andrewcaires/decorator"),a=require("express-session"),l=require("jsonwebtoken"),p=require("@node-rs/argon2"),u=require("fs"),c=require("path");function g(e,t,r,o){var i,s=arguments.length,n=s<3?t:null===o?o=Object.getOwnPropertyDescriptor(t,r):o;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)n=Reflect.decorate(e,t,r,o);else for(var d=e.length-1;d>=0;d--)(i=e[d])&&(n=(s<3?i(n):s>3?i(t,r,n):i(t,r))||n);return s>3&&n&&Object.defineProperty(t,r,n),n}function v(e,t){return function(r,o){t(r,o,e)}}function m(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function h(e,t,r,o){return new(r||(r=Promise))(function(i,s){function n(e){try{a(o.next(e))}catch(e){s(e)}}function d(e){try{a(o.throw(e))}catch(e){s(e)}}function a(e){var t;e.done?i(e.value):(t=e.value,t instanceof r?t:new r(function(e){e(t)})).then(n,d)}a((o=o.apply(e,t||[])).next())})}"function"==typeof SuppressedError&&SuppressedError,n.config({quiet:!0});class Env extends r.Env{}e=Env,Env.BASE_NAME=e.getString("BASE_NAME",""),Env.CONSOLE_ERROR=e.getBool("CONSOLE_ERROR",!1),Env.DATABASE_URI=e.getString("DATABASE_URI","",!0),Env.DATABASE_LOG=e.getBool("DATABASE_LOG",!1),Env.DATABASE_AUDIT=e.getBool("DATABASE_AUDIT",!0),Env.DATABASE_PREFIX=e.getString("DATABASE_PREFIX",""),Env.DATABASE_TIMEZONE=e.getString("DATABASE_TIMEZONE","+00:00"),Env.HTTP_CROSS=e.getString("HTTP_CROSS",""),Env.HTTP_PORT=e.getInt("HTTP_PORT",e.getInt("PORT",3e3)),Env.HTTP_PUBLIC=e.getString("HTTP_PUBLIC",""),Env.HTTP_TLS_CA=e.getFile("HTTP_TLS_CA"),Env.HTTP_TLS_CRT=e.getFile("HTTP_TLS_CRT"),Env.HTTP_TLS_KEY=e.getFile("HTTP_TLS_KEY"),Env.KEY_HEADER=e.getString("KEY_HEADER","x-api-key"),Env.MODEL_LIMIT=e.getInt("MODEL_LIMIT",10),Env.MODEL_LIMIT_MAX=e.getInt("MODEL_LIMIT_MAX",100),Env.MCP_SESSION_TTL=e.getMs("MCP_SESSION_TTL","30m"),Env.PASSWORD_ALGORITHM=e.getInt("PASSWORD_ALGORITHM",2),Env.PASSWORD_MEMORY_COST=e.getInt("PASSWORD_MEMORY_COST",4096),Env.PASSWORD_PARALLELISM=e.getInt("PASSWORD_PARALLELISM",1),Env.PASSWORD_PEPPER=e.getString("PASSWORD_PEPPER",""),Env.PASSWORD_TIME_COST=e.getInt("PASSWORD_TIME_COST",3),Env.SLEEP_AUTH=e.getMs("SLEEP_AUTH","2s"),Env.SLEEP_FORGOT=e.getMs("SLEEP_FORGOT","5s"),Env.SLEEP_REGISTRY=e.getMs("SLEEP_REGISTRY","5s"),Env.TENANT_HEADER=e.getString("TENANT_HEADER","x-tenant-id"),Env.TOKEN_CRT=e.getFile("TOKEN_CRT"),Env.TOKEN_HEADER=e.getString("TOKEN_HEADER","authorization"),Env.TOKEN_KEY=e.getFile("TOKEN_KEY"),Env.TOKEN_TTL=e.getMs("TOKEN_TTL","1d"),Env.TOKEN_TTL_FORGOT=e.getMs("TOKEN_TTL_FORGOT","1d"),Env.TOKEN_TTL_RENEW=e.getMs("TOKEN_TTL_RENEW","1d"),Env.TOKEN_TYPE=e.getString("TOKEN_TYPE","bearer"),Env.API_BODYPARSER_STRICT=e.getBool("API_BODYPARSER_STRICT",!0),Env.API_BODYPARSER_INFLATE=e.getBool("API_BODYPARSER_INFLATE",!0),Env.API_BODYPARSER_LIMIT=e.getString("API_BODYPARSER_LIMIT","10mb"),Env.API_BODYPARSER_TYPE=e.getString("API_BODYPARSER_TYPE","json"),Env.API_HTTP_HYBRID=e.getBool("API_HTTP_HYBRID",!1),Env.API_HTTP_NOTFOUND=e.getString("API_HTTP_NOTFOUND",""),Env.API_HTTP_PATH=e.getString("API_HTTP_PATH","/api"),Env.API_HTTP_REDIRECT=e.getString("API_HTTP_REDIRECT",""),Env.API_KEY_HASH=e.getString("API_KEY_HASH",""),Env.API_SESSION_NAME=e.getString("API_SESSION_NAME","session.id"),Env.API_SESSION_LIFETIME=e.getMs("API_SESSION_LIFETIME","1d"),Env.API_SESSION_SECRET=e.getString("API_SESSION_SECRET","yoursecret"),Env.API_TOKEN_COOKIE=e.getString("API_TOKEN_COOKIE","authorization"),Env.API_TOKEN_COOKIE_SET=e.getBool("API_TOKEN_COOKIE_SET",!0),Env.API_USER_HISTORY=e.getBool("API_USER_HISTORY",!0),Env.API_WEBSOCKET_START=e.getBool("API_WEBSOCKET_START",!1);const y=new s.Sequelize({uri:Env.DATABASE_URI,logging:!!Env.DATABASE_LOG&&(e=>r.Log.console(r.LogColor.Magenta,"sql",e)),prefix:Env.DATABASE_PREFIX,timezone:Env.DATABASE_TIMEZONE});var x,E,C,M,S;exports.AuditTypes=void 0,(x=exports.AuditTypes||(exports.AuditTypes={})).CREATE="CREATE",x.DELETE="DELETE",x.UPDATE="UPDATE",exports.GroupTypes=void 0,(E=exports.GroupTypes||(exports.GroupTypes={})).SYSTEM="system",E.TENANT="tenant",exports.LogLevels=void 0,(C=exports.LogLevels||(exports.LogLevels={})).INFO="info",C.WARN="warn",C.ERROR="error",exports.TenantStatus=void 0,(M=exports.TenantStatus||(exports.TenantStatus={})).ACTIVE="active",M.PENDING="pending",M.SUSPENDED="suspended",M.DISABLED="disabled",M.ARCHIVED="archived",exports.UserStatus=void 0,(S=exports.UserStatus||(exports.UserStatus={})).ACTIVE="active",S.PENDING="pending",S.DISABLED="disabled",S.LOCKED="locked",S.ARCHIVED="archived";const f=e=>r=>(i,s,n)=>{t.Use(i=>h(void 0,void 0,void 0,function*(){var s;o.isUndefined(r)&&(r=o.isFunction(i.controller.name)?i.controller.name():null===(s=i.controller.constructor)||void 0===s?void 0:s.name);const{permissions:n=[]}=i.req;if(n.includes(`${r}.${e}`))return i.next();i.error(new t.UnauthorizedError("Access Denied"))}))(i,s,n)},A=f("create"),T=f("delete"),_=f("read"),O=f("update"),P=()=>(e,r,o)=>{t.Use(e=>h(void 0,void 0,void 0,function*(){yield(e=>h(void 0,void 0,void 0,function*(){var r,o,i,s;if(e.req.auth&&e.req.user)return e.next();const{[Env.KEY_HEADER]:n,[Env.TOKEN_HEADER]:d,[Env.TENANT_HEADER]:a,"user-agent":l}=e.getHeaders(),p=e.getQuery(Env.KEY_HEADER),u=(null===(r=n||p)||void 0===r?void 0:r.toString())||"";let c=e.getCookie(Env.API_TOKEN_COOKIE);c=`${Env.TOKEN_TYPE} ${c}`;const[g,v]=null!==(i=null===(o=d||c)||void 0===o?void 0:o.split(" "))&&void 0!==i?i:["",""];if(!(u||v&&g.toLowerCase()==Env.TOKEN_TYPE))return e.error(new t.UnauthorizedError("Invalid token"));const{authService:m,userService:h}=e.app,{auth:y,user:x}=null!==(s=yield(u?m.key(u.toString()):m.user(v)).catch(t=>{e.error(t)}))&&void 0!==s?s:{};if(!y||!x)return;if(!u&&y.user_agent&&y.user_agent!=l)return e.error(new t.UnauthorizedError("Invalid token"));e.req.auth=y,e.req.user=x;const E=a||null,C=yield h.getTenants(x.id);if(E&&!C.find(e=>e.id==E))return e.error(new t.UnauthorizedError("Invalid token"));const M=h.getGroups(x.id,E),S=h.getPermissions(x.id,E),[f,A]=yield Promise.all([M,S]);e.req.groups=f,e.req.permissions=A,e.req.tenants=C,e.next()}))(e)}))(e,r,o)},b=t.parameterFactory(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.auth}),I=t.parameterFactory(({ctx:e,key:t})=>{var r,o;return(null!==(o=null===(r=e.req)||void 0===r?void 0:r.groups)&&void 0!==o?o:[]).includes(t)}),w=t.parameterFactory(({ctx:e})=>{var t,r;return null!==(r=null===(t=e.req)||void 0===t?void 0:t.groups)&&void 0!==r?r:[]}),R=t.parameterFactory(({ctx:e,key:t})=>{var r,o;return(null!==(o=null===(r=e.req)||void 0===r?void 0:r.permissions)&&void 0!==o?o:[]).includes(t)}),U=t.parameterFactory(({ctx:e})=>{var t,r;return null!==(r=null===(t=e.req)||void 0===t?void 0:t.permissions)&&void 0!==r?r:[]}),D=t.parameterFactory(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.user}),j={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,ServerError:-32e3,InvalidSession:-32001};class McpError extends t.ResponseError{constructor(e,t=j.ServerError,r=200,o){super(e,r),this.code=t,this.data=o,this.name=this.constructor.name}}class McpParseError extends McpError{constructor(e="Parse error",t){super(e,j.ParseError,400,t)}}class McpInvalidRequestError extends McpError{constructor(e="Invalid Request",t){super(e,j.InvalidRequest,400,t)}}class McpMethodNotFoundError extends McpError{constructor(e){super(`Method not found: ${e}`,j.MethodNotFound,200)}}class McpInvalidParamsError extends McpError{constructor(e="Invalid params",t){super(e,j.InvalidParams,200,t)}}class McpServerError extends McpError{constructor(e="Server error",t){super(e,j.ServerError,500,t)}}class McpInvalidSessionError extends McpError{constructor(e="Invalid MCP session",t=404){super(e,j.InvalidSession,t)}}class McpToolNotFoundError extends McpError{constructor(e){super("Tool not found",j.InvalidParams,200,{toolName:e})}}const N=e=>o.isString(e)||o.isNumber(e),V=(e,t)=>({jsonrpc:"2.0",id:e,result:t}),L=(e,t)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t.code,message:t.message},void 0!==t.data?{data:t.data}:{})}),F=e=>{if(!o.isPlainObject(e))throw new McpInvalidRequestError("Invalid Request");if("2.0"!==e.jsonrpc)throw new McpInvalidRequestError("Invalid JSON-RPC version");if(!o.isString(e.method))throw new McpInvalidRequestError("Invalid method");if(void 0!==e.id&&!N(e.id))throw new McpInvalidRequestError("Invalid id");return e},B=["2025-11-25","2025-06-18"],H=B[0],G="MCP-Protocol-Version",k="MCP-Session-Id",q=["POST","DELETE","OPTIONS"],K=q.join(", "),z=e=>{if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode};class McpHttpHandler{constructor(e){var t,r;this.sessions=e.sessions,this.tools=e.tools,this.logger=e.logger,this.serverName=null!==(t=e.serverName)&&void 0!==t?t:"andrewcaires-api-mcp",this.serverVersion=null!==(r=e.serverVersion)&&void 0!==r?r:"1.0.0"}post(e){return h(this,void 0,void 0,function*(){var t;let r=null;try{const o=F(e.getBody());if(r=null!==(t=o.id)&&void 0!==t?t:null,"initialize"===o.method)return this.withTransportHeaders(this.initialize(o.id,o.params));if("notifications/initialized"===o.method)return this.withTransportHeaders(this.initialized(o.id,o.params,e));if("ping"===o.method)return this.validateObjectParams(o.params),this.withTransportHeaders(this.withSession(o.id,e,e=>({status:200,body:V(e,{})})));if("tools/list"===o.method)return this.validateObjectParams(o.params),this.withTransportHeaders(this.withInitializedSession(o.id,e,e=>({status:200,body:V(e,{tools:this.tools.list()})})));if("tools/call"===o.method)return this.withTransportHeaders(yield this.callTool(o.id,o.params,e));if(void 0===o.id)return this.withTransportHeaders({status:202});throw new McpMethodNotFoundError(o.method)}catch(e){return this.withTransportHeaders(this.errorResponse(r,e))}})}delete(e){const t=e.getHeader("mcp-session-id");if(!t)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError(`${k} header is required`,400)));return this.sessions.get(t)?(this.sessions.delete(t),this.withTransportHeaders({status:204})):this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError))}initialize(e,t){const r=this.requireRequestId({jsonrpc:"2.0",id:e,method:"initialize",params:t}),o=this.negotiateProtocolVersion(t),i=this.sessions.create(o);return{status:200,headers:{[k]:i.sessionId,[G]:i.protocolVersion},body:V(r,{protocolVersion:i.protocolVersion,capabilities:{tools:{listChanged:!1}},serverInfo:{name:this.serverName,version:this.serverVersion}})}}initialized(e,t,r){if(void 0!==e)throw new McpInvalidRequestError("notifications/initialized must not include id");this.validateObjectParams(t);const o=this.requireSession(r);return this.sessions.markInitialized(o.sessionId),{status:202}}callTool(e,t,r){return h(this,void 0,void 0,function*(){return this.withInitializedSession(e,r,(e,r)=>h(this,void 0,void 0,function*(){var o;const i=this.parseToolCallParams(t),s=Date.now();let n,d=!1;try{const t=yield this.tools.call(i.name,i.arguments,r);return d=!t.isError,n=t.isError?"Tool execution failed":void 0,{status:200,body:V(e,t)}}catch(e){if(e instanceof McpError)throw n=e.message,e;throw n="Internal error",e}finally{null===(o=this.logger)||void 0===o||o.toolCall(Object.assign({sessionId:r.sessionId,toolName:i.name,durationMs:Date.now()-s,success:d},n?{error:n}:{}))}}))})}requireRequestId(e){if(!N(e.id))throw new McpInvalidRequestError("Request id is required");return e.id}withSession(e,t,r){return r(this.requireRequestId({jsonrpc:"2.0",id:e,method:"session"}),this.requireSession(t))}withInitializedSession(e,t,r){return this.withSession(e,t,(e,t)=>{if(!t.initialized)throw new McpInvalidRequestError("Session not initialized");return r(e,t)})}requireSession(e){const t=e.getHeader("mcp-session-id");if(!t)throw new McpInvalidSessionError(`${k} header is required`,400);return this.sessions.require(t)}negotiateProtocolVersion(e){if(!o.isPlainObject(e)||!o.isString(e.protocolVersion))throw new McpInvalidParamsError("params.protocolVersion is required");return B.includes(e.protocolVersion)?e.protocolVersion:H}parseToolCallParams(e){if(!o.isPlainObject(e)||!o.isString(e.name))throw new McpInvalidParamsError("params.name is required");return{name:e.name,arguments:e.arguments}}validateObjectParams(e){if(void 0!==e&&!o.isPlainObject(e))throw new McpInvalidParamsError("params must be an object")}withTransportHeaders(e){var t;return Object.assign(Object.assign({},e),{headers:Object.assign({Allow:K,"Access-Control-Allow-Methods":K,"Access-Control-Allow-Headers":`Content-Type, Accept, ${k}, ${G}`},null!==(t=e.headers)&&void 0!==t?t:{})})}errorResponse(e,t){if(t instanceof McpError)return{status:t.status,body:L(e,t)};const r=new McpServerError;return{status:r.status,body:L(e,r)}}}class McpSessionStore{constructor(e=18e5,t=()=>Date.now()){this.sessions=new Map,this.ttl=e,this.now=t}create(e){this.cleanup();const t=this.now(),r={sessionId:o.uuidv7(),createdAt:t,expiresAt:t+this.ttl,protocolVersion:e,initialized:!1};return this.sessions.set(r.sessionId,r),r}get(e){this.cleanup();const t=this.sessions.get(e);if(t){if(!this.isExpired(t))return t;this.sessions.delete(e)}}require(e){const t=this.get(e);if(!t)throw new McpInvalidSessionError;return t}markInitialized(e){const t=this.require(e);return t.initialized=!0,t}delete(e){return this.cleanup(),this.sessions.delete(e)}cleanup(){const e=this.now();for(const[t,r]of this.sessions)r.expiresAt<=e&&this.sessions.delete(t)}size(){return this.cleanup(),this.sessions.size}isExpired(e){return e.expiresAt<=this.now()}}const Y=Symbol.for("@andrewcaires/api:mcp:tool"),$=e=>{if(!o.isString(e.name)||!e.name.trim())throw new Error("MCP tool name is required");if(!o.isString(e.title)||!e.title.trim())throw new Error(`MCP tool "${e.name}" title is required`);if(!o.isString(e.description)||!e.description.trim())throw new Error(`MCP tool "${e.name}" description is required`);if(o.isUndefined(e.input))throw new Error(`MCP tool "${e.name}" input must be declared`)};class McpToolRegistry{constructor(e=[]){this.tools=new Map,e.forEach(e=>this.register(e))}register(e){var t,r;if($(e),this.tools.has(e.name))throw new Error(`Duplicate MCP tool name: ${e.name}`);const o=this.normalizeMcpValidation(null!==(t=e.input)&&void 0!==t?t:{},"object"),i=e.output?this.normalizeMcpValidation(null!==(r=e.output)&&void 0!==r?r:{},"any"):void 0;this.tools.set(e.name,{inputSchema:o.schema,inputValidation:o.validation,outputSchema:null==i?void 0:i.schema,outputValidation:null==i?void 0:i.validation,tool:e})}list(){return Array.from(this.tools.values()).map(({tool:e})=>{var t,r,o,i;return Object.assign({name:e.name,title:e.title,description:e.description,inputSchema:null!==(r=null===(t=this.tools.get(e.name))||void 0===t?void 0:t.inputSchema)&&void 0!==r?r:{}},(null===(o=this.tools.get(e.name))||void 0===o?void 0:o.outputSchema)?{outputSchema:null===(i=this.tools.get(e.name))||void 0===i?void 0:i.outputSchema}:{})})}call(e,t,r){return h(this,void 0,void 0,function*(){var i;const s=this.tools.get(e);if(!s)throw new McpToolNotFoundError(e);const n=null!=t?t:{};if(!o.isPlainObject(n))return this.toolInputValidationError(["arguments must be an object"]);const d={session:r};let a=n;const l=this.validateAdditionalProperties(s.inputSchema,n);if(l.length)return this.toolInputValidationError(l);if(s.inputValidation){const e=s.inputValidation.validate(n,d);if(e.error)return this.toolInputValidationError([e.error]);a=null!==(i=e.value)&&void 0!==i?i:{}}try{const e=yield s.tool.run(a,d);if(!s.outputValidation&&this.isCallToolResult(e))return e;let t=e;if(s.outputValidation){const r=s.outputValidation.validate(e,d);if(r.error)return this.outputValidationError();t=r.value}return{content:[{type:"text",text:JSON.stringify(t)}],structuredContent:t}}catch(e){return{isError:!0,content:[{type:"text",text:"Tool execution failed."}]}}})}isCallToolResult(e){return o.isPlainObject(e)&&o.isArray(e.content)}normalizeMcpValidation(e,t="object"){if(o.isValidationShape(e)){const t=o.Validation.object(e).parse();return{schema:t.toSchema(),validation:t}}const r="object"===t?o.Validation.object({}).parse():o.Validation.any();return{schema:r.toSchema(),validation:r}}outputValidationError(){return{isError:!0,content:[{type:"text",text:"Tool output validation failed."}]}}toolInputValidationError(e){return{isError:!0,content:[{type:"text",text:"Invalid tool arguments."}],structuredContent:{errors:e}}}validateAdditionalProperties(e,t){if("object"!==e.type||!1!==e.additionalProperties||!o.isPlainObject(e.properties))return[];const r=Object.keys(e.properties);return Object.keys(t).filter(e=>!r.includes(e)).map(e=>`additional property "${e}" is not allowed`)}}const W=e=>($(e),(t,r)=>{J(r)?r.addInitializer(function(){Q(this.constructor,r.name,e)}):Q(t,r,e)}),J=e=>"object"==typeof e&&null!==e&&"kind"in e&&"method"===e.kind&&"name"in e&&"addInitializer"in e,Q=(e,t,r)=>{const o=d.metadata(Y,e,[]),i=Object.assign(Object.assign({},r),{propertyKey:t});o.some(e=>e.propertyKey===i.propertyKey&&e.name===i.name)||o.push(i)},X=(e,r,o)=>{var i,s,n,d,a,l,p,u,c,g,v;const m=o.ctx instanceof t.Context?o.ctx:null,h=null!==(i=null==m?void 0:m.id)&&void 0!==i?i:null,y=null!==(a=null!==(d=null===(n=null===(s=null==m?void 0:m.req)||void 0===s?void 0:s.user)||void 0===n?void 0:n.id)&&void 0!==d?d:o.user_id)&&void 0!==a?a:null,x={type:e,model:null!==(l=null==r?void 0:r.getTableName())&&void 0!==l?l:null,source:null!==(p=Env.BASE_NAME)&&void 0!==p?p:"",request_id:h,user_id:y};return m?Object.assign(Object.assign({},x),{full_url:null!==(u=m.getUrl())&&void 0!==u?u:"",ip_address:null!==(c=m.getIp())&&void 0!==c?c:"",user_agent:null!==(v=null===(g=m.req)||void 0===g?void 0:g.headers["user-agent"])&&void 0!==v?v:""}):x},Z=e=>{const t=o.getConstructor(e),r=t.primaryKeyAttribute;return{model:t,record_id:r?e.getDataValue(r):null}},ee={afterCreate:(e,t)=>h(void 0,void 0,void 0,function*(){const{model:o,record_id:i}=Z(e);yield exports.AuditModel.create(Object.assign(Object.assign({},X(exports.AuditTypes.CREATE,o,t)),{record:i,currently:e.toJSON()})).catch(r.Log.catch)}),afterUpdate:(e,t)=>h(void 0,void 0,void 0,function*(){const{model:o,record_id:i}=Z(e),s={},n={},d=e.changed();d&&d.length&&d.forEach(t=>{s[t]=e.getDataValue(t),n[t]=e.previous(t)}),yield exports.AuditModel.create(Object.assign(Object.assign({},X(exports.AuditTypes.UPDATE,o,t)),{record:i,currently:s,previously:n})).catch(r.Log.catch)}),afterDestroy:(e,t)=>h(void 0,void 0,void 0,function*(){const{model:o,record_id:i}=Z(e);yield exports.AuditModel.create(Object.assign(Object.assign({},X(exports.AuditTypes.DELETE,o,t)),{record:i,currently:e.toJSON()})).catch(r.Log.catch)})},te=e=>(o.isUndefined(e)&&(e=Env.DATABASE_AUDIT),s.Hooks(e?ee:{}));exports.RegisterModel=class RegisterModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.RegisterModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.RegisterModel.prototype,"secret",void 0),g([s.Column.FullDate(),m("design:type",Number)],exports.RegisterModel.prototype,"expired_at",void 0),g([s.Column.Boolean(),m("design:type",Boolean)],exports.RegisterModel.prototype,"active",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.RegisterModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.RegisterModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.RegisterModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.RegisterModel.prototype,"user_id",void 0),exports.RegisterModel=g([s.Database(y),s.ModelName("register"),s.Version("5.3.1")],exports.RegisterModel),exports.UserAuthModel=class UserAuthModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.UserAuthModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.UserAuthModel.prototype,"secret",void 0),g([s.Column.String(),m("design:type",String)],exports.UserAuthModel.prototype,"ip_address",void 0),g([s.Column.String(),m("design:type",String)],exports.UserAuthModel.prototype,"user_agent",void 0),g([s.Column.FullDate(),m("design:type",Object)],exports.UserAuthModel.prototype,"revoked_at",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.UserAuthModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.UserAuthModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.UserAuthModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.UserAuthModel.prototype,"user_id",void 0),exports.UserAuthModel=g([s.Database(y),s.ModelName("users_auth"),s.Version("5.3.1")],exports.UserAuthModel),exports.PermissionModel=class PermissionModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.PermissionModel.prototype,"id",void 0),g([s.Column.String(),s.Index(),m("design:type",String)],exports.PermissionModel.prototype,"name",void 0),g([s.Column.Text(),m("design:type",String)],exports.PermissionModel.prototype,"description",void 0),g([s.Column.Boolean(),m("design:type",Boolean)],exports.PermissionModel.prototype,"active",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),m("design:type",Object)],exports.PermissionModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.PermissionModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.PermissionModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.PermissionModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.GroupPermissionModel),m("design:type",Array)],exports.PermissionModel.prototype,"groups_permissions",void 0),exports.PermissionModel=g([s.Database(y),s.ModelName("permission"),te(),s.Version("5.3.1")],exports.PermissionModel),exports.GroupPermissionModel=class GroupPermissionModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.GroupPermissionModel.prototype,"id",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.GroupPermissionModel.prototype,"created_at",void 0),g([s.Association.BelongsTo(()=>exports.GroupModel),m("design:type",String)],exports.GroupPermissionModel.prototype,"group_id",void 0),g([s.Association.BelongsTo(()=>exports.PermissionModel),m("design:type",String)],exports.GroupPermissionModel.prototype,"permission_id",void 0),exports.GroupPermissionModel=g([s.Database(y),s.ModelName("groups_permissions"),te(),s.Version("5.3.1")],exports.GroupPermissionModel),exports.GroupModel=class GroupModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.GroupModel.prototype,"id",void 0),g([s.Column.String(),s.Index(),m("design:type",String)],exports.GroupModel.prototype,"name",void 0),g([s.Column.Text(),m("design:type",String)],exports.GroupModel.prototype,"description",void 0),g([s.Column.Enum(exports.GroupTypes),s.DefaultValue(exports.GroupTypes.SYSTEM),m("design:type",String)],exports.GroupModel.prototype,"type",void 0),g([s.Column.Boolean(),m("design:type",Boolean)],exports.GroupModel.prototype,"active",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),m("design:type",Object)],exports.GroupModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.GroupModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.GroupModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.GroupModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.UserGroupModel),m("design:type",Array)],exports.GroupModel.prototype,"users_groups",void 0),g([s.Association.HasMany(()=>exports.GroupPermissionModel),m("design:type",Array)],exports.GroupModel.prototype,"groups_Permission",void 0),exports.GroupModel=g([s.Database(y),s.ModelName("group"),te(),s.Version("5.3.1")],exports.GroupModel),exports.UserTenantModel=class UserTenantModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.UserTenantModel.prototype,"id",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.UserTenantModel.prototype,"created_at",void 0),g([s.Association.BelongsTo(()=>exports.TenantModel),m("design:type",String)],exports.UserTenantModel.prototype,"tenant_id",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.UserTenantModel.prototype,"user_id",void 0),exports.UserTenantModel=g([s.Database(y),s.ModelName("users_tenants"),te(),s.Version("5.3.1")],exports.UserTenantModel),exports.TenantModel=class TenantModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.TenantModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.TenantModel.prototype,"name",void 0),g([s.Column.Enum(exports.TenantStatus),s.DefaultValue(exports.TenantStatus.ACTIVE),m("design:type",String)],exports.TenantModel.prototype,"status",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),m("design:type",Object)],exports.TenantModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.TenantModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.TenantModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.TenantModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.UserTenantModel),m("design:type",Array)],exports.TenantModel.prototype,"users_tenants",void 0),exports.TenantModel=g([s.Database(y),s.ModelName("tenant"),te(),s.Version("5.3.1")],exports.TenantModel),exports.UserGroupModel=class UserGroupModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.UserGroupModel.prototype,"id",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.UserGroupModel.prototype,"created_at",void 0),g([s.Association.BelongsTo(()=>exports.GroupModel),m("design:type",String)],exports.UserGroupModel.prototype,"group_id",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.UserGroupModel.prototype,"user_id",void 0),g([s.Association.BelongsTo(()=>exports.TenantModel),m("design:type",String)],exports.UserGroupModel.prototype,"tenant_id",void 0),exports.UserGroupModel=g([s.Database(y),s.ModelName("users_groups"),te(),s.Version("5.3.1")],exports.UserGroupModel),exports.UserPasswordModel=class UserPasswordModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.UserPasswordModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.UserPasswordModel.prototype,"hash",void 0),g([s.Column.FullDate(),m("design:type",Object)],exports.UserPasswordModel.prototype,"revoked_at",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.UserPasswordModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.UserPasswordModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.UserPasswordModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.UserPasswordModel.prototype,"user_id",void 0),exports.UserPasswordModel=g([s.Database(y),s.ModelName("users_password"),te(),s.Version("5.3.1")],exports.UserPasswordModel),exports.UserModel=class UserModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.UserModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.UserModel.prototype,"name",void 0),g([s.Column.String(),m("design:type",String)],exports.UserModel.prototype,"username",void 0),g([s.Column.String(),m("design:type",String)],exports.UserModel.prototype,"email",void 0),g([s.Column.Text(),m("design:type",String)],exports.UserModel.prototype,"notes",void 0),g([s.Column.Enum(exports.UserStatus),s.DefaultValue(exports.UserStatus.ACTIVE),m("design:type",String)],exports.UserModel.prototype,"status",void 0),g([s.Column.Json(),s.DefaultValue(()=>({})),m("design:type",Object)],exports.UserModel.prototype,"metadata",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.UserModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.UserModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.UserModel.prototype,"deleted_at",void 0),g([s.Association.HasMany(()=>exports.AuditModel),m("design:type",Array)],exports.UserModel.prototype,"audits",void 0),g([s.Association.HasMany(()=>exports.UserAuthModel),m("design:type",Array)],exports.UserModel.prototype,"users_auths",void 0),g([s.Association.HasMany(()=>exports.RegisterModel),m("design:type",Array)],exports.UserModel.prototype,"registers",void 0),g([s.Association.HasMany(()=>exports.UserGroupModel),m("design:type",Array)],exports.UserModel.prototype,"users_groups",void 0),g([s.Association.HasMany(()=>exports.UserPasswordModel),m("design:type",Array)],exports.UserModel.prototype,"users_passwords",void 0),g([s.Association.HasMany(()=>exports.UserTenantModel),m("design:type",Array)],exports.UserModel.prototype,"users_tenants",void 0),exports.UserModel=g([s.Database(y),s.ModelName("user"),te(),s.Version("5.3.1")],exports.UserModel),exports.AuditModel=class AuditModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.AuditModel.prototype,"id",void 0),g([s.Column.Enum(exports.AuditTypes),m("design:type",String)],exports.AuditModel.prototype,"type",void 0),g([s.Column.String(),m("design:type",String)],exports.AuditModel.prototype,"model",void 0),g([s.Column.String(),m("design:type",String)],exports.AuditModel.prototype,"record",void 0),g([s.Column.Json(),m("design:type",Object)],exports.AuditModel.prototype,"currently",void 0),g([s.Column.Json(),m("design:type",Object)],exports.AuditModel.prototype,"previously",void 0),g([s.Column.String(36),m("design:type",String)],exports.AuditModel.prototype,"request_id",void 0),g([s.Column.Text(),m("design:type",String)],exports.AuditModel.prototype,"full_url",void 0),g([s.Column.String(),m("design:type",String)],exports.AuditModel.prototype,"ip_address",void 0),g([s.Column.Text(),m("design:type",String)],exports.AuditModel.prototype,"user_agent",void 0),g([s.Column.String(),m("design:type",String)],exports.AuditModel.prototype,"source",void 0),g([s.Column.FullDate(),m("design:type",Object)],exports.AuditModel.prototype,"reverted_at",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.AuditModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.AuditModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.AuditModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.AuditModel.prototype,"user_id",void 0),exports.AuditModel=g([s.Database(y),s.ModelName("audit"),s.Version("5.3.1")],exports.AuditModel),exports.ConfigModel=class ConfigModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.ConfigModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.ConfigModel.prototype,"key",void 0),g([s.Column.Text(),m("design:type",String)],exports.ConfigModel.prototype,"value",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.ConfigModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.ConfigModel.prototype,"updated_at",void 0),exports.ConfigModel=g([s.Database(y),s.ModelName("configs"),s.Version("5.3.1")],exports.ConfigModel),exports.ForgotModel=class ForgotModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.ForgotModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.ForgotModel.prototype,"secret",void 0),g([s.Column.FullDate(),m("design:type",Number)],exports.ForgotModel.prototype,"expired_at",void 0),g([s.Column.Boolean(),m("design:type",Boolean)],exports.ForgotModel.prototype,"active",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.ForgotModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.ForgotModel.prototype,"updated_at",void 0),g([s.Column.DeletedAt(),m("design:type",Object)],exports.ForgotModel.prototype,"deleted_at",void 0),g([s.Association.BelongsTo(()=>exports.UserModel),m("design:type",String)],exports.ForgotModel.prototype,"user_id",void 0),exports.ForgotModel=g([s.Database(y),s.ModelName("forgot"),s.Version("5.3.1")],exports.ForgotModel),exports.LogModel=class LogModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.LogModel.prototype,"id",void 0),g([s.Column.Enum(exports.LogLevels),s.DefaultValue(exports.LogLevels.INFO),m("design:type",String)],exports.LogModel.prototype,"level",void 0),g([s.Column.Text(),m("design:type",String)],exports.LogModel.prototype,"message",void 0),g([s.Column.String(),m("design:type",String)],exports.LogModel.prototype,"source",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.LogModel.prototype,"created_at",void 0),exports.LogModel=g([s.Database(y),s.ModelName("log"),s.Version("5.3.1")],exports.LogModel),exports.MigrationModel=class MigrationModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.MigrationModel.prototype,"id",void 0),g([s.Column.String(),m("design:type",String)],exports.MigrationModel.prototype,"model",void 0),g([s.Column.String(),m("design:type",String)],exports.MigrationModel.prototype,"version",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.MigrationModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.MigrationModel.prototype,"updated_at",void 0),exports.MigrationModel=g([s.Database(y),s.ModelName("migration"),s.Version("5.3.1")],exports.MigrationModel),exports.SessionModel=class SessionModel extends s.Model{},g([s.Column.Id(7),m("design:type",String)],exports.SessionModel.prototype,"id",void 0),g([s.Column.Json(),m("design:type",Object)],exports.SessionModel.prototype,"data",void 0),g([s.Column.FullDate(),m("design:type",Date)],exports.SessionModel.prototype,"expired_at",void 0),g([s.Column.CreatedAt(),m("design:type",Date)],exports.SessionModel.prototype,"created_at",void 0),g([s.Column.UpdatedAt(),m("design:type",Date)],exports.SessionModel.prototype,"updated_at",void 0),exports.SessionModel=g([s.Database(y),s.ModelName("session"),s.Version("5.3.1")],exports.SessionModel);class Log{static error(e,t,r){return h(this,void 0,void 0,function*(){yield this.writeRaw("error",e,t,r)})}static info(e,t,r){return h(this,void 0,void 0,function*(){yield this.writeRaw("info",e,t,r)})}static warn(e,t,r){return h(this,void 0,void 0,function*(){yield this.writeRaw("warn",e,t,r)})}static writeRaw(e,t,o,i){return h(this,void 0,void 0,function*(){var s;i&&r.Log.console(null!==(s=this.colors[e])&&void 0!==s?s:r.LogColor.White,e,t),y&&(yield exports.LogModel.create({level:e,message:t,source:null!=o?o:""}).catch(r.Log.catch))})}}Log.colors={error:r.LogColor.Red,info:r.LogColor.Cyan,warn:r.LogColor.Yellow};class Loggable{get log(){return e=>Loggable.logInfo(this,e)}static get log(){return e=>this.logInfo(this,e)}get error(){return e=>Loggable.logError(this,e)}static get error(){return e=>this.logError(this,e)}static logError(e,t){var r,o;Log.error(null!==(o=null!==(r=null==t?void 0:t.message)&&void 0!==r?r:t)&&void 0!==o?o:"",this.source(e),Env.CONSOLE_ERROR)}static logInfo(e,t){Log.info(null!=t?t:"",this.source(e),Env.CONSOLE_ERROR)}static source(e){var t,r,o;const i=null!==(o=null!==(r=null===(t=null==e?void 0:e.constructor)||void 0===t?void 0:t.name)&&void 0!==r?r:null==e?void 0:e.name)&&void 0!==o?o:"null";return Env.BASE_NAME?`${Env.BASE_NAME}.${i}`:i}}class SessionStore extends a.Store{constructor(){super(),this.all=e=>h(this,void 0,void 0,function*(){e=e||o.noop;const t=yield exports.SessionModel.findAll({attributes:["id","expired_at"],where:{expired_at:{[s.Op.gte]:new Date}}}).catch(t=>(e(t),null));t&&e(null,t.map(e=>e.id)),e()}),this.clear=e=>h(this,void 0,void 0,function*(){yield exports.SessionModel.destroy().catch(r.Log.catch),e&&e()}),this.destroy=(e,t)=>h(this,void 0,void 0,function*(){yield exports.SessionModel.destroy({where:{id:e}}).catch(r.Log.catch),t&&t()}),this.expired=()=>h(this,void 0,void 0,function*(){yield exports.SessionModel.destroy({where:{expired_at:{[s.Op.lt]:new Date}}}).catch(r.Log.catch)}),this.get=(e,t)=>h(this,void 0,void 0,function*(){t=t||o.noop;const i=yield exports.SessionModel.findOne({where:{id:e,expired_at:{[s.Op.gte]:new Date}}}).catch(e=>(t(e),null));if(i){if(i.data.cookie){if(new Date(i.data.cookie.expires).getTime()<=Date.now())return yield i.destroy().catch(r.Log.catch),void t(null)}t(null,i.data)}else t(null)}),this.length=e=>h(this,void 0,void 0,function*(){e&&e(null,(yield exports.SessionModel.count().catch(r.Log.catch))||0)}),this.set=(e,t,i)=>h(this,void 0,void 0,function*(){i=i||o.noop;const s=new Date;s.setTime(s.getTime()+Env.API_SESSION_LIFETIME);const[n,d]=(yield exports.SessionModel.findOrCreate({where:{id:e},defaults:{id:e,data:t,expired_at:s}}).catch(r.Log.catch))||[];n?(d||(n.data=t,n.expired_at=s,yield n.save().catch(r.Log.catch)),i()):i()}),setInterval(this.expired,6e4)}}exports.Service=class Service{},exports.Service=g([d.Trait(Loggable)],exports.Service),exports.AuthService=class AuthService extends exports.Service{constructor(){super(...arguments),this.userAttributes={exclude:["username","notes","deleted_at"]}}create(e){return h(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new t.NotFoundError("TOKEN_KEY not found");const{id:r}=e,i=o.uuidv7(),s=yield exports.UserAuthModel.create({secret:i,user_id:r}).catch(this.error);if(!s)throw new t.InternalServerError;return{auth:s,token:l.sign({id:r,secret:i},Env.TOKEN_KEY,this.options())}})}destroy(e){return h(this,void 0,void 0,function*(){return!(!e||e.revoked_at)&&(e.revoked_at=new Date,yield e.save(),!0)})}renew(e){return h(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new t.NotFoundError("TOKEN_KEY not found");const{decode:r}=yield this.verify(e,Env.TOKEN_TTL_RENEW/1e3);if(!r)throw new t.UnauthorizedError("Invalid token");const{id:i,secret:s}=r;if(i&&s){const e=yield exports.UserModel.findOne({where:{id:i,status:exports.UserStatus.ACTIVE}}).catch(this.error);if(e){const t=yield exports.UserAuthModel.findOne({where:{secret:s,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at){t.secret=o.uuidv7(),yield t.save().catch(this.error);return{auth:t,token:l.sign({id:i,secret:t.secret},Env.TOKEN_KEY,this.options())}}}}throw new t.UnauthorizedError("Invalid token")})}user(e){return h(this,void 0,void 0,function*(){const{decode:r}=yield this.verify(e);if(!r)throw new t.UnauthorizedError("Invalid token");const{id:o,secret:i}=r;if(o&&i){const e=yield exports.UserModel.findOne({attributes:this.userAttributes,where:{id:o,status:exports.UserStatus.ACTIVE}}).catch(this.error);if(e){const t=yield exports.UserAuthModel.findOne({where:{secret:i,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at)return{auth:t,user:e}}}throw new t.UnauthorizedError("Invalid token")})}options(){return{algorithm:"RS256",expiresIn:`${Env.TOKEN_TTL}ms`}}verify(e,r){return h(this,void 0,void 0,function*(){if(!Env.TOKEN_CRT)throw new t.NotFoundError("TOKEN_CRT not found");if(!e||e.split(".").length<3)throw new t.UnauthorizedError("Invalid token");try{return{decode:l.verify(e,Env.TOKEN_CRT,{clockTolerance:r})}}catch(e){throw new t.UnauthorizedError("Invalid token")}})}key(e){return h(this,void 0,void 0,function*(){if(!e)throw new t.UnauthorizedError("Invalid token");const r=yield exports.UserModel.findOne({attributes:this.userAttributes,where:{token:e,status:exports.UserStatus.ACTIVE}}).catch(this.error);if(r){const t=e.replace(/(-[\w]{4})/g,"-****"),[o]=(yield exports.UserAuthModel.findOrCreate({where:{secret:t,user_id:r.id},defaults:{secret:t,user_id:r.id}}).catch(this.error))||[];if(o)return o.revoked_at&&(o.revoked_at=null,yield o.save().catch(this.error)),{auth:o,user:r}}throw new t.UnauthorizedError("Invalid token")})}},exports.AuthService=g([d.Singleton()],exports.AuthService);class ModelService extends exports.Service{constructor(e,t){var r,o;super(),this.attributes=[],this.permissions=[],this.search=[],this.model=e,(null==t?void 0:t.permissions)&&(this.permissions=t.permissions);const i=Object.keys(e.getAttributes());this.attributes=this.filterAttributes(i,null!==(r=null==t?void 0:t.attributes)&&void 0!==r?r:[]),this.search=this.filterAttributes(i,null!==(o=null==t?void 0:t.search)&&void 0!==o?o:this.attributes)}applySelect(e,t,r){if(!t)return;const i=null==e?void 0:e.getQuery(r?`${r}_select`:"select"),s=t.attributes,n=e=>s.includes(e);t.attributes=[],o.isString(i)&&i.length&&t.attributes.push(...i.split(/\s*,\s*/g).filter(n)),t.attributes.length||(t.attributes=s)}applyOrders(e,t){if(!t)return;const r=null==e?void 0:e.getQuery("asc"),i=null==e?void 0:e.getQuery("desc"),s=[],n=t.attributes,d=e=>n.includes(e);o.isString(r)&&r.length&&s.push(...r.split(/\s*,\s*/g).filter(d).map(e=>[e,"ASC"])),o.isString(i)&&i.length&&s.push(...i.split(/\s*,\s*/g).filter(d).map(e=>[e,"DESC"])),s.length&&(t.order=s)}applyPagination(e,t){if(!t)return;const r=null==e?void 0:e.getQuery("limit"),i=null==e?void 0:e.getQuery("offset");o.isUndefined(t.limit)&&(t.limit=Env.MODEL_LIMIT,o.isString(r)&&(t.limit=parseInt(r)||0),t.limit=o.clamp(t.limit,-1,Env.MODEL_LIMIT_MAX)),t.limit<0&&(t.limit=void 0),o.isString(i)&&(t.offset=parseInt(i)||0,t.offset<0&&(t.offset=void 0))}applySearch(e,t){var r;if(!t)return;const i=null==e?void 0:e.getQuery("search");i&&o.isString(i)&&(t.where=Object.assign(Object.assign({},null!==(r=t.where)&&void 0!==r?r:{}),{[s.Op.or]:this.search.map(e=>({[e]:{[s.Op.substring]:i}}))}))}applyWhere(e,r,i){var n,d;if(!r)return null;const a=null==e?void 0:e.getQuery(i?`${i}_where`:"where");if(!o.isString(a))return null;const l=r.attributes,p=s.Where.parse(l,a);return o.isUndefined(p.error)?(r.where=Object.assign(Object.assign({},null!==(n=r.where)&&void 0!==n?n:{}),null!==(d=p.value)&&void 0!==d?d:{}),null):new t.ValidationError(p.error.join(", "))}countAll(e){return h(this,void 0,void 0,function*(){var r,i;const{ctx:s,options:n={}}=e,d=o.merge({},n);d.attributes=this.getAttributes(null!==(r=null==d?void 0:d.attributes)&&void 0!==r?r:[]),this.applySearch(s,d);const a=this.applyWhere(s,d);if(a)return null==s||s.error(a),0;this.applySelect(s,d);const l=null!==(i=yield this.model.count(Object.assign(Object.assign({},d),{distinct:!!d.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error))&&void 0!==i?i:0;return null==s||s.prepare(t.StatusCodes.OK,{count:l}),l})}create(e){return h(this,void 0,void 0,function*(){var r,i;const{body:s={},ctx:n,options:d={}}=e,a=o.merge({},d),l=yield this.model.create(Object.assign({},o.merge({},null!==(i=null===(r=null==n?void 0:n.req)||void 0===r?void 0:r.body)&&void 0!==i?i:{},s)),Object.assign(Object.assign({},a),{ctx:n})).catch(this.error);if(!l)return null==n||n.error(new t.InternalServerError),null;const{primaryKeyAttribute:p}=this.model;return null==n||n.prepare(t.StatusCodes.OK,{[p]:l.getDataValue(p)}),l})}delete(e){return h(this,void 0,void 0,function*(){var r,i;const{ctx:n,id:d,options:a={}}=e,{primaryKeyAttribute:l}=this.model,p=null!==(r=null==n?void 0:n.getParam(l))&&void 0!==r?r:d;if(o.isUndefined(p))return null==n||n.error(new t.BadRequestError),0;const u=o.merge({},a),c=yield this.model.destroy(Object.assign(Object.assign(Object.assign({},u),{where:{[s.Op.and]:Object.assign({[l]:p},null!==(i=null==u?void 0:u.where)&&void 0!==i?i:{})},individualHooks:!0}),{ctx:n})).catch(this.error);return c?(null==n||n.success("OK"),c):(null==n||n.error(new t.NotFoundError),0)})}filterAttributes(e,t){if(o.isArray(t))return t.length?t.filter(t=>o.isString(t)&&e.includes(t)):e;const{exclude:r,include:i}=t,s=o.isUndefined(i)?e:i.filter(t=>o.isString(t)&&e.includes(t)),n=null!=r?r:[];return n.length?s.filter(e=>!n.includes(e)):s}findAll(e){return h(this,void 0,void 0,function*(){var r,i;const{ctx:s,callback:n,options:d={},query:a=!0}=e,l=o.merge({},d);if(l.attributes=this.getAttributes(null!==(r=null==l?void 0:l.attributes)&&void 0!==r?r:[]),a&&this.applySelect(s,l),this.applyOrders(s,l),this.applyPagination(s,l),(null!==(i=null==l?void 0:l.limit)&&void 0!==i?i:0)>Env.MODEL_LIMIT_MAX&&(l.limit=Env.MODEL_LIMIT_MAX),this.applySearch(s,l),a){const e=this.applyWhere(s,l);if(e)return null==s||s.error(e),{count:0,records:[]}}const[p,u]=yield Promise.all([this.model.count(Object.assign(Object.assign({},l),{distinct:!!l.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error).then(e=>null!=e?e:0),this.model.findAll(l).catch(this.error).then(e=>null!=e?e:[])]),c={count:p,records:n?yield n(u):u};return null==s||s.prepare(t.StatusCodes.OK,c),c})}findOne(e){return h(this,void 0,void 0,function*(){var r,i,n;const{callback:d,ctx:a,id:l,options:p={},query:u=!0}=e,{primaryKeyAttribute:c}=this.model,g=null!==(r=null==a?void 0:a.getParam(c))&&void 0!==r?r:l;if(o.isUndefined(g))return null==a||a.error(new t.BadRequestError),null;const v=o.merge({},p);v.attributes=this.getAttributes(null!==(i=null==v?void 0:v.attributes)&&void 0!==i?i:[]),u&&this.applySelect(a,v);const m=yield this.model.findOne(Object.assign(Object.assign({},v),{where:{[s.Op.and]:Object.assign({[c]:g},null!==(n=null==v?void 0:v.where)&&void 0!==n?n:{})}})).catch(this.error);return m?(null==a||a.prepare(t.StatusCodes.OK,d?yield d(m):m.toJSON()),m):(null==a||a.error(new t.NotFoundError),null)})}getAttributes(e){return this.filterAttributes(this.attributes,e)}include(e,t){var r;const i=o.clone(t),{ctx:s}=null!=t?t:{};i.attributes=this.filterAttributes(Object.keys(e.getAttributes()),null!==(r=i.attributes)&&void 0!==r?r:[]),this.applySearch(s,i);const n=this.applyWhere(s,i,t.name);return n?(null==s||s.error(n),null):(this.applySelect(s,i,t.name),Object.assign({model:e},i))}name(){return this.model.tableName}sync(){return h(this,void 0,void 0,function*(){if(!this.permissions.length)return;const e=this.name().toLowerCase(),t={description:"",active:!0};yield o.forEachAsync(this.permissions,r=>h(this,void 0,void 0,function*(){const i=`${e}.${r}`,s=o.upperCamelCase(e.replace(/_/g," ")," ");yield exports.PermissionModel.findOrCreate({where:{key:i},defaults:Object.assign({name:`${s} ${o.upperCamelCase(r," ")}`,key:i,tags:s},t)})}))})}update(e){return h(this,void 0,void 0,function*(){var r,i,n,d;const{ctx:a,body:l,id:p,options:u={}}=e,{primaryKeyAttribute:c}=this.model,g=null!==(r=null==a?void 0:a.getParam(c))&&void 0!==r?r:p;if(o.isUndefined(g))return null==a||a.error(new t.BadRequestError),!1;const v=o.merge({},u),m=o.merge({},null!==(n=null===(i=null==a?void 0:a.req)||void 0===i?void 0:i.body)&&void 0!==n?n:{},null!=l?l:{}),h=yield this.model.findOne(Object.assign(Object.assign({},v),{attributes:this.getAttributes([c,...Object.keys(m)]),where:{[s.Op.and]:Object.assign({[c]:g},null!==(d=null==v?void 0:v.where)&&void 0!==d?d:{})}})).catch(this.error);return h?(h.set(m),h.changed()?(null==a||a.success("OK"),yield h.save(Object.assign({},{ctx:a})).catch(this.error),!0):(null==a||a.success("Record not changed"),!1)):(null==a||a.error(new t.NotFoundError),!1)})}}exports.UserService=class UserService extends exports.Service{constructor(){super(...arguments),this.hashOptions={algorithm:Env.PASSWORD_ALGORITHM,memoryCost:Env.PASSWORD_MEMORY_COST,parallelism:Env.PASSWORD_PARALLELISM,timeCost:Env.PASSWORD_TIME_COST}}createPassword(e,t,r){return h(this,void 0,void 0,function*(){yield exports.UserPasswordModel.update({revoked_at:new Date},{where:{revoked_at:null,user_id:e}}).catch(this.error);const o=p.hashSync(t+Env.PASSWORD_PEPPER,this.hashOptions);yield exports.UserPasswordModel.create({hash:o,user_id:e},Object.assign({},{ctx:r})).catch(this.error)})}getGroups(e,t){return h(this,void 0,void 0,function*(){var r;return o.uniqueArray((null!==(r=yield exports.GroupModel.findAll({attributes:["name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||o.isNull(t)?{tenant_id:t}:{})}]}).catch(this.error))&&void 0!==r?r:[]).map(e=>e.name))})}getPermissions(e,t){return h(this,void 0,void 0,function*(){var r;return(null!==(r=yield exports.PermissionModel.findAll({attributes:["name"],where:{active:!0},include:[{association:"groups_permissions",required:!0,include:[{association:"group",required:!0,attributes:["id","name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||o.isNull(t)?{tenant_id:t}:{})}]}]}]}).catch(this.error))&&void 0!==r?r:[]).map(e=>e.name)})}getTenants(e){return h(this,void 0,void 0,function*(){var t;return(null!==(t=yield exports.TenantModel.findAll({attributes:["id","name"],where:{status:exports.TenantStatus.ACTIVE},include:[{association:"users_tenants",required:!0,where:{user_id:e}}]}).catch(this.error))&&void 0!==t?t:[]).map(e=>({id:e.id,name:e.name}))})}},exports.UserService=g([d.Singleton()],exports.UserService);class Application extends t.Application{constructor(e,t){super(e,o.merge({},{cross:!!Env.HTTP_CROSS&&("*"===Env.HTTP_CROSS||{origin:Env.HTTP_CROSS.split(",")}),hybrid:Env.API_HTTP_HYBRID,json:{strict:Env.API_BODYPARSER_STRICT,inflate:Env.API_BODYPARSER_INFLATE,limit:Env.API_BODYPARSER_LIMIT,type:Env.API_BODYPARSER_TYPE},notfound:Env.API_HTTP_NOTFOUND,path:Env.API_HTTP_PATH,port:Env.HTTP_PORT,public:Env.HTTP_PUBLIC,redirect:Env.API_HTTP_REDIRECT,session:{store:new SessionStore,name:Env.API_SESSION_NAME,secret:Env.API_SESSION_SECRET,cookie:{maxAge:Env.API_SESSION_LIFETIME},genid:o.uuidv7},tls:{ca:Env.HTTP_TLS_CA,cert:Env.HTTP_TLS_CRT,key:Env.HTTP_TLS_KEY}},null!=t?t:{})),this.hash=new r.Hash(Env.API_KEY_HASH)}error(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.error(e.message,t,Env.CONSOLE_ERROR)}log(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.info(e,t,!0)}listen(){const e=Object.create(null,{listen:{get:()=>super.listen}});return h(this,void 0,void 0,function*(){yield y.sync(),yield this.migrations(y),yield o.forEachSeries(this.controllers,e=>h(this,void 0,void 0,function*(){o.isFunction(e.sync)&&(yield e.sync(this))})),this.authService=new exports.AuthService,this.userService=new exports.UserService,yield e.listen.call(this),Env.API_WEBSOCKET_START&&this.server&&(this._webSocket=new i.WebSocketServer({server:this.server,verifyClient:(e,t)=>t(Env.API_WEBSOCKET_START)}),this._webSocket.on("connection",(e,t)=>h(this,void 0,void 0,function*(){t.url||(t.url=""),e.on("close",()=>{}),yield o.sleep(2e3)})))})}migrations(e){return h(this,void 0,void 0,function*(){const t=[];yield o.forEachSeries(Object.keys(e.models),r=>h(this,void 0,void 0,function*(){var o;const i=e.models[r],s=i.version();if(!s)return;const[n,d]=null!==(o=yield exports.MigrationModel.findOrCreate({where:{model:i.tableName},defaults:{model:i.tableName,version:""}}).catch(this.error))&&void 0!==o?o:[];n&&(d||n.version!=s)&&(n.version=s,yield n.save().catch(this.error),t.push(i))})),yield o.forEachSeries(t,e=>h(this,void 0,void 0,function*(){return yield e.updateAttributes()}))})}websocket(){return this._webSocket}}exports.BaseController=class BaseController extends o.EventEmitter{constructor(){super(...arguments),this.permissions=[]}name(){var e,t;return(null!==(t=null===(e=this.constructor)||void 0===e?void 0:e.name)&&void 0!==t?t:"api").replace(/(([a-z])([A-Z]))/g,"$2_$3")}session(e,t,r){return h(this,void 0,void 0,function*(){r.auth&&r.user&&(r.user_agent?r.user_agent!=t&&r.regenerate(o.noop):(r.user_agent=t,r.save(o.noop))),e.next()})}sync(){return h(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=o.upperCamelCase(e.replace(/_/g," ")," ");yield o.forEachSeries(this.permissions,r=>h(this,void 0,void 0,function*(){const i=`${e}.${r}`;yield exports.PermissionModel.findOrCreate({where:{name:i},defaults:{name:i,description:`${t} ${o.upperCamelCase(r," ")}`,active:!0}})}))})}},g([v(0,t.Ctx()),v(1,t.Headers("user-agent")),v(2,t.Session()),m("design:type",Function),m("design:paramtypes",[t.Context,String,Object]),m("design:returntype",Promise)],exports.BaseController.prototype,"session",null),exports.BaseController=g([d.Trait(Loggable)],exports.BaseController),exports.ModelController=class ModelController extends exports.BaseController{constructor(){super(...arguments),this.attributes=[],this.permissions=["create","read","update","delete"],this.search=[]}countAll(e){return h(this,void 0,void 0,function*(){return yield this.service.countAll(e)})}create(e){return h(this,void 0,void 0,function*(){return yield this.service.create(e)})}delete(e){return h(this,void 0,void 0,function*(){return yield this.service.delete(e)})}findAll(e){return h(this,void 0,void 0,function*(){return yield this.service.findAll(e)})}findOne(e){return h(this,void 0,void 0,function*(){return yield this.service.findOne(e)})}include(e,t){return this.service.include(e,t)}sync(){return h(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=o.upperCamelCase(e.replace(/_/g," ")," ");yield o.forEachSeries(this.permissions,r=>h(this,void 0,void 0,function*(){const i=`${e}.${r}`;yield exports.PermissionModel.findOrCreate({where:{name:i},defaults:{name:i,description:`${t} ${o.upperCamelCase(r," ")}`,active:!0}})})),this.service=new ModelService(this.model,{attributes:this.attributes.length?this.attributes:void 0,search:this.search.length?this.search:void 0})})}update(e){return h(this,void 0,void 0,function*(){return yield this.service.update(e)})}name(){return this.model.tableName}},exports.ModelController=g([t.Extends(exports.BaseController)],exports.ModelController),exports.AuditsController=class AuditsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.AuditModel,this.permissions=["read"]}all(e,t,r){return h(this,void 0,void 0,function*(){const o={};t&&(o.type=t),r&&(o.table=r),yield this.findAll({ctx:e,options:{attributes:{exclude:["currently","previously"]},where:o,order:[["created_at","DESC"]]}})})}get(e){return h(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}},g([t.Get(),P(),_(),v(0,t.Ctx()),v(1,t.Query("type")),v(2,t.Query("table")),m("design:type",Function),m("design:paramtypes",[t.Context,String,String]),m("design:returntype",Promise)],exports.AuditsController.prototype,"all",null),g([t.Get("/:id"),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.AuditsController.prototype,"get",null),exports.AuditsController=g([t.Controller("/audits"),t.Extends(exports.ModelController)],exports.AuditsController),exports.AuthController=class AuthController extends exports.BaseController{constructor(){super(...arguments),this.authService=new exports.AuthService}login(e,r,i,n,d,a){return h(this,void 0,void 0,function*(){var l;yield o.sleep(Env.SLEEP_AUTH);const u=yield exports.UserModel.findOne({where:{[s.Op.or]:[{email:i},{username:i}]}}).catch(this.error);if(!u)return e.error(new t.UnauthorizedError("Invalid credentials")),a.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const c=yield exports.UserPasswordModel.findOne({where:{revoked_at:null,user_id:u.id}}).catch(this.error);if(n+=Env.PASSWORD_PEPPER,!c||!(yield p.verify(c.hash,n).catch(o.noop)))return e.error(new t.UnauthorizedError("Invalid credentials")),a.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const g=yield exports.RegisterModel.findOne({where:{active:!0,user_id:u.id}}).catch(this.error);if(g)return e.error(new t.UnauthorizedError("Activation Required")),a.emit("auth.activation",{ctx:e,register:g,user:u}),void this.emit("auth.activation",{ctx:e,register:g,user:u});if(u.status!=exports.UserStatus.ACTIVE)return e.error(new t.UnauthorizedError("Invalid credentials")),a.emit("auth.failure",{ctx:e,user:u}),void this.emit("auth.failure",{ctx:e,user:u});const{auth:v,token:m}=null!==(l=yield this.authService.create(u).catch(t=>{e.error(t),a.emit("auth.failure",{ctx:e}),this.emit("auth.failure",{ctx:e})}))&&void 0!==l?l:{};v&&m&&(v.user_agent=r,v.ip_address=e.getIp(),yield v.save().catch(this.error),Env.API_TOKEN_COOKIE_SET&&e.setCookie(Env.API_TOKEN_COOKIE,m,{maxAge:d?Env.TOKEN_TTL:void 0}),e.json({token:m}),a.emit("auth.login",{ctx:e,auth:v,user:u}),this.emit("auth.login",{ctx:e,auth:v,user:u}))})}logout(e,r,o,i){return h(this,void 0,void 0,function*(){if(yield this.authService.destroy(r))return Env.API_TOKEN_COOKIE_SET&&e.clearCookie(Env.API_TOKEN_COOKIE),e.success("OK"),i.emit("auth.logout",{auth:r,ctx:e,user:o}),void this.emit("auth.logout",{auth:r,ctx:e,user:o});e.error(new t.UnauthorizedError("Access Denied"))})}renew(e,t,r,o){return h(this,void 0,void 0,function*(){var i;const{auth:s,token:n}=null!==(i=yield this.authService.renew(r).catch(t=>{e.error(t)}))&&void 0!==i?i:{};s&&n&&(s.user_agent=t,yield s.save().catch(this.error),e.json({token:n}),o.emit("auth.renew",{auth:s,ctx:e}),this.emit("auth.renew",{auth:s,ctx:e}))})}user(e,r){return h(this,void 0,void 0,function*(){const{groups:o,permissions:i,tenants:s}=e.req;if(!o||!i||!s)return e.error(new t.InternalServerError);e.json(Object.assign(Object.assign({},r.toJSON()),{groups:o,permissions:i,tenants:s}))})}},g([t.Post("/login"),t.Validate(e=>({username:e.string().min(3),password:e.string().min(5),remember:e.boolean().parse().default(!1)})),v(0,t.Ctx()),v(1,t.Headers("user-agent")),v(2,t.Body("username")),v(3,t.Body("password")),v(4,t.Body("remember")),v(5,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,String,String,String,Boolean,Application]),m("design:returntype",Promise)],exports.AuthController.prototype,"login",null),g([t.Get("/logout"),P(),v(0,t.Ctx()),v(1,b()),v(2,D()),v(3,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,exports.UserAuthModel,exports.UserModel,Application]),m("design:returntype",Promise)],exports.AuthController.prototype,"logout",null),g([t.Post("/renew"),t.Validate(e=>({token:e.string()})),v(0,t.Ctx()),v(1,t.Headers("user-agent")),v(2,t.Body("token")),v(3,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,String,String,Application]),m("design:returntype",Promise)],exports.AuthController.prototype,"renew",null),g([t.Get(),t.Get("/me"),P(),v(0,t.Ctx()),v(1,D()),m("design:type",Function),m("design:paramtypes",[t.Context,exports.UserModel]),m("design:returntype",Promise)],exports.AuthController.prototype,"user",null),exports.AuthController=g([t.Controller("/auth"),t.Extends(exports.BaseController)],exports.AuthController),exports.CrudController=class CrudController extends exports.ModelController{constructor(){super(...arguments),this._crud={}}CrudArgumentsCountAll(e){return{ctx:e}}CrudArgumentsCreate(e){return{ctx:e}}CrudArgumentsFindAll(e){return{ctx:e}}CrudArgumentsFindOne(e){return{ctx:e}}CrudArgumentsDelete(e){return{ctx:e}}CrudArgumentsUpdate(e){return{ctx:e}}CrudValidateCreate(){return this._crud}CrudValidateUpdate(){return this._crud}add(e){return h(this,void 0,void 0,function*(){yield this.create(this.CrudArgumentsCreate(e))})}all(e){return h(this,void 0,void 0,function*(){yield this.findAll(this.CrudArgumentsFindAll(e))})}rows(e){return h(this,void 0,void 0,function*(){yield this.countAll(this.CrudArgumentsCountAll(e))})}del(e){return h(this,void 0,void 0,function*(){yield this.delete(this.CrudArgumentsDelete(e))})}get(e){return h(this,void 0,void 0,function*(){yield this.findOne(this.CrudArgumentsFindOne(e))})}set(e){return h(this,void 0,void 0,function*(){yield this.update(this.CrudArgumentsUpdate(e))})}validate(e,r){var i,s;const n=o.Validation.object(r).parse().validate(null!==(s=null===(i=e.req)||void 0===i?void 0:i.body)&&void 0!==s?s:{});if(n.error)return e.error(new t.ValidationError(n.message||n.error));e.req.body=n.value,e.next()}validateCreate(e){const r=this.CrudValidateCreate();if(r==this._crud)return e.error(new t.InternalServerError);this.validate(e,r)}validateUpdate(e){const r=this.CrudValidateUpdate();if(r==this._crud)return e.error(new t.InternalServerError);this.validate(e,r)}},g([t.Post(),P(),A(),t.Middleware("validateCreate"),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.CrudController.prototype,"add",null),g([t.Get(),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.CrudController.prototype,"all",null),g([t.Get("/count"),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.CrudController.prototype,"rows",null),g([t.Delete("/:id"),P(),T(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.CrudController.prototype,"del",null),g([t.Get("/:id"),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.CrudController.prototype,"get",null),g([t.Put("/:id"),P(),O(),t.Middleware("validateUpdate"),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.CrudController.prototype,"set",null),g([v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",void 0)],exports.CrudController.prototype,"validateCreate",null),g([v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",void 0)],exports.CrudController.prototype,"validateUpdate",null),exports.CrudController=g([t.Extends(exports.ModelController)],exports.CrudController),exports.FilesController=class FilesController extends exports.BaseController{constructor(){super(...arguments),this.directory=Env.HTTP_PUBLIC||"./",this.permissions=["delete","download","edit","list","read","rename","upload","write"]}files(e){return h(this,void 0,void 0,function*(){let{path:r}=e.req;r=r.replace(/(^\/path(\/)?)|([\\.]{1,2}\/)/g,"");const i=c.join(this.directory,r);if(!u.existsSync(i)||!u.statSync(i).isDirectory())return e.error(new t.NotFoundError);let s;return s=u.readdirSync(i),s=s.map(e=>this.info(c.join(i,e))),s=s.filter(o.isDef),Object.assign(Object.assign({},this.info(i)),{files:s})})}info(e){if(!u.existsSync(e))return null;const t=u.statSync(e),r=e.split("/").pop();e=e.replace(this.directory,"/").replace(/^\/\//,"/");const o=t.isDirectory();return{name:r,path:e.replace(/^\/\//,"/"),size:t.size,extension:o?"":"."+e.split(".").pop(),created:t.birthtime,modified:t.mtime,directory:o,symlink:t.isSymbolicLink()}}name(){return"files"}sync(){return h(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=o.upperCamelCase(e.replace(/_/g," ")," ");yield o.forEachSeries(this.permissions,r=>h(this,void 0,void 0,function*(){const i=`${e}.${r}`;yield exports.PermissionModel.findOrCreate({where:{name:i},defaults:{name:i,description:`${t} ${o.upperCamelCase(r," ")}`,active:!0}})}))})}},g([t.Get("/path"),t.Get("/path/*path"),P(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.FilesController.prototype,"files",null),exports.FilesController=g([t.Controller("/files"),t.Extends(exports.BaseController)],exports.FilesController),exports.ForgotController=class ForgotController extends exports.BaseController{check(e,r){return h(this,void 0,void 0,function*(){const i=yield this.find(r);if(!i||!i.user)return e.error(new t.NotFoundError);i.secret=o.uniqueID(),yield i.save(),e.json({token:i.secret})})}forgot(e,r,i){return h(this,void 0,void 0,function*(){yield o.sleep(Env.SLEEP_FORGOT);const n=r,d=yield exports.UserModel.findOne({where:{[s.Op.or]:[{email:n},{username:r}]}}).catch(this.error);if(!d)return e.error(new t.NotFoundError);const a=o.uniqueID(),l=Date.now()+6e4*Env.TOKEN_TTL_FORGOT,p=yield exports.ForgotModel.create({token:a,timestamp:l,active:!0,user_id:d.id});e.success("OK"),i.emit("forgot.send",{ctx:e,forgot:p,user:d}),this.emit("forgot.send",{ctx:e,forgot:p,user:d})})}reset(e,r,o,i){return h(this,void 0,void 0,function*(){const o=yield this.find(r);if(!o)return e.error(new t.NotFoundError);o.active=!1,yield o.save().catch(this.error),yield o.user.save().catch(this.error),e.success("OK"),i.emit("forgot.reset",{ctx:e,user:o.user}),this.emit("forgot.reset",{ctx:e,user:o.user})})}find(e){return h(this,void 0,void 0,function*(){return yield exports.ForgotModel.findOne({where:{token:e,active:!0},include:[{association:"users",required:!0}]}).catch(this.error)})}},g([t.Get("/check"),t.Validate(e=>({token:e.string()})),v(0,t.Ctx()),v(1,t.Body("token")),m("design:type",Function),m("design:paramtypes",[t.Context,String]),m("design:returntype",Promise)],exports.ForgotController.prototype,"check",null),g([t.Post(),t.Validate(e=>({username:e.string().min(4)})),v(0,t.Ctx()),v(1,t.Body("username")),v(2,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,String,Application]),m("design:returntype",Promise)],exports.ForgotController.prototype,"forgot",null),g([t.Post("/reset"),t.Validate(e=>({token:e.string(),password:e.string().min(5)})),v(0,t.Ctx()),v(1,t.Body("token")),v(2,t.Body("password")),v(3,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,String,String,Application]),m("design:returntype",Promise)],exports.ForgotController.prototype,"reset",null),exports.ForgotController=g([t.Controller("/forgot"),t.Extends(exports.BaseController)],exports.ForgotController),exports.GroupsController=class GroupsController extends exports.CrudController{constructor(){super(...arguments),this.model=exports.GroupModel,this.schemaCreate={name:o.Validation.string(),description:o.Validation.string().default(""),type:o.Validation.enum(Object.values(exports.GroupTypes)).default(exports.GroupTypes.SYSTEM),active:o.Validation.boolean().parse(),metadata:o.Validation.object().parse().default({})},this.schemaUpdate={description:o.Validation.string().optional(),type:o.Validation.enum(Object.values(exports.GroupTypes)).optional(),active:o.Validation.boolean().parse().optional(),metadata:o.Validation.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}},exports.GroupsController=g([t.Controller("/groups"),t.Extends(exports.CrudController)],exports.GroupsController),exports.GroupsPermissionsController=class GroupsPermissionsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.GroupPermissionModel,this.permissions=[]}all(e,t){return h(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{where:{group_id:t},include:[{association:"permission",required:!0}]},callback:e=>e.map(e=>e.permission),query:!1})})}set(e,r,i){return h(this,void 0,void 0,function*(){const n=yield exports.GroupModel.findByPk(r,{attributes:["id"]}).catch(this.error);if(!n)return e.error(new t.NotFoundError);const d=n.id,a=[];yield o.forEachSeries(o.uniqueArray(i),t=>h(this,void 0,void 0,function*(){var r;if(!(yield exports.PermissionModel.count({where:{id:t}})))return;const[o]=null!==(r=yield exports.GroupPermissionModel.findOrCreate(Object.assign({where:{group_id:d,permission_id:t},defaults:{group_id:d,permission_id:t}},{ctx:e})).catch(this.error))&&void 0!==r?r:[];o&&a.push(t)})),yield exports.GroupPermissionModel.destroy(Object.assign({where:{group_id:d,permission_id:{[s.Op.notIn]:a}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}},g([t.Get("/:id/permissions"),P(),_("groups"),v(0,t.Ctx()),v(1,t.Params("id")),m("design:type",Function),m("design:paramtypes",[t.Context,String]),m("design:returntype",Promise)],exports.GroupsPermissionsController.prototype,"all",null),g([t.Put("/:id/permissions"),P(),O("groups"),t.Validate(e=>({permissions:e.array(e.string().uuid())})),v(0,t.Ctx()),v(1,t.Params("id")),v(2,t.Body("permissions")),m("design:type",Function),m("design:paramtypes",[t.Context,String,Array]),m("design:returntype",Promise)],exports.GroupsPermissionsController.prototype,"set",null),exports.GroupsPermissionsController=g([t.Controller("/groups"),t.Extends(exports.ModelController)],exports.GroupsPermissionsController),exports.HealthController=class HealthController{ping(e){return h(this,void 0,void 0,function*(){e.json({status:"ok",timestamp:Date.now(),uptime:process.uptime()})})}},g([t.All("/"),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.HealthController.prototype,"ping",null),exports.HealthController=g([t.Controller("/health")],exports.HealthController),exports.LogsController=class LogsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.LogModel,this.permissions=["read"]}all(e){return h(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}},g([t.Get(),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.LogsController.prototype,"all",null),exports.LogsController=g([t.Controller("/logs"),t.Extends(exports.ModelController)],exports.LogsController),exports.McpController=class McpController extends exports.BaseController{constructor(){super(...arguments),this.tools=new McpToolRegistry,this.toolsRegistered=!1,this.handler=new McpHttpHandler({sessions:new McpSessionStore(Env.MCP_SESSION_TTL),tools:this.tools,logger:{toolCall:e=>h(this,void 0,void 0,function*(){yield Log.info(JSON.stringify(e),"mcp")})}})}sync(e){const t=Object.create(null,{sync:{get:()=>super.sync}});return h(this,void 0,void 0,function*(){yield t.sync.call(this),this.toolsRegistered||(this.toolsRegistered=!0,e&&(e.instance.use((e,t,r,o)=>{if(!this.isMcpEndpoint(t))return o(e);const i=this.jsonParseErrorResponse(e);if(!i)return o(e);r.status(i.status).json(i.body)}),e.instance.use((e,t,r)=>{if(!this.isMcpEndpoint(e)||!["GET","HEAD"].includes(e.method))return r();t.setHeader("Allow",K),t.status(405).end()}),this.discoverMcpTools(e.controllers).forEach(e=>this.tools.register(e))))})}get(e){return h(this,void 0,void 0,function*(){this.setHeader(e),e.send(405)})}options(e){return h(this,void 0,void 0,function*(){this.setHeader(e),e.send(204)})}post(e){return h(this,void 0,void 0,function*(){this.respond(e,yield this.handler.post(e))})}delete(e){return h(this,void 0,void 0,function*(){this.respond(e,this.handler.delete(e))})}getMcpToolMetadata(e){const t=d.metadata(Y,e,[]);return t.length||"function"==typeof e?t:d.metadata(Y,Object.getPrototypeOf(e),[])}discoverMcpTools(e){const t=[];for(const r of e)for(const e of this.getMcpToolMetadata(r))t.push(this.createMcpToolFromMetadata(r,e));return t}createMcpToolFromMetadata(e,t){const r=e[t.propertyKey];if(!o.isFunction(r))throw new Error(`MCP tool "${t.name}" handler was not found`);return $(t),Object.assign(Object.assign(Object.assign({name:t.name,title:t.title,description:t.description},void 0!==t.input?{input:t.input}:{}),void 0!==t.output?{output:t.output}:{}),{run:(t,o)=>r.call(e,t,o)})}isJsonParseError(e){if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode}isMcpEndpoint(e){const t=(e.originalUrl||e.url).split("?")[0].replace(/\/+$/g,"")||"/";return t===`${(Env.API_HTTP_PATH||"/").replace(/\/+$/g,"")||""}/mcp`.replace(/\/+/g,"/")||"/mcp"===t}jsonParseErrorResponse(e){if(this.isJsonParseError(e))return{status:400,body:L(null,new McpParseError("Parse error",{message:e.message}))}}respond(e,t){var r;for(const[o,i]of Object.entries(null!==(r=t.headers)&&void 0!==r?r:{}))e.res.setHeader(o,i);void 0!==t.body?e.res.status(t.status).json(t.body):e.res.status(t.status).end()}setHeader(e,t){Object.entries(Object.assign({Allow:K,"Access-Control-Allow-Methods":K,"Access-Control-Allow-Headers":`Content-Type, Accept, ${k}, ${G}`},null!=t?t:{})).forEach(([t,r])=>{e.res.setHeader(t,r)})}},g([t.Get(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.McpController.prototype,"get",null),g([t.Options(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.McpController.prototype,"options",null),g([t.Post(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.McpController.prototype,"post",null),g([t.Delete(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.McpController.prototype,"delete",null),exports.McpController=g([t.Controller("/mcp"),t.Extends(exports.BaseController)],exports.McpController),exports.PermissionsController=class PermissionsController extends exports.CrudController{constructor(){super(...arguments),this.model=exports.PermissionModel,this.schemaCreate={name:o.Validation.string(),description:o.Validation.string().default(""),active:o.Validation.boolean().parse(),metadata:o.Validation.object().parse().default({})},this.schemaUpdate={description:o.Validation.string().optional(),active:o.Validation.boolean().parse().optional(),metadata:o.Validation.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}},exports.PermissionsController=g([t.Controller("/permissions"),t.Extends(exports.CrudController)],exports.PermissionsController),exports.RegisterController=class RegisterController extends exports.BaseController{register(e,i,n){return h(this,void 0,void 0,function*(){yield o.sleep(Env.SLEEP_REGISTRY);const{name:d,date:a,email:l,username:p,password:u,confirm:c}=i,g=p||l,v=r.sha256(u);if(yield exports.UserModel.count({where:{[s.Op.or]:[{email:l},{username:g}]}}).catch(this.error))return e.error("INVALID EMAIL OR USERNAME");if(v!=r.sha256(c))return e.error("INVALID PASSWORD");const m=yield exports.UserModel.create({name:d,email:l,username:g,password:v,avatar:"",date:a,description:"",status:exports.UserStatus.PENDING}).catch(this.error);if(!m)return e.error(new t.InternalServerError);const h=yield exports.RegisterModel.create({token:yield this.getId(),active:!0,user_id:m.id}).catch(this.error);if(!h)return yield m.destroy().catch(this.error),e.error(new t.InternalServerError);e.success("OK"),n.emit("register.user",{ctx:e,register:h,user:m}),this.emit("register.user",{ctx:e,register:h,user:m})})}confirm(e,r,o){return h(this,void 0,void 0,function*(){const i=yield exports.RegisterModel.findOne({where:{token:r,active:!0},include:[{association:"users",required:!0}]}).catch(this.error);if(!i)return e.error(new t.NotFoundError);i.active=!1,yield i.save().catch(this.error),i.user.status=exports.UserStatus.ACTIVE,yield i.user.save().catch(this.error),e.success("OK"),o.emit("register.confirm",{ctx:e,register:i,user:i.user}),this.emit("register.confirm",{ctx:e,register:i,user:i.user})})}send(e,r,o){return h(this,void 0,void 0,function*(){const i=r,n=yield exports.RegisterModel.findOne({where:{active:!0},include:[{model:exports.UserModel,required:!0,where:{[s.Op.or]:[{email:i},{username:r}]}}]}).catch(this.error);if(!n)return e.error(new t.NotFoundError);e.success("OK"),o.emit("register.send",{ctx:e,register:n,user:n.user}),this.emit("register.send",{ctx:e,register:n,user:n.user})})}getId(){return h(this,void 0,void 0,function*(){const e=o.uuidv7();return(yield exports.RegisterModel.count({where:{token:e}}))?this.getId():e})}},g([t.Post(),t.Validate(e=>({name:e.string(),date:e.date(),email:e.string().email(),username:e.string().min(4).default(e.ref("email")),password:e.string().min(5),confirm:e.string().min(5)})),v(0,t.Ctx()),v(1,t.Body()),v(2,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,Object,Application]),m("design:returntype",Promise)],exports.RegisterController.prototype,"register",null),g([t.Post("/confirm"),t.Validate(e=>({token:e.string()})),v(0,t.Ctx()),v(1,t.Body("token")),v(2,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,String,Application]),m("design:returntype",Promise)],exports.RegisterController.prototype,"confirm",null),g([t.Post("/send"),t.Validate(e=>({username:e.string().min(4)})),v(0,t.Ctx()),v(1,t.Body("username")),v(2,t.App()),m("design:type",Function),m("design:paramtypes",[t.Context,String,Application]),m("design:returntype",Promise)],exports.RegisterController.prototype,"send",null),exports.RegisterController=g([t.Controller("/register"),t.Extends(exports.BaseController)],exports.RegisterController),exports.SetupController=class SetupController extends exports.BaseController{constructor(){super(...arguments),this.userService=new exports.UserService}setup(e){return h(this,void 0,void 0,function*(){var r;if(yield exports.UserModel.count())return e.error(new t.NotFoundError("Endpoint Not Found"));const i=yield exports.UserModel.create({name:"Admin",username:"admin",email:"admin@localhost.com",notes:"",status:exports.UserStatus.ACTIVE},Object.assign({},{ctx:e})).catch(this.error);if(!i)return e.error(new t.InternalServerError);yield this.userService.createPassword(i.id,"admin",e);const s=yield exports.GroupModel.create({name:"root",description:"Root",active:!0},Object.assign({},{ctx:e}));yield exports.UserGroupModel.create({user_id:i.id,group_id:s.id},Object.assign({},{ctx:e})),yield exports.GroupModel.create({name:"admin",description:"Admin",active:!0},Object.assign({},{ctx:e})),yield exports.GroupModel.create({name:"user",description:"User",active:!0},Object.assign({},{ctx:e}));const n=null!==(r=yield exports.PermissionModel.findAll({where:{active:!0}}).catch(this.error))&&void 0!==r?r:[];yield o.forEachSeries(n,t=>h(this,void 0,void 0,function*(){yield exports.GroupPermissionModel.create({group_id:s.id,permission_id:t.id},Object.assign({},{ctx:e}))})),e.success("OK")})}},g([t.Get(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.SetupController.prototype,"setup",null),exports.SetupController=g([t.Controller("/setup"),t.Extends(exports.BaseController)],exports.SetupController),exports.TestController=class TestController extends exports.BaseController{json(e){return h(this,void 0,void 0,function*(){e.json({ok:!0,message:"hello",timestamp:Date.now()})})}sum(e,t){return h(this,void 0,void 0,function*(){const{a:t,b:r}=e;return{value:t+r}})}multiply(e,t){return h(this,void 0,void 0,function*(){const{a:t,b:r}=e;return{value:t*r}})}average(e,t){return h(this,void 0,void 0,function*(){const t=e.values;return{value:t.reduce((e,t)=>e+t,0)/t.length,count:t.length}})}validationString(e,t){return h(this,void 0,void 0,function*(){const t=e.text;return{length:t.length,normalized:t.trim()}})}validationNumber(e,t){return h(this,void 0,void 0,function*(){return{doubled:2*e.value}})}validationBoolean(e,t){return h(this,void 0,void 0,function*(){return{active:e.active}})}validationArray(e,t){return h(this,void 0,void 0,function*(){return{count:e.tags.length}})}validationObject(e,t){return h(this,void 0,void 0,function*(){const t=e.profile;return{summary:{name:t.name,adult:t.age>=18}}})}validationEnum(e,t){return h(this,void 0,void 0,function*(){return{status:e.status}})}validationDate(e,t){return h(this,void 0,void 0,function*(){const t=e.date;return{iso:t.toISOString(),timestamp:t.getTime()}})}validationOptional(e,t){return h(this,void 0,void 0,function*(){const t=e.nickname;return Object.assign({name:e.name,hasNickname:Boolean(t)},t?{nickname:t}:{})})}validationDefaults(e,t){return h(this,void 0,void 0,function*(){return{name:e.name,limit:e.limit}})}validationParse(e,t){return h(this,void 0,void 0,function*(){return{active:e.active,amount:e.amount}})}validationNested(e,t){return h(this,void 0,void 0,function*(){const t=e.payload;return{userId:t.user.id,scoreCount:t.scores.length}})}},g([t.Get(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.TestController.prototype,"json",null),g([W({name:"sum",title:"Somar numeros",description:"Soma dois numeros.",input:{a:o.Validation.number().description("valor a"),b:o.Validation.number().description("valor b")},output:{value:o.Validation.number().description("resultado da soma de a + b")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"sum",null),g([W({name:"multiply",title:"Multiplicar numeros",description:"Multiplica dois numeros.",input:{a:o.Validation.number().description("valor a"),b:o.Validation.number().description("valor b")},output:{value:o.Validation.number().description("resultado da multiplicação de a * b")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"multiply",null),g([W({name:"average",title:"Calcular media",description:"Calcula a media de uma lista de numeros.",input:{values:o.Validation.array(o.Validation.number().description("numero usado no calculo da media")).min(1).max(10).description("lista de numeros para calcular a media")},output:{value:o.Validation.number().description("media calculada"),count:o.Validation.number().description("quantidade de numeros usados")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"average",null),g([W({name:"validation.string",title:"Validacao de string",description:"Exemplo de validacao de texto com tamanho minimo e maximo.",input:{text:o.Validation.string().min(5).max(50).description("Texto entre 5 e 50 caracteres.")},output:{length:o.Validation.number().description("Quantidade de caracteres do texto."),normalized:o.Validation.string().description("Texto normalizado sem espacos nas pontas.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationString",null),g([W({name:"validation.number",title:"Validacao de number",description:"Exemplo de validacao numerica com minimo e maximo.",input:{value:o.Validation.number().min(0).max(100).description("Numero entre 0 e 100.")},output:{doubled:o.Validation.number().description("Numero multiplicado por dois.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationNumber",null),g([W({name:"validation.boolean",title:"Validacao de boolean",description:"Exemplo de validacao de booleano sem parse implicito.",input:{active:o.Validation.boolean().description("Indica se o registro esta ativo.")},output:{active:o.Validation.boolean().description("Booleano validado.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationBoolean",null),g([W({name:"validation.array",title:"Validacao de array",description:"Exemplo de validacao de array com limites e item tipado.",input:{tags:o.Validation.array(o.Validation.string().min(2).max(20).description("Tag entre 2 e 20 caracteres.")).min(1).max(5).description("Lista de tags entre 1 e 5 itens.")},output:{count:o.Validation.number().description("Quantidade de tags recebidas.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationArray",null),g([W({name:"validation.object",title:"Validacao de object",description:"Exemplo de validacao de objeto simples.",input:{profile:o.Validation.object({name:o.Validation.string().min(2).max(60).description("Nome do perfil."),age:o.Validation.number().min(0).max(120).description("Idade do perfil."),nickname:o.Validation.string().empty().max(30).description("Apelido opcional do perfil.")}).description("Objeto de perfil.")},output:{summary:o.Validation.object({name:o.Validation.string().description("Nome validado."),adult:o.Validation.boolean().description("Indica se a idade e maior ou igual a 18.")}).description("Resumo do perfil.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationObject",null),g([W({name:"validation.enum",title:"Validacao de enum",description:"Exemplo de validacao de lista fechada de valores.",input:{status:o.Validation.enum(["draft","active","archived"]).description("Status permitido.")},output:{status:o.Validation.string().description("Status validado.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationEnum",null),g([W({name:"validation.date",title:"Validacao de date",description:"Exemplo de validacao e parse de data.",input:{date:o.Validation.date().parse().description("Data em formato aceito pelo Date.")},output:{iso:o.Validation.string().description("Data em ISO string."),timestamp:o.Validation.number().description("Data em timestamp Unix em milissegundos.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationDate",null),g([W({name:"validation.optional",title:"Validacao de campo opcional",description:"Exemplo de campo opcional aceitando ausencia.",input:{name:o.Validation.string().min(2).description("Nome obrigatorio."),nickname:o.Validation.string().empty().max(30).description("Apelido opcional.")},output:{name:o.Validation.string().description("Nome validado."),hasNickname:o.Validation.boolean().description("Indica se apelido foi enviado."),nickname:o.Validation.string().empty().description("Apelido validado quando enviado.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationOptional",null),g([W({name:"validation.defaults",title:"Validacao de valores padrao",description:"Exemplo de campos opcionais com valores padrao.",input:{name:o.Validation.string().default("guest").description("Nome opcional com valor padrao."),limit:o.Validation.number().parse().default(10).min(1).max(100).description("Limite opcional com valor padrao.")},output:{name:o.Validation.string().description("Nome final."),limit:o.Validation.number().description("Limite final.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationDefaults",null),g([W({name:"validation.parse",title:"Validacao com parse",description:"Exemplo de parse de boolean e number antes da validacao final.",input:{active:o.Validation.boolean().parse().default(!1).description("Booleano aceitando valores parseaveis."),amount:o.Validation.number().parse().min(1).max(1e3).description("Numero aceitando string numerica.")},output:{active:o.Validation.boolean().description("Booleano parseado."),amount:o.Validation.number().description("Numero parseado.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationParse",null),g([W({name:"validation.nested",title:"Validacao de objeto aninhado",description:"Exemplo de objeto aninhado com array interno.",input:{payload:o.Validation.object({user:o.Validation.object({id:o.Validation.string().min(3).max(30).description("Identificador do usuario."),email:o.Validation.string().email().description("Email do usuario.")}).description("Usuario do payload."),scores:o.Validation.array(o.Validation.number().min(0).max(100).description("Pontuacao individual.")).min(1).max(3).description("Pontuacoes do usuario.")}).description("Payload aninhado.")},output:{userId:o.Validation.string().description("Identificador validado."),scoreCount:o.Validation.number().description("Quantidade de pontuacoes.")}}),m("design:type",Function),m("design:paramtypes",[Object,Object]),m("design:returntype",Promise)],exports.TestController.prototype,"validationNested",null),exports.TestController=g([t.Controller("/test"),t.Extends(exports.BaseController)],exports.TestController),exports.UsersController=class UsersController extends exports.ModelController{constructor(){super(),this.model=exports.UserModel,this.path=Env.HTTP_PUBLIC+"/avatar",Env.HTTP_PUBLIC&&u.existsSync(Env.HTTP_PUBLIC)&&!u.existsSync(this.path)&&u.mkdirSync(this.path)}avatar(e,r){return h(this,void 0,void 0,function*(){var o;const i=e.getFiles();if(i.file&&i.file.length){const{filename:s,path:n}=null!==(o=i.file[0])&&void 0!==o?o:{};if(s){const o=yield exports.UserModel.findOne({where:{id:r.id}}).catch(this.error);if(!o)return u.lstatSync(n).isFile()&&u.rmSync(n),e.error(new t.InternalServerError);const i=this.path+"/"+o.metadata.avatar_url;if(u.existsSync(i)&&u.lstatSync(i).isFile()&&u.rmSync(i),o.changed("metadata",!0),o.metadata.avatar_url=s,yield o.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK")}}e.success("Record not Changed")})}token_new(){return h(this,void 0,void 0,function*(){var e;const t=o.uuidv7();return(null!==(e=yield this.model.count({where:{token:t}}).catch(this.error))&&void 0!==e?e:0)?this.token_new():t})}add(e){return h(this,void 0,void 0,function*(){yield this.create({ctx:e})})}all(e){return h(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}rows(e){return h(this,void 0,void 0,function*(){yield this.countAll({ctx:e})})}del(e,r,o){return h(this,void 0,void 0,function*(){if(o.id==r)return e.error(new t.NotFoundError);yield this.delete({ctx:e})})}get(e){return h(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}set(e){return h(this,void 0,void 0,function*(){yield this.update({ctx:e})})}},g([t.Post("/avatar"),P(),t.Upload({file:{count:1,path:`${Env.HTTP_PUBLIC}/avatar`,types:["image/bmp","image/jpeg","image/png"],size:32}}),v(0,t.Ctx()),v(1,D()),m("design:type",Function),m("design:paramtypes",[t.Context,exports.UserModel]),m("design:returntype",Promise)],exports.UsersController.prototype,"avatar",null),g([t.Post(),P(),A(),t.Validate(e=>({name:e.string(),email:e.string().email(),username:e.string().min(3),notes:e.string().default(""),status:e.enum(Object.values(exports.UserStatus)).default(exports.UserStatus.ACTIVE),metadata:e.object().parse().default({})})),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.UsersController.prototype,"add",null),g([t.Get(),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.UsersController.prototype,"all",null),g([t.Get("/count"),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.UsersController.prototype,"rows",null),g([t.Delete("/:id"),P(),T(),v(0,t.Ctx()),v(1,t.Params("id")),v(2,D()),m("design:type",Function),m("design:paramtypes",[t.Context,String,exports.UserModel]),m("design:returntype",Promise)],exports.UsersController.prototype,"del",null),g([t.Get("/:id"),P(),_(),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.UsersController.prototype,"get",null),g([t.Put("/:id"),P(),O(),t.Validate(e=>({name:e.string().optional(),email:e.string().email().optional(),username:e.string().min(3).optional(),notes:e.string().optional(),status:e.enum(Object.values(exports.UserStatus)).optional(),metadata:e.object().parse().optional()})),v(0,t.Ctx()),m("design:type",Function),m("design:paramtypes",[t.Context]),m("design:returntype",Promise)],exports.UsersController.prototype,"set",null),exports.UsersController=g([t.Controller("/users"),t.Extends(exports.ModelController),m("design:paramtypes",[])],exports.UsersController),exports.UsersGroupsController=class UsersGroupsController extends exports.ModelController{constructor(){super(...arguments),this.model=exports.UserGroupModel,this.permissions=[]}all(e,r){return h(this,void 0,void 0,function*(){if(!(yield exports.UserModel.findByPk(r,{attributes:["id"]}).catch(this.error)))return e.error(new t.NotFoundError("User Not Found"));yield this.findAll({ctx:e,options:{where:{user_id:r},include:[{association:"group",required:!0}]},callback:e=>e.map(e=>e.group),query:!1})})}set(e,r,i){return h(this,void 0,void 0,function*(){const n=yield exports.UserModel.findByPk(r,{attributes:["id"]}).catch(this.error);if(!n)return e.error(new t.NotFoundError("User Not Found"));const d=n.id,a=[];yield o.forEachSeries(o.uniqueArray(i),t=>h(this,void 0,void 0,function*(){var r;if(!(yield exports.GroupModel.count({where:{id:t}})))return;const[o]=null!==(r=yield exports.UserGroupModel.findOrCreate(Object.assign({where:{user_id:d,group_id:t},defaults:{user_id:d,group_id:t}},{ctx:e})).catch(this.error))&&void 0!==r?r:[];o&&a.push(t)})),yield exports.UserGroupModel.destroy(Object.assign({where:{user_id:d,group_id:{[s.Op.notIn]:a}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}},g([t.Get("/:id/groups"),P(),_("users"),v(0,t.Ctx()),v(1,t.Params("id")),m("design:type",Function),m("design:paramtypes",[t.Context,String]),m("design:returntype",Promise)],exports.UsersGroupsController.prototype,"all",null),g([t.Put("/:id/groups"),P(),O("users"),t.Validate(e=>({groups:e.array(e.string().uuid())})),v(0,t.Ctx()),v(1,t.Params("id")),v(2,t.Body("groups")),m("design:type",Function),m("design:paramtypes",[t.Context,String,Array]),m("design:returntype",Promise)],exports.UsersGroupsController.prototype,"set",null),exports.UsersGroupsController=g([t.Controller("/users"),t.Extends(exports.ModelController)],exports.UsersGroupsController),exports.Application=Application,exports.Audit=te,exports.CanCreate=A,exports.CanDelete=T,exports.CanRead=_,exports.CanUpdate=O,exports.Config=class Config extends Loggable{static all(e){return h(this,void 0,void 0,function*(){var t;const r=null!==(t=yield exports.ConfigModel.findAll({where:(null==e?void 0:e.length)?{key:{[s.Op.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[];return Object.fromEntries(r.map(e=>[e.key,e.value]))})}static del(e){return h(this,void 0,void 0,function*(){return((yield exports.ConfigModel.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return h(this,arguments,void 0,function*(e,t=""){const[r]=(yield exports.ConfigModel.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];return r?r.value:t})}static set(e,t){return h(this,void 0,void 0,function*(){const[r,o]=(yield exports.ConfigModel.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];r&&!o&&(r.value=t,yield r.save().catch(this.error))})}},exports.Env=Env,exports.HasGroups=(...e)=>(r,i,s)=>{t.Use(r=>h(void 0,void 0,void 0,function*(){const{groups:i=[]}=r.req;if(o.includesArray(e,i))return r.next();r.error(new t.UnauthorizedError("Access Denied"))}))(r,i,s)},exports.HasPermissions=(...e)=>(r,i,s)=>{t.Use(r=>h(void 0,void 0,void 0,function*(){const{permissions:i}=r.req;if(o.includesArray(e,null!=i?i:[]))return r.next();r.error(new t.UnauthorizedError("Access Denied"))}))(r,i,s)},exports.IsAuthenticated=P,exports.Log=Log,exports.Loggable=Loggable,exports.MCP_DEFAULT_PROTOCOL_VERSION=H,exports.MCP_HTTP_ALLOW=K,exports.MCP_HTTP_ALLOWED_METHODS=q,exports.MCP_PROTOCOL_VERSION_HEADER=G,exports.MCP_SESSION_ID_HEADER=k,exports.MCP_SUPPORTED_PROTOCOL_VERSIONS=B,exports.MCP_TOOL_METADATA=Y,exports.McpError=McpError,exports.McpErrorCode=j,exports.McpHttpHandler=McpHttpHandler,exports.McpInternalError=class McpInternalError extends McpError{constructor(e="Internal error",t){super(e,j.InternalError,200,t)}},exports.McpInvalidParamsError=McpInvalidParamsError,exports.McpInvalidRequestError=McpInvalidRequestError,exports.McpInvalidSessionError=McpInvalidSessionError,exports.McpMethodNotFoundError=McpMethodNotFoundError,exports.McpParseError=McpParseError,exports.McpServerError=McpServerError,exports.McpSessionStore=McpSessionStore,exports.McpTool=W,exports.McpToolNotFoundError=McpToolNotFoundError,exports.McpToolRegistry=McpToolRegistry,exports.ModelService=ModelService,exports.ReqAuth=b,exports.ReqGroup=I,exports.ReqGroups=w,exports.ReqPermission=R,exports.ReqPermissions=U,exports.ReqUser=D,exports.SessionStore=SessionStore,exports.assertValidMcpToolDefinition=$,exports.canFactory=f,exports.isJsonParseError=z,exports.isJsonRpcId=N,exports.jsonParseErrorResponse=e=>{if(z(e))return{status:400,body:L(null,new McpParseError("Parse error",{message:e.message}))}},exports.jsonRpcError=L,exports.jsonRpcErrorFromCode=(e,t,r,o)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t,message:r},void 0!==o?{data:o}:{})}),exports.jsonRpcResult=V,exports.parseJsonRpcRequest=F,exports.sequelize=y;

package/dist/index.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 /*!
- * @andrewcaires/api v5.3.2
+ * @andrewcaires/api v5.3.4
  * Simple api for small applications using express, jsonwebtoken, sequelize and websocket
  * (c) 2026 Andrew Caires
  * @license: MIT
@@ -599,19 +599,19 @@ declare class McpController extends BaseController {
     private readonly tools;
     private toolsRegistered;
     private readonly handler;
-    private readonly rateLimiter;
     sync(app?: Application): Promise<void>;
+    protected get(ctx: Context): Promise<void>;
     protected options(ctx: Context): Promise<void>;
     protected post(ctx: Context): Promise<void>;
     protected delete(ctx: Context): Promise<void>;
     private getMcpToolMetadata;
     private discoverMcpTools;
     private createMcpToolFromMetadata;
-    private request;
     private isJsonParseError;
     private isMcpEndpoint;
     private jsonParseErrorResponse;
     private respond;
+    private setHeader;
 }
 declare class PermissionsController extends CrudController<PermissionModel> {
@@ -701,15 +701,7 @@ interface McpJsonRpcErrorResult {
     id: McpJsonRpcId | null;
     error: McpJsonRpcErrorBody;
 }
-interface McpSessionContext {
-    auth?: unknown;
-    groups?: unknown;
-    permissions?: unknown;
-    profile?: unknown;
-    user?: unknown;
-    userId?: string | number;
-}
-interface McpSession extends McpSessionContext {
+interface McpSession {
     sessionId: string;
     createdAt: number;
     expiresAt: number;
@@ -730,7 +722,7 @@ interface McpToolDeclaration {
     input?: ValidationShape;
     output?: ValidationShape;
 }
-interface McpToolContext extends McpSessionContext {
+interface McpToolContext {
     session: McpSession;
 }
 type McpToolInput = Record<string, unknown>;
@@ -747,12 +739,6 @@ type McpToolHandlerResult = McpCallToolResult | McpToolOutput;
 interface McpRegisteredTool extends McpToolDeclaration {
     run(_argumentsValue: McpToolInput, _context: McpToolContext): Promise<McpToolHandlerResult> | McpToolHandlerResult;
 }
-interface McpHttpRequest {
-    body: unknown;
-    headers: Record<string, string | undefined>;
-    context?: McpSessionContext;
-    ip?: string;
-}
 interface McpHttpResponse {
     status: number;
     headers?: Record<string, string>;
@@ -760,7 +746,6 @@ interface McpHttpResponse {
 }
 interface McpToolCallLog {
     sessionId: string;
-    userId?: string | number;
     toolName: string;
     durationMs: number;
     success: boolean;
@@ -775,7 +760,7 @@ declare class McpSessionStore {
     private readonly ttl;
     private readonly now;
     constructor(ttl?: number, now?: () => number);
-    create(protocolVersion: McpProtocolVersion, context?: McpSessionContext): McpSession;
+    create(protocolVersion: McpProtocolVersion): McpSession;
     get(sessionId: string): McpSession | undefined;
     require(sessionId: string): McpSession;
     markInitialized(sessionId: string): McpSession;
@@ -805,7 +790,6 @@ declare class McpToolRegistry {
 interface McpHttpHandlerOptions {
     sessions: McpSessionStore;
     tools: McpToolRegistry;
-    allowedOrigins?: Array<string>;
     logger?: McpLogger;
     serverName?: string;
     serverVersion?: string;
@@ -821,15 +805,12 @@ declare const jsonParseErrorResponse: (error: unknown) => McpHttpResponse | unde
 declare class McpHttpHandler {
     private readonly sessions;
     private readonly tools;
-    private readonly allowedOrigins;
     private readonly logger?;
     private readonly serverName;
     private readonly serverVersion;
     constructor(options: McpHttpHandlerOptions);
-    post(request: McpHttpRequest): Promise<McpHttpResponse>;
-    delete(request: McpHttpRequest): McpHttpResponse;
-    get(request: McpHttpRequest): McpHttpResponse;
-    options(request: McpHttpRequest): McpHttpResponse;
+    post(ctx: Context): Promise<McpHttpResponse>;
+    delete(ctx: Context): McpHttpResponse;
     private initialize;
     private initialized;
     private callTool;
@@ -837,16 +818,10 @@ declare class McpHttpHandler {
     private withSession;
     private withInitializedSession;
     private requireSession;
-    private validateProtocolHeader;
     private negotiateProtocolVersion;
     private parseToolCallParams;
     private validateObjectParams;
-    private validateOrigin;
     private withTransportHeaders;
-    private transportHeaders;
-    private getAllowedOrigin;
-    private getSessionHeader;
-    private getHeader;
     private errorResponse;
 }
@@ -856,15 +831,6 @@ declare const jsonRpcError: (id: McpJsonRpcId | null, error: McpError) => McpJso
 declare const jsonRpcErrorFromCode: (id: McpJsonRpcId | null, code: McpErrorCode, message: string, data?: unknown) => McpJsonRpcErrorResult;
 declare const parseJsonRpcRequest: (body: unknown) => McpJsonRpcRequest;
-declare class McpRateLimiter {
-    private readonly entries;
-    private readonly max;
-    private readonly windowMs;
-    private readonly now;
-    constructor(max?: number, windowMs?: number, now?: () => number);
-    consume(key: string): boolean;
-}
 declare const MCP_TOOL_METADATA: unique symbol;
 interface McpToolMetadata extends McpToolDeclaration {
     propertyKey: string | symbol;
@@ -1002,9 +968,6 @@ declare class Env extends Env$1 {
     static readonly KEY_HEADER: string;
     static readonly MODEL_LIMIT: number;
     static readonly MODEL_LIMIT_MAX: number;
-    static readonly MCP_ALLOWED_ORIGINS: string;
-    static readonly MCP_RATE_LIMIT_MAX: number;
-    static readonly MCP_RATE_LIMIT_WINDOW: number;
     static readonly MCP_SESSION_TTL: number;
     static readonly PASSWORD_ALGORITHM: number;
     static readonly PASSWORD_MEMORY_COST: number;
@@ -1040,5 +1003,5 @@ declare class Env extends Env$1 {
     static readonly API_WEBSOCKET_START: boolean;
 }
-export { Application, Audit, AuditModel, AuditTypes, AuditsController, AuthController, AuthService, BaseController, CanCreate, CanDelete, CanRead, CanUpdate, Config, ConfigModel, CrudController, Env, FilesController, ForgotController, ForgotModel, GroupModel, GroupPermissionModel, GroupTypes, GroupsController, GroupsPermissionsController, HasGroups, HasPermissions, HealthController, IsAuthenticated, Log, LogLevels, LogModel, Loggable, LogsController, MCP_DEFAULT_PROTOCOL_VERSION, MCP_HTTP_ALLOW, MCP_HTTP_ALLOWED_METHODS, MCP_PROTOCOL_VERSION_HEADER, MCP_SESSION_ID_HEADER, MCP_SUPPORTED_PROTOCOL_VERSIONS, MCP_TOOL_METADATA, McpController, McpError, McpErrorCode, McpHttpHandler, McpInternalError, McpInvalidParamsError, McpInvalidRequestError, McpInvalidSessionError, McpMethodNotFoundError, McpParseError, McpRateLimiter, McpServerError, McpSessionStore, McpTool, McpToolNotFoundError, McpToolRegistry, MigrationModel, ModelController, ModelService, PermissionModel, PermissionsController, RegisterController, RegisterModel, ReqAuth, ReqGroup, ReqGroups, ReqPermission, ReqPermissions, ReqUser, Service, SessionModel, SessionStore, SetupController, TenantModel, TenantStatus, TestController, UserAuthModel, UserGroupModel, UserModel, UserPasswordModel, UserService, UserStatus, UserTenantModel, UsersController, UsersGroupsController, assertValidMcpToolDefinition, canFactory, isJsonParseError, isJsonRpcId, jsonParseErrorResponse, jsonRpcError, jsonRpcErrorFromCode, jsonRpcResult, parseJsonRpcRequest, sequelize };
-export type { ApplicationEvents, AuthEvents, ForgotEvents, IAuthParameters, McpCallToolResult, McpDecoratedToolHandler, McpHttpHandlerOptions, McpHttpRequest, McpHttpResponse, McpJsonRpcErrorBody, McpJsonRpcErrorResult, McpJsonRpcId, McpJsonRpcRequest, McpJsonRpcResult, McpLogger, McpNormalizedValidation, McpProtocolVersion, McpRegisteredTool, McpSession, McpSessionContext, McpToolCallLog, McpToolContext, McpToolDeclaration, McpToolDefinition, McpToolHandlerResult, McpToolInput, McpToolMetadata, McpToolOptions, McpToolOutput, ModelArgumentsBase, ModelArgumentsCount, ModelArgumentsCreate, ModelArgumentsDelete, ModelArgumentsFindAll, ModelArgumentsFindOne, ModelArgumentsInclude, ModelArgumentsUpdate, ModelCallbackFindAll, ModelCallbackFindOne, ModelOptions, ModelResultFindAll, RegisterEvents };
+export { Application, Audit, AuditModel, AuditTypes, AuditsController, AuthController, AuthService, BaseController, CanCreate, CanDelete, CanRead, CanUpdate, Config, ConfigModel, CrudController, Env, FilesController, ForgotController, ForgotModel, GroupModel, GroupPermissionModel, GroupTypes, GroupsController, GroupsPermissionsController, HasGroups, HasPermissions, HealthController, IsAuthenticated, Log, LogLevels, LogModel, Loggable, LogsController, MCP_DEFAULT_PROTOCOL_VERSION, MCP_HTTP_ALLOW, MCP_HTTP_ALLOWED_METHODS, MCP_PROTOCOL_VERSION_HEADER, MCP_SESSION_ID_HEADER, MCP_SUPPORTED_PROTOCOL_VERSIONS, MCP_TOOL_METADATA, McpController, McpError, McpErrorCode, McpHttpHandler, McpInternalError, McpInvalidParamsError, McpInvalidRequestError, McpInvalidSessionError, McpMethodNotFoundError, McpParseError, McpServerError, McpSessionStore, McpTool, McpToolNotFoundError, McpToolRegistry, MigrationModel, ModelController, ModelService, PermissionModel, PermissionsController, RegisterController, RegisterModel, ReqAuth, ReqGroup, ReqGroups, ReqPermission, ReqPermissions, ReqUser, Service, SessionModel, SessionStore, SetupController, TenantModel, TenantStatus, TestController, UserAuthModel, UserGroupModel, UserModel, UserPasswordModel, UserService, UserStatus, UserTenantModel, UsersController, UsersGroupsController, assertValidMcpToolDefinition, canFactory, isJsonParseError, isJsonRpcId, jsonParseErrorResponse, jsonRpcError, jsonRpcErrorFromCode, jsonRpcResult, parseJsonRpcRequest, sequelize };
+export type { ApplicationEvents, AuthEvents, ForgotEvents, IAuthParameters, McpCallToolResult, McpDecoratedToolHandler, McpHttpHandlerOptions, McpHttpResponse, McpJsonRpcErrorBody, McpJsonRpcErrorResult, McpJsonRpcId, McpJsonRpcRequest, McpJsonRpcResult, McpLogger, McpNormalizedValidation, McpProtocolVersion, McpRegisteredTool, McpSession, McpToolCallLog, McpToolContext, McpToolDeclaration, McpToolDefinition, McpToolHandlerResult, McpToolInput, McpToolMetadata, McpToolOptions, McpToolOutput, ModelArgumentsBase, ModelArgumentsCount, ModelArgumentsCreate, ModelArgumentsDelete, ModelArgumentsFindAll, ModelArgumentsFindOne, ModelArgumentsInclude, ModelArgumentsUpdate, ModelCallbackFindAll, ModelCallbackFindOne, ModelOptions, ModelResultFindAll, RegisterEvents };

package/dist/index.esm.js CHANGED Viewed

@@ -1,7 +1,7 @@
 /*!
- * @andrewcaires/api v5.3.2
+ * @andrewcaires/api v5.3.4
  * Simple api for small applications using express, jsonwebtoken, sequelize and websocket
  * (c) 2026 Andrew Caires
  * @license: MIT
  */
-import{Use as e,UnauthorizedError as t,parameterFactory as i,ResponseError as r,Context as n,NotFoundError as o,InternalServerError as s,ValidationError as a,StatusCodes as d,BadRequestError as l,Application as u,Ctx as c,Headers as p,Session as v,Extends as g,Get as h,Query as y,Controller as m,Post as E,Validate as f,Body as _,App as S,Middleware as O,Delete as A,Put as T,Params as b,All as I,Options as P,Upload as w}from"@andrewcaires/express";import{Env as M,Log as x,LogColor as C,Hash as R,sha256 as j}from"@andrewcaires/node";import{isUndefined as D,isFunction as N,includesArray as L,isPlainObject as H,isString as k,isNumber as F,uuidv7 as B,isArray as K,isValidationShape as q,Validation as V,getConstructor as U,noop as Y,clamp as $,merge as W,clone as z,forEachAsync as G,upperCamelCase as J,uniqueArray as Q,isNull as X,forEachSeries as Z,sleep as ee,EventEmitter as te,isDef as ie,uniqueID as re}from"@andrewcaires/utils.js";import{WebSocketServer as ne}from"ws";import{Sequelize as oe,Hooks as se,Column as ae,Association as de,Database as le,ModelName as ue,Version as ce,Model as pe,Index as ve,DefaultValue as ge,Op as he,Where as ye}from"@andrewcaires/sequelize";import{config as me}from"dotenv";import{metadata as Ee,Trait as fe,Singleton as _e}from"@andrewcaires/decorator";import{Store as Se}from"express-session";import Oe from"jsonwebtoken";import{hashSync as Ae,verify as Te}from"@node-rs/argon2";import{existsSync as be,statSync as Ie,readdirSync as Pe,mkdirSync as we,lstatSync as Me,rmSync as xe}from"fs";import{join as Ce}from"path";function Re(e,t,i,r){var n,o=arguments.length,s=o<3?t:null===r?r=Object.getOwnPropertyDescriptor(t,i):r;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)s=Reflect.decorate(e,t,i,r);else for(var a=e.length-1;a>=0;a--)(n=e[a])&&(s=(o<3?n(s):o>3?n(t,i,s):n(t,i))||s);return o>3&&s&&Object.defineProperty(t,i,s),s}function je(e,t){return function(i,r){t(i,r,e)}}function De(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function Ne(e,t,i,r){return new(i||(i=Promise))(function(n,o){function s(e){try{d(r.next(e))}catch(e){o(e)}}function a(e){try{d(r.throw(e))}catch(e){o(e)}}function d(e){var t;e.done?n(e.value):(t=e.value,t instanceof i?t:new i(function(e){e(t)})).then(s,a)}d((r=r.apply(e,t||[])).next())})}var Le;"function"==typeof SuppressedError&&SuppressedError,me({quiet:!0});class Env extends M{}Le=Env,Env.BASE_NAME=Le.getString("BASE_NAME",""),Env.CONSOLE_ERROR=Le.getBool("CONSOLE_ERROR",!1),Env.DATABASE_URI=Le.getString("DATABASE_URI","",!0),Env.DATABASE_LOG=Le.getBool("DATABASE_LOG",!1),Env.DATABASE_AUDIT=Le.getBool("DATABASE_AUDIT",!0),Env.DATABASE_PREFIX=Le.getString("DATABASE_PREFIX",""),Env.DATABASE_TIMEZONE=Le.getString("DATABASE_TIMEZONE","+00:00"),Env.HTTP_CROSS=Le.getString("HTTP_CROSS",""),Env.HTTP_PORT=Le.getInt("HTTP_PORT",Le.getInt("PORT",3e3)),Env.HTTP_PUBLIC=Le.getString("HTTP_PUBLIC",""),Env.HTTP_TLS_CA=Le.getFile("HTTP_TLS_CA"),Env.HTTP_TLS_CRT=Le.getFile("HTTP_TLS_CRT"),Env.HTTP_TLS_KEY=Le.getFile("HTTP_TLS_KEY"),Env.KEY_HEADER=Le.getString("KEY_HEADER","x-api-key"),Env.MODEL_LIMIT=Le.getInt("MODEL_LIMIT",10),Env.MODEL_LIMIT_MAX=Le.getInt("MODEL_LIMIT_MAX",100),Env.MCP_ALLOWED_ORIGINS=Le.getString("MCP_ALLOWED_ORIGINS",""),Env.MCP_RATE_LIMIT_MAX=Le.getInt("MCP_RATE_LIMIT_MAX",120),Env.MCP_RATE_LIMIT_WINDOW=Le.getMs("MCP_RATE_LIMIT_WINDOW","1m"),Env.MCP_SESSION_TTL=Le.getMs("MCP_SESSION_TTL","30m"),Env.PASSWORD_ALGORITHM=Le.getInt("PASSWORD_ALGORITHM",2),Env.PASSWORD_MEMORY_COST=Le.getInt("PASSWORD_MEMORY_COST",4096),Env.PASSWORD_PARALLELISM=Le.getInt("PASSWORD_PARALLELISM",1),Env.PASSWORD_PEPPER=Le.getString("PASSWORD_PEPPER",""),Env.PASSWORD_TIME_COST=Le.getInt("PASSWORD_TIME_COST",3),Env.SLEEP_AUTH=Le.getMs("SLEEP_AUTH","2s"),Env.SLEEP_FORGOT=Le.getMs("SLEEP_FORGOT","5s"),Env.SLEEP_REGISTRY=Le.getMs("SLEEP_REGISTRY","5s"),Env.TENANT_HEADER=Le.getString("TENANT_HEADER","x-tenant-id"),Env.TOKEN_CRT=Le.getFile("TOKEN_CRT"),Env.TOKEN_HEADER=Le.getString("TOKEN_HEADER","authorization"),Env.TOKEN_KEY=Le.getFile("TOKEN_KEY"),Env.TOKEN_TTL=Le.getMs("TOKEN_TTL","1d"),Env.TOKEN_TTL_FORGOT=Le.getMs("TOKEN_TTL_FORGOT","1d"),Env.TOKEN_TTL_RENEW=Le.getMs("TOKEN_TTL_RENEW","1d"),Env.TOKEN_TYPE=Le.getString("TOKEN_TYPE","bearer"),Env.API_BODYPARSER_STRICT=Le.getBool("API_BODYPARSER_STRICT",!0),Env.API_BODYPARSER_INFLATE=Le.getBool("API_BODYPARSER_INFLATE",!0),Env.API_BODYPARSER_LIMIT=Le.getString("API_BODYPARSER_LIMIT","10mb"),Env.API_BODYPARSER_TYPE=Le.getString("API_BODYPARSER_TYPE","json"),Env.API_HTTP_HYBRID=Le.getBool("API_HTTP_HYBRID",!1),Env.API_HTTP_NOTFOUND=Le.getString("API_HTTP_NOTFOUND",""),Env.API_HTTP_PATH=Le.getString("API_HTTP_PATH","/api"),Env.API_HTTP_REDIRECT=Le.getString("API_HTTP_REDIRECT",""),Env.API_KEY_HASH=Le.getString("API_KEY_HASH",""),Env.API_SESSION_NAME=Le.getString("API_SESSION_NAME","session.id"),Env.API_SESSION_LIFETIME=Le.getMs("API_SESSION_LIFETIME","1d"),Env.API_SESSION_SECRET=Le.getString("API_SESSION_SECRET","yoursecret"),Env.API_TOKEN_COOKIE=Le.getString("API_TOKEN_COOKIE","authorization"),Env.API_TOKEN_COOKIE_SET=Le.getBool("API_TOKEN_COOKIE_SET",!0),Env.API_USER_HISTORY=Le.getBool("API_USER_HISTORY",!0),Env.API_WEBSOCKET_START=Le.getBool("API_WEBSOCKET_START",!1);const He=new oe({uri:Env.DATABASE_URI,logging:!!Env.DATABASE_LOG&&(e=>x.console(C.Magenta,"sql",e)),prefix:Env.DATABASE_PREFIX,timezone:Env.DATABASE_TIMEZONE});var ke,Fe,Be,Ke,qe;!function(e){e.CREATE="CREATE",e.DELETE="DELETE",e.UPDATE="UPDATE"}(ke||(ke={})),function(e){e.SYSTEM="system",e.TENANT="tenant"}(Fe||(Fe={})),function(e){e.INFO="info",e.WARN="warn",e.ERROR="error"}(Be||(Be={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.SUSPENDED="suspended",e.DISABLED="disabled",e.ARCHIVED="archived"}(Ke||(Ke={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.DISABLED="disabled",e.LOCKED="locked",e.ARCHIVED="archived"}(qe||(qe={}));const Ve=i=>r=>(n,o,s)=>{e(e=>Ne(void 0,void 0,void 0,function*(){var n;D(r)&&(r=N(e.controller.name)?e.controller.name():null===(n=e.controller.constructor)||void 0===n?void 0:n.name);const{permissions:o=[]}=e.req;if(o.includes(`${r}.${i}`))return e.next();e.error(new t("Access Denied"))}))(n,o,s)},Ue=Ve("create"),Ye=Ve("delete"),$e=Ve("read"),We=Ve("update"),ze=(...i)=>(r,n,o)=>{e(e=>Ne(void 0,void 0,void 0,function*(){const{groups:r=[]}=e.req;if(L(i,r))return e.next();e.error(new t("Access Denied"))}))(r,n,o)},Ge=(...i)=>(r,n,o)=>{e(e=>Ne(void 0,void 0,void 0,function*(){const{permissions:r}=e.req;if(L(i,null!=r?r:[]))return e.next();e.error(new t("Access Denied"))}))(r,n,o)},Je=()=>(i,r,n)=>{e(e=>Ne(void 0,void 0,void 0,function*(){yield(e=>Ne(void 0,void 0,void 0,function*(){var i,r,n,o;if(e.req.auth&&e.req.user)return e.next();const{[Env.KEY_HEADER]:s,[Env.TOKEN_HEADER]:a,[Env.TENANT_HEADER]:d,"user-agent":l}=e.getHeaders(),u=e.getQuery(Env.KEY_HEADER),c=(null===(i=s||u)||void 0===i?void 0:i.toString())||"";let p=e.getCookie(Env.API_TOKEN_COOKIE);p=`${Env.TOKEN_TYPE} ${p}`;const[v,g]=null!==(n=null===(r=a||p)||void 0===r?void 0:r.split(" "))&&void 0!==n?n:["",""];if(!(c||g&&v.toLowerCase()==Env.TOKEN_TYPE))return e.error(new t("Invalid token"));const{authService:h,userService:y}=e.app,{auth:m,user:E}=null!==(o=yield(c?h.key(c.toString()):h.user(g)).catch(t=>{e.error(t)}))&&void 0!==o?o:{};if(!m||!E)return;if(!c&&m.user_agent&&m.user_agent!=l)return e.error(new t("Invalid token"));e.req.auth=m,e.req.user=E;const f=d||null,_=yield y.getTenants(E.id);if(f&&!_.find(e=>e.id==f))return e.error(new t("Invalid token"));const S=y.getGroups(E.id,f),O=y.getPermissions(E.id,f),[A,T]=yield Promise.all([S,O]);e.req.groups=A,e.req.permissions=T,e.req.tenants=_,e.next()}))(e)}))(i,r,n)},Qe=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.auth}),Xe=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.groups)&&void 0!==r?r:[]).includes(t)}),Ze=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.groups)&&void 0!==i?i:[]}),et=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.permissions)&&void 0!==r?r:[]).includes(t)}),tt=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.permissions)&&void 0!==i?i:[]}),it=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.user}),rt={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,ServerError:-32e3,InvalidSession:-32001};class McpError extends r{constructor(e,t=rt.ServerError,i=200,r){super(e,i),this.code=t,this.data=r,this.name=this.constructor.name}}class McpParseError extends McpError{constructor(e="Parse error",t){super(e,rt.ParseError,400,t)}}class McpInvalidRequestError extends McpError{constructor(e="Invalid Request",t){super(e,rt.InvalidRequest,400,t)}}class McpMethodNotFoundError extends McpError{constructor(e){super(`Method not found: ${e}`,rt.MethodNotFound,200)}}class McpInvalidParamsError extends McpError{constructor(e="Invalid params",t){super(e,rt.InvalidParams,200,t)}}class McpInternalError extends McpError{constructor(e="Internal error",t){super(e,rt.InternalError,200,t)}}class McpServerError extends McpError{constructor(e="Server error",t){super(e,rt.ServerError,500,t)}}class McpInvalidSessionError extends McpError{constructor(e="Invalid MCP session",t=404){super(e,rt.InvalidSession,t)}}class McpToolNotFoundError extends McpError{constructor(e){super("Tool not found",rt.InvalidParams,200,{toolName:e})}}const nt=e=>k(e)||F(e),ot=(e,t)=>({jsonrpc:"2.0",id:e,result:t}),st=(e,t)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t.code,message:t.message},void 0!==t.data?{data:t.data}:{})}),at=(e,t,i,r)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t,message:i},void 0!==r?{data:r}:{})}),dt=e=>{if(!H(e))throw new McpInvalidRequestError("Invalid Request");if("2.0"!==e.jsonrpc)throw new McpInvalidRequestError("Invalid JSON-RPC version");if(!k(e.method))throw new McpInvalidRequestError("Invalid method");if(void 0!==e.id&&!nt(e.id))throw new McpInvalidRequestError("Invalid id");return e},lt=["2025-11-25","2025-06-18"],ut=lt[0],ct="MCP-Protocol-Version",pt="MCP-Session-Id",vt=["POST","DELETE","OPTIONS"],gt=vt.join(", "),ht=e=>{if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode},yt=e=>{if(ht(e))return{status:400,body:st(null,new McpParseError("Parse error",{message:e.message}))}};class McpHttpHandler{constructor(e){var t,i,r;this.sessions=e.sessions,this.tools=e.tools,this.allowedOrigins=null!==(t=e.allowedOrigins)&&void 0!==t?t:[],this.logger=e.logger,this.serverName=null!==(i=e.serverName)&&void 0!==i?i:"andrewcaires-api-mcp",this.serverVersion=null!==(r=e.serverVersion)&&void 0!==r?r:"1.0.0"}post(e){return Ne(this,void 0,void 0,function*(){var t;const i=this.validateOrigin(e);if(i)return i;let r=null;try{const i=dt(e.body);if(r=null!==(t=i.id)&&void 0!==t?t:null,"initialize"===i.method)return this.withTransportHeaders(this.initialize(i.id,i.params,e),e);if("notifications/initialized"===i.method)return this.withTransportHeaders(this.initialized(i.id,i.params,e),e);if("ping"===i.method)return this.validateObjectParams(i.params),this.withTransportHeaders(this.withSession(i.id,e,e=>({status:200,body:ot(e,{})})),e);if("tools/list"===i.method)return this.validateObjectParams(i.params),this.withTransportHeaders(this.withInitializedSession(i.id,e,e=>({status:200,body:ot(e,{tools:this.tools.list()})})),e);if("tools/call"===i.method)return this.withTransportHeaders(yield this.callTool(i.id,i.params,e),e);if(void 0===i.id)return this.withTransportHeaders({status:202},e);throw new McpMethodNotFoundError(i.method)}catch(t){return this.withTransportHeaders(this.errorResponse(r,t),e)}})}delete(e){const t=this.validateOrigin(e);if(t)return t;const i=this.getSessionHeader(e);if(!i)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError(`${pt} header is required`,400)),e);const r=this.sessions.get(i);if(!r)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError),e);try{this.validateProtocolHeader(e,r.protocolVersion)}catch(t){return this.withTransportHeaders(this.errorResponse(null,t),e)}return this.sessions.delete(i),this.withTransportHeaders({status:204},e)}get(e){const t=this.validateOrigin(e);return t||this.withTransportHeaders({status:405},e)}options(e){const t=this.validateOrigin(e);return t||this.withTransportHeaders({status:204},e)}initialize(e,t,i){const r=this.requireRequestId({jsonrpc:"2.0",id:e,method:"initialize",params:t}),n=this.negotiateProtocolVersion(t),o=this.sessions.create(n,i.context);return{status:200,headers:{[pt]:o.sessionId,[ct]:o.protocolVersion},body:ot(r,{protocolVersion:o.protocolVersion,capabilities:{tools:{listChanged:!1}},serverInfo:{name:this.serverName,version:this.serverVersion}})}}initialized(e,t,i){if(void 0!==e)throw new McpInvalidRequestError("notifications/initialized must not include id");this.validateObjectParams(t);const r=this.requireSession(i);return this.validateProtocolHeader(i,r.protocolVersion),this.sessions.markInitialized(r.sessionId),{status:202}}callTool(e,t,i){return Ne(this,void 0,void 0,function*(){return this.withInitializedSession(e,i,(e,i)=>Ne(this,void 0,void 0,function*(){var r;const n=this.parseToolCallParams(t),o=Date.now();let s,a=!1;try{const t=yield this.tools.call(n.name,n.arguments,i);return a=!t.isError,s=t.isError?"Tool execution failed":void 0,{status:200,body:ot(e,t)}}catch(e){if(e instanceof McpError)throw s=e.message,e;throw s="Internal error",e}finally{null===(r=this.logger)||void 0===r||r.toolCall(Object.assign({sessionId:i.sessionId,userId:i.userId,toolName:n.name,durationMs:Date.now()-o,success:a},s?{error:s}:{}))}}))})}requireRequestId(e){if(!nt(e.id))throw new McpInvalidRequestError("Request id is required");return e.id}withSession(e,t,i){const r=this.requireRequestId({jsonrpc:"2.0",id:e,method:"session"}),n=this.requireSession(t);return this.validateProtocolHeader(t,n.protocolVersion),i(r,n)}withInitializedSession(e,t,i){return this.withSession(e,t,(e,t)=>{if(!t.initialized)throw new McpInvalidRequestError("Session not initialized");return i(e,t)})}requireSession(e){const t=this.getSessionHeader(e);if(!t)throw new McpInvalidSessionError(`${pt} header is required`,400);return this.sessions.require(t)}validateProtocolHeader(e,t){const i=this.getHeader(e,"mcp-protocol-version");if(i&&i!==t)throw new McpInvalidRequestError(`Invalid ${ct} header`)}negotiateProtocolVersion(e){if(!H(e)||!k(e.protocolVersion))throw new McpInvalidParamsError("params.protocolVersion is required");return lt.includes(e.protocolVersion)?e.protocolVersion:ut}parseToolCallParams(e){if(!H(e)||!k(e.name))throw new McpInvalidParamsError("params.name is required");return{name:e.name,arguments:e.arguments}}validateObjectParams(e){if(void 0!==e&&!H(e))throw new McpInvalidParamsError("params must be an object")}validateOrigin(e){if(this.getHeader(e,"origin")&&!this.getAllowedOrigin(e))return{status:403}}withTransportHeaders(e,t){var i;return Object.assign(Object.assign({},e),{headers:Object.assign(Object.assign({},this.transportHeaders(t)),null!==(i=e.headers)&&void 0!==i?i:{})})}transportHeaders(e){const t={Allow:gt,"Access-Control-Allow-Methods":gt,"Access-Control-Allow-Headers":`Content-Type, Accept, ${pt}, ${ct}`},i=this.getAllowedOrigin(e);return i&&(t["Access-Control-Allow-Origin"]=i),t}getAllowedOrigin(e){const t=this.getHeader(e,"origin");if(!t)return;if(this.allowedOrigins.includes("*"))return"*";if(this.allowedOrigins.includes(t))return t;const i=this.getHeader(e,"host");if(!this.allowedOrigins.length&&i)try{if(new URL(t).host===i)return t}catch(e){return}}getSessionHeader(e){return this.getHeader(e,"mcp-session-id")}getHeader(e,t){var i;return null===(i=Object.entries(e.headers).find(([e])=>e.toLowerCase()===t))||void 0===i?void 0:i[1]}errorResponse(e,t){if(t instanceof McpError)return{status:t.status,body:st(e,t)};const i=new McpServerError;return{status:i.status,body:st(e,i)}}}class McpRateLimiter{constructor(e=120,t=6e4,i=()=>Date.now()){this.entries=new Map,this.max=e,this.windowMs=t,this.now=i}consume(e){if(this.max<=0)return!0;const t=this.now(),i=this.entries.get(e);return!i||i.resetAt<=t?(this.entries.set(e,{count:1,resetAt:t+this.windowMs}),!0):(i.count++,i.count<=this.max)}}class McpSessionStore{constructor(e=18e5,t=()=>Date.now()){this.sessions=new Map,this.ttl=e,this.now=t}create(e,t){this.cleanup();const i=this.now(),r=Object.assign(Object.assign({},t),{sessionId:B(),createdAt:i,expiresAt:i+this.ttl,protocolVersion:e,initialized:!1});return this.sessions.set(r.sessionId,r),r}get(e){this.cleanup();const t=this.sessions.get(e);if(t){if(!this.isExpired(t))return t;this.sessions.delete(e)}}require(e){const t=this.get(e);if(!t)throw new McpInvalidSessionError;return t}markInitialized(e){const t=this.require(e);return t.initialized=!0,t}delete(e){return this.cleanup(),this.sessions.delete(e)}cleanup(){const e=this.now();for(const[t,i]of this.sessions)i.expiresAt<=e&&this.sessions.delete(t)}size(){return this.cleanup(),this.sessions.size}isExpired(e){return e.expiresAt<=this.now()}}const mt=Symbol.for("@andrewcaires/api:mcp:tool"),Et=e=>{if(!k(e.name)||!e.name.trim())throw new Error("MCP tool name is required");if(!k(e.title)||!e.title.trim())throw new Error(`MCP tool "${e.name}" title is required`);if(!k(e.description)||!e.description.trim())throw new Error(`MCP tool "${e.name}" description is required`);if(D(e.input))throw new Error(`MCP tool "${e.name}" input must be declared`)};class McpToolRegistry{constructor(e=[]){this.tools=new Map,e.forEach(e=>this.register(e))}register(e){var t,i;if(Et(e),this.tools.has(e.name))throw new Error(`Duplicate MCP tool name: ${e.name}`);const r=this.normalizeMcpValidation(null!==(t=e.input)&&void 0!==t?t:{},"object"),n=e.output?this.normalizeMcpValidation(null!==(i=e.output)&&void 0!==i?i:{},"any"):void 0;this.tools.set(e.name,{inputSchema:r.schema,inputValidation:r.validation,outputSchema:null==n?void 0:n.schema,outputValidation:null==n?void 0:n.validation,tool:e})}list(){return Array.from(this.tools.values()).map(({tool:e})=>{var t,i,r,n;return Object.assign({name:e.name,title:e.title,description:e.description,inputSchema:null!==(i=null===(t=this.tools.get(e.name))||void 0===t?void 0:t.inputSchema)&&void 0!==i?i:{}},(null===(r=this.tools.get(e.name))||void 0===r?void 0:r.outputSchema)?{outputSchema:null===(n=this.tools.get(e.name))||void 0===n?void 0:n.outputSchema}:{})})}call(e,t,i){return Ne(this,void 0,void 0,function*(){var r;const n=this.tools.get(e);if(!n)throw new McpToolNotFoundError(e);const o=null!=t?t:{};if(!H(o))return this.toolInputValidationError(["arguments must be an object"]);const s={session:i,auth:i.auth,groups:i.groups,permissions:i.permissions,profile:i.profile,user:i.user,userId:i.userId};let a=o;const d=this.validateAdditionalProperties(n.inputSchema,o);if(d.length)return this.toolInputValidationError(d);if(n.inputValidation){const e=n.inputValidation.validate(o,s);if(e.error)return this.toolInputValidationError([e.error]);a=null!==(r=e.value)&&void 0!==r?r:{}}try{const e=yield n.tool.run(a,s);if(!n.outputValidation&&this.isCallToolResult(e))return e;let t=e;if(n.outputValidation){const i=n.outputValidation.validate(e,s);if(i.error)return this.outputValidationError();t=i.value}return{content:[{type:"text",text:JSON.stringify(t)}],structuredContent:t}}catch(e){return{isError:!0,content:[{type:"text",text:"Tool execution failed."}]}}})}isCallToolResult(e){return H(e)&&K(e.content)}normalizeMcpValidation(e,t="object"){if(q(e)){const t=V.object(e).parse();return{schema:t.toSchema(),validation:t}}const i="object"===t?V.object({}).parse():V.any();return{schema:i.toSchema(),validation:i}}outputValidationError(){return{isError:!0,content:[{type:"text",text:"Tool output validation failed."}]}}toolInputValidationError(e){return{isError:!0,content:[{type:"text",text:"Invalid tool arguments."}],structuredContent:{errors:e}}}validateAdditionalProperties(e,t){if("object"!==e.type||!1!==e.additionalProperties||!H(e.properties))return[];const i=Object.keys(e.properties);return Object.keys(t).filter(e=>!i.includes(e)).map(e=>`additional property "${e}" is not allowed`)}}const ft=e=>(Et(e),(t,i)=>{_t(i)?i.addInitializer(function(){St(this.constructor,i.name,e)}):St(t,i,e)}),_t=e=>"object"==typeof e&&null!==e&&"kind"in e&&"method"===e.kind&&"name"in e&&"addInitializer"in e,St=(e,t,i)=>{const r=Ee(mt,e,[]),n=Object.assign(Object.assign({},i),{propertyKey:t});r.some(e=>e.propertyKey===n.propertyKey&&e.name===n.name)||r.push(n)},Ot=(e,t,i)=>{var r,o,s,a,d,l,u,c,p,v,g;const h=i.ctx instanceof n?i.ctx:null,y=null!==(r=null==h?void 0:h.id)&&void 0!==r?r:null,m=null!==(d=null!==(a=null===(s=null===(o=null==h?void 0:h.req)||void 0===o?void 0:o.user)||void 0===s?void 0:s.id)&&void 0!==a?a:i.user_id)&&void 0!==d?d:null,E={type:e,model:null!==(l=null==t?void 0:t.getTableName())&&void 0!==l?l:null,source:null!==(u=Env.BASE_NAME)&&void 0!==u?u:"",request_id:y,user_id:m};return h?Object.assign(Object.assign({},E),{full_url:null!==(c=h.getUrl())&&void 0!==c?c:"",ip_address:null!==(p=h.getIp())&&void 0!==p?p:"",user_agent:null!==(g=null===(v=h.req)||void 0===v?void 0:v.headers["user-agent"])&&void 0!==g?g:""}):E},At=e=>{const t=U(e),i=t.primaryKeyAttribute;return{model:t,record_id:i?e.getDataValue(i):null}},Tt={afterCreate:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=At(e);yield Lt.create(Object.assign(Object.assign({},Ot(ke.CREATE,i,t)),{record:r,currently:e.toJSON()})).catch(x.catch)}),afterUpdate:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=At(e),n={},o={},s=e.changed();s&&s.length&&s.forEach(t=>{n[t]=e.getDataValue(t),o[t]=e.previous(t)}),yield Lt.create(Object.assign(Object.assign({},Ot(ke.UPDATE,i,t)),{record:r,currently:n,previously:o})).catch(x.catch)}),afterDestroy:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=At(e);yield Lt.create(Object.assign(Object.assign({},Ot(ke.DELETE,i,t)),{record:r,currently:e.toJSON()})).catch(x.catch)})},bt=e=>(D(e)&&(e=Env.DATABASE_AUDIT),se(e?Tt:{}));let It=class RegisterModel extends pe{};Re([ae.Id(7),De("design:type",String)],It.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],It.prototype,"secret",void 0),Re([ae.FullDate(),De("design:type",Number)],It.prototype,"expired_at",void 0),Re([ae.Boolean(),De("design:type",Boolean)],It.prototype,"active",void 0),Re([ae.CreatedAt(),De("design:type",Date)],It.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],It.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],It.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],It.prototype,"user_id",void 0),It=Re([le(He),ue("register"),ce("5.3.1")],It);let Pt=class UserAuthModel extends pe{};Re([ae.Id(7),De("design:type",String)],Pt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Pt.prototype,"secret",void 0),Re([ae.String(),De("design:type",String)],Pt.prototype,"ip_address",void 0),Re([ae.String(),De("design:type",String)],Pt.prototype,"user_agent",void 0),Re([ae.FullDate(),De("design:type",Object)],Pt.prototype,"revoked_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Pt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Pt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Pt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Pt.prototype,"user_id",void 0),Pt=Re([le(He),ue("users_auth"),ce("5.3.1")],Pt);let wt=class PermissionModel extends pe{};Re([ae.Id(7),De("design:type",String)],wt.prototype,"id",void 0),Re([ae.String(),ve(),De("design:type",String)],wt.prototype,"name",void 0),Re([ae.Text(),De("design:type",String)],wt.prototype,"description",void 0),Re([ae.Boolean(),De("design:type",Boolean)],wt.prototype,"active",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],wt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],wt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],wt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],wt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>Mt),De("design:type",Array)],wt.prototype,"groups_permissions",void 0),wt=Re([le(He),ue("permission"),bt(),ce("5.3.1")],wt);let Mt=class GroupPermissionModel extends pe{};Re([ae.Id(7),De("design:type",String)],Mt.prototype,"id",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Mt.prototype,"created_at",void 0),Re([de.BelongsTo(()=>xt),De("design:type",String)],Mt.prototype,"group_id",void 0),Re([de.BelongsTo(()=>wt),De("design:type",String)],Mt.prototype,"permission_id",void 0),Mt=Re([le(He),ue("groups_permissions"),bt(),ce("5.3.1")],Mt);let xt=class GroupModel extends pe{};Re([ae.Id(7),De("design:type",String)],xt.prototype,"id",void 0),Re([ae.String(),ve(),De("design:type",String)],xt.prototype,"name",void 0),Re([ae.Text(),De("design:type",String)],xt.prototype,"description",void 0),Re([ae.Enum(Fe),ge(Fe.SYSTEM),De("design:type",String)],xt.prototype,"type",void 0),Re([ae.Boolean(),De("design:type",Boolean)],xt.prototype,"active",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],xt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],xt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],xt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],xt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>jt),De("design:type",Array)],xt.prototype,"users_groups",void 0),Re([de.HasMany(()=>Mt),De("design:type",Array)],xt.prototype,"groups_Permission",void 0),xt=Re([le(He),ue("group"),bt(),ce("5.3.1")],xt);let Ct=class UserTenantModel extends pe{};Re([ae.Id(7),De("design:type",String)],Ct.prototype,"id",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Ct.prototype,"created_at",void 0),Re([de.BelongsTo(()=>Rt),De("design:type",String)],Ct.prototype,"tenant_id",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Ct.prototype,"user_id",void 0),Ct=Re([le(He),ue("users_tenants"),bt(),ce("5.3.1")],Ct);let Rt=class TenantModel extends pe{};Re([ae.Id(7),De("design:type",String)],Rt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Rt.prototype,"name",void 0),Re([ae.Enum(Ke),ge(Ke.ACTIVE),De("design:type",String)],Rt.prototype,"status",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],Rt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Rt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Rt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Rt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>Ct),De("design:type",Array)],Rt.prototype,"users_tenants",void 0),Rt=Re([le(He),ue("tenant"),bt(),ce("5.3.1")],Rt);let jt=class UserGroupModel extends pe{};Re([ae.Id(7),De("design:type",String)],jt.prototype,"id",void 0),Re([ae.CreatedAt(),De("design:type",Date)],jt.prototype,"created_at",void 0),Re([de.BelongsTo(()=>xt),De("design:type",String)],jt.prototype,"group_id",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],jt.prototype,"user_id",void 0),Re([de.BelongsTo(()=>Rt),De("design:type",String)],jt.prototype,"tenant_id",void 0),jt=Re([le(He),ue("users_groups"),bt(),ce("5.3.1")],jt);let Dt=class UserPasswordModel extends pe{};Re([ae.Id(7),De("design:type",String)],Dt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Dt.prototype,"hash",void 0),Re([ae.FullDate(),De("design:type",Object)],Dt.prototype,"revoked_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Dt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Dt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Dt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Dt.prototype,"user_id",void 0),Dt=Re([le(He),ue("users_password"),bt(),ce("5.3.1")],Dt);let Nt=class UserModel extends pe{};Re([ae.Id(7),De("design:type",String)],Nt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Nt.prototype,"name",void 0),Re([ae.String(),De("design:type",String)],Nt.prototype,"username",void 0),Re([ae.String(),De("design:type",String)],Nt.prototype,"email",void 0),Re([ae.Text(),De("design:type",String)],Nt.prototype,"notes",void 0),Re([ae.Enum(qe),ge(qe.ACTIVE),De("design:type",String)],Nt.prototype,"status",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],Nt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Nt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Nt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Nt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>Lt),De("design:type",Array)],Nt.prototype,"audits",void 0),Re([de.HasMany(()=>Pt),De("design:type",Array)],Nt.prototype,"users_auths",void 0),Re([de.HasMany(()=>It),De("design:type",Array)],Nt.prototype,"registers",void 0),Re([de.HasMany(()=>jt),De("design:type",Array)],Nt.prototype,"users_groups",void 0),Re([de.HasMany(()=>Dt),De("design:type",Array)],Nt.prototype,"users_passwords",void 0),Re([de.HasMany(()=>Ct),De("design:type",Array)],Nt.prototype,"users_tenants",void 0),Nt=Re([le(He),ue("user"),bt(),ce("5.3.1")],Nt);let Lt=class AuditModel extends pe{};Re([ae.Id(7),De("design:type",String)],Lt.prototype,"id",void 0),Re([ae.Enum(ke),De("design:type",String)],Lt.prototype,"type",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"model",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"record",void 0),Re([ae.Json(),De("design:type",Object)],Lt.prototype,"currently",void 0),Re([ae.Json(),De("design:type",Object)],Lt.prototype,"previously",void 0),Re([ae.String(36),De("design:type",String)],Lt.prototype,"request_id",void 0),Re([ae.Text(),De("design:type",String)],Lt.prototype,"full_url",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"ip_address",void 0),Re([ae.Text(),De("design:type",String)],Lt.prototype,"user_agent",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"source",void 0),Re([ae.FullDate(),De("design:type",Object)],Lt.prototype,"reverted_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Lt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Lt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Lt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Lt.prototype,"user_id",void 0),Lt=Re([le(He),ue("audit"),ce("5.3.1")],Lt);let Ht=class ConfigModel extends pe{};Re([ae.Id(7),De("design:type",String)],Ht.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Ht.prototype,"key",void 0),Re([ae.Text(),De("design:type",String)],Ht.prototype,"value",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Ht.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Ht.prototype,"updated_at",void 0),Ht=Re([le(He),ue("configs"),ce("5.3.1")],Ht);let kt=class ForgotModel extends pe{};Re([ae.Id(7),De("design:type",String)],kt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],kt.prototype,"secret",void 0),Re([ae.FullDate(),De("design:type",Number)],kt.prototype,"expired_at",void 0),Re([ae.Boolean(),De("design:type",Boolean)],kt.prototype,"active",void 0),Re([ae.CreatedAt(),De("design:type",Date)],kt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],kt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],kt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],kt.prototype,"user_id",void 0),kt=Re([le(He),ue("forgot"),ce("5.3.1")],kt);let Ft=class LogModel extends pe{};Re([ae.Id(7),De("design:type",String)],Ft.prototype,"id",void 0),Re([ae.Enum(Be),ge(Be.INFO),De("design:type",String)],Ft.prototype,"level",void 0),Re([ae.Text(),De("design:type",String)],Ft.prototype,"message",void 0),Re([ae.String(),De("design:type",String)],Ft.prototype,"source",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Ft.prototype,"created_at",void 0),Ft=Re([le(He),ue("log"),ce("5.3.1")],Ft);let Bt=class MigrationModel extends pe{};Re([ae.Id(7),De("design:type",String)],Bt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Bt.prototype,"model",void 0),Re([ae.String(),De("design:type",String)],Bt.prototype,"version",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Bt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Bt.prototype,"updated_at",void 0),Bt=Re([le(He),ue("migration"),ce("5.3.1")],Bt);let Kt=class SessionModel extends pe{};Re([ae.Id(7),De("design:type",String)],Kt.prototype,"id",void 0),Re([ae.Json(),De("design:type",Object)],Kt.prototype,"data",void 0),Re([ae.FullDate(),De("design:type",Date)],Kt.prototype,"expired_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Kt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Kt.prototype,"updated_at",void 0),Kt=Re([le(He),ue("session"),ce("5.3.1")],Kt);class Log{static error(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("error",e,t,i)})}static info(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("info",e,t,i)})}static warn(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("warn",e,t,i)})}static writeRaw(e,t,i,r){return Ne(this,void 0,void 0,function*(){var n;r&&x.console(null!==(n=this.colors[e])&&void 0!==n?n:C.White,e,t),He&&(yield Ft.create({level:e,message:t,source:null!=i?i:""}).catch(x.catch))})}}Log.colors={error:C.Red,info:C.Cyan,warn:C.Yellow};class Loggable{get log(){return e=>Loggable.logInfo(this,e)}static get log(){return e=>this.logInfo(this,e)}get error(){return e=>Loggable.logError(this,e)}static get error(){return e=>this.logError(this,e)}static logError(e,t){var i,r;Log.error(null!==(r=null!==(i=null==t?void 0:t.message)&&void 0!==i?i:t)&&void 0!==r?r:"",this.source(e),Env.CONSOLE_ERROR)}static logInfo(e,t){Log.info(null!=t?t:"",this.source(e),Env.CONSOLE_ERROR)}static source(e){var t,i,r;const n=null!==(r=null!==(i=null===(t=null==e?void 0:e.constructor)||void 0===t?void 0:t.name)&&void 0!==i?i:null==e?void 0:e.name)&&void 0!==r?r:"null";return Env.BASE_NAME?`${Env.BASE_NAME}.${n}`:n}}class Config extends Loggable{static all(e){return Ne(this,void 0,void 0,function*(){var t;const i=null!==(t=yield Ht.findAll({where:(null==e?void 0:e.length)?{key:{[he.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[];return Object.fromEntries(i.map(e=>[e.key,e.value]))})}static del(e){return Ne(this,void 0,void 0,function*(){return((yield Ht.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return Ne(this,arguments,void 0,function*(e,t=""){const[i]=(yield Ht.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];return i?i.value:t})}static set(e,t){return Ne(this,void 0,void 0,function*(){const[i,r]=(yield Ht.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];i&&!r&&(i.value=t,yield i.save().catch(this.error))})}}class SessionStore extends Se{constructor(){super(),this.all=e=>Ne(this,void 0,void 0,function*(){e=e||Y;const t=yield Kt.findAll({attributes:["id","expired_at"],where:{expired_at:{[he.gte]:new Date}}}).catch(t=>(e(t),null));t&&e(null,t.map(e=>e.id)),e()}),this.clear=e=>Ne(this,void 0,void 0,function*(){yield Kt.destroy().catch(x.catch),e&&e()}),this.destroy=(e,t)=>Ne(this,void 0,void 0,function*(){yield Kt.destroy({where:{id:e}}).catch(x.catch),t&&t()}),this.expired=()=>Ne(this,void 0,void 0,function*(){yield Kt.destroy({where:{expired_at:{[he.lt]:new Date}}}).catch(x.catch)}),this.get=(e,t)=>Ne(this,void 0,void 0,function*(){t=t||Y;const i=yield Kt.findOne({where:{id:e,expired_at:{[he.gte]:new Date}}}).catch(e=>(t(e),null));if(i){if(i.data.cookie){if(new Date(i.data.cookie.expires).getTime()<=Date.now())return yield i.destroy().catch(x.catch),void t(null)}t(null,i.data)}else t(null)}),this.length=e=>Ne(this,void 0,void 0,function*(){e&&e(null,(yield Kt.count().catch(x.catch))||0)}),this.set=(e,t,i)=>Ne(this,void 0,void 0,function*(){i=i||Y;const r=new Date;r.setTime(r.getTime()+Env.API_SESSION_LIFETIME);const[n,o]=(yield Kt.findOrCreate({where:{id:e},defaults:{id:e,data:t,expired_at:r}}).catch(x.catch))||[];n?(o||(n.data=t,n.expired_at=r,yield n.save().catch(x.catch)),i()):i()}),setInterval(this.expired,6e4)}}let qt=class Service{};qt=Re([fe(Loggable)],qt);let Vt=class AuthService extends qt{constructor(){super(...arguments),this.userAttributes={exclude:["username","notes","deleted_at"]}}create(e){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new o("TOKEN_KEY not found");const{id:t}=e,i=B(),r=yield Pt.create({secret:i,user_id:t}).catch(this.error);if(!r)throw new s;return{auth:r,token:Oe.sign({id:t,secret:i},Env.TOKEN_KEY,this.options())}})}destroy(e){return Ne(this,void 0,void 0,function*(){return!(!e||e.revoked_at)&&(e.revoked_at=new Date,yield e.save(),!0)})}renew(e){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new o("TOKEN_KEY not found");const{decode:i}=yield this.verify(e,Env.TOKEN_TTL_RENEW/1e3);if(!i)throw new t("Invalid token");const{id:r,secret:n}=i;if(r&&n){const e=yield Nt.findOne({where:{id:r,status:qe.ACTIVE}}).catch(this.error);if(e){const t=yield Pt.findOne({where:{secret:n,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at){t.secret=B(),yield t.save().catch(this.error);return{auth:t,token:Oe.sign({id:r,secret:t.secret},Env.TOKEN_KEY,this.options())}}}}throw new t("Invalid token")})}user(e){return Ne(this,void 0,void 0,function*(){const{decode:i}=yield this.verify(e);if(!i)throw new t("Invalid token");const{id:r,secret:n}=i;if(r&&n){const e=yield Nt.findOne({attributes:this.userAttributes,where:{id:r,status:qe.ACTIVE}}).catch(this.error);if(e){const t=yield Pt.findOne({where:{secret:n,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at)return{auth:t,user:e}}}throw new t("Invalid token")})}options(){return{algorithm:"RS256",expiresIn:`${Env.TOKEN_TTL}ms`}}verify(e,i){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_CRT)throw new o("TOKEN_CRT not found");if(!e||e.split(".").length<3)throw new t("Invalid token");try{return{decode:Oe.verify(e,Env.TOKEN_CRT,{clockTolerance:i})}}catch(e){throw new t("Invalid token")}})}key(e){return Ne(this,void 0,void 0,function*(){if(!e)throw new t("Invalid token");const i=yield Nt.findOne({attributes:this.userAttributes,where:{token:e,status:qe.ACTIVE}}).catch(this.error);if(i){const t=e.replace(/(-[\w]{4})/g,"-****"),[r]=(yield Pt.findOrCreate({where:{secret:t,user_id:i.id},defaults:{secret:t,user_id:i.id}}).catch(this.error))||[];if(r)return r.revoked_at&&(r.revoked_at=null,yield r.save().catch(this.error)),{auth:r,user:i}}throw new t("Invalid token")})}};Vt=Re([_e()],Vt);class ModelService extends qt{constructor(e,t){var i,r;super(),this.attributes=[],this.permissions=[],this.search=[],this.model=e,(null==t?void 0:t.permissions)&&(this.permissions=t.permissions);const n=Object.keys(e.getAttributes());this.attributes=this.filterAttributes(n,null!==(i=null==t?void 0:t.attributes)&&void 0!==i?i:[]),this.search=this.filterAttributes(n,null!==(r=null==t?void 0:t.search)&&void 0!==r?r:this.attributes)}applySelect(e,t,i){if(!t)return;const r=null==e?void 0:e.getQuery(i?`${i}_select`:"select"),n=t.attributes,o=e=>n.includes(e);t.attributes=[],k(r)&&r.length&&t.attributes.push(...r.split(/\s*,\s*/g).filter(o)),t.attributes.length||(t.attributes=n)}applyOrders(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("asc"),r=null==e?void 0:e.getQuery("desc"),n=[],o=t.attributes,s=e=>o.includes(e);k(i)&&i.length&&n.push(...i.split(/\s*,\s*/g).filter(s).map(e=>[e,"ASC"])),k(r)&&r.length&&n.push(...r.split(/\s*,\s*/g).filter(s).map(e=>[e,"DESC"])),n.length&&(t.order=n)}applyPagination(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("limit"),r=null==e?void 0:e.getQuery("offset");D(t.limit)&&(t.limit=Env.MODEL_LIMIT,k(i)&&(t.limit=parseInt(i)||0),t.limit=$(t.limit,-1,Env.MODEL_LIMIT_MAX)),t.limit<0&&(t.limit=void 0),k(r)&&(t.offset=parseInt(r)||0,t.offset<0&&(t.offset=void 0))}applySearch(e,t){var i;if(!t)return;const r=null==e?void 0:e.getQuery("search");r&&k(r)&&(t.where=Object.assign(Object.assign({},null!==(i=t.where)&&void 0!==i?i:{}),{[he.or]:this.search.map(e=>({[e]:{[he.substring]:r}}))}))}applyWhere(e,t,i){var r,n;if(!t)return null;const o=null==e?void 0:e.getQuery(i?`${i}_where`:"where");if(!k(o))return null;const s=t.attributes,d=ye.parse(s,o);return D(d.error)?(t.where=Object.assign(Object.assign({},null!==(r=t.where)&&void 0!==r?r:{}),null!==(n=d.value)&&void 0!==n?n:{}),null):new a(d.error.join(", "))}countAll(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,options:n={}}=e,o=W({},n);o.attributes=this.getAttributes(null!==(t=null==o?void 0:o.attributes)&&void 0!==t?t:[]),this.applySearch(r,o);const s=this.applyWhere(r,o);if(s)return null==r||r.error(s),0;this.applySelect(r,o);const a=null!==(i=yield this.model.count(Object.assign(Object.assign({},o),{distinct:!!o.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error))&&void 0!==i?i:0;return null==r||r.prepare(d.OK,{count:a}),a})}create(e){return Ne(this,void 0,void 0,function*(){var t,i;const{body:r={},ctx:n,options:o={}}=e,a=W({},o),l=yield this.model.create(Object.assign({},W({},null!==(i=null===(t=null==n?void 0:n.req)||void 0===t?void 0:t.body)&&void 0!==i?i:{},r)),Object.assign(Object.assign({},a),{ctx:n})).catch(this.error);if(!l)return null==n||n.error(new s),null;const{primaryKeyAttribute:u}=this.model;return null==n||n.prepare(d.OK,{[u]:l.getDataValue(u)}),l})}delete(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,id:n,options:s={}}=e,{primaryKeyAttribute:a}=this.model,d=null!==(t=null==r?void 0:r.getParam(a))&&void 0!==t?t:n;if(D(d))return null==r||r.error(new l),0;const u=W({},s),c=yield this.model.destroy(Object.assign(Object.assign(Object.assign({},u),{where:{[he.and]:Object.assign({[a]:d},null!==(i=null==u?void 0:u.where)&&void 0!==i?i:{})},individualHooks:!0}),{ctx:r})).catch(this.error);return c?(null==r||r.success("OK"),c):(null==r||r.error(new o),0)})}filterAttributes(e,t){if(K(t))return t.length?t.filter(t=>k(t)&&e.includes(t)):e;const{exclude:i,include:r}=t,n=D(r)?e:r.filter(t=>k(t)&&e.includes(t)),o=null!=i?i:[];return o.length?n.filter(e=>!o.includes(e)):n}findAll(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,callback:n,options:o={},query:s=!0}=e,a=W({},o);if(a.attributes=this.getAttributes(null!==(t=null==a?void 0:a.attributes)&&void 0!==t?t:[]),s&&this.applySelect(r,a),this.applyOrders(r,a),this.applyPagination(r,a),(null!==(i=null==a?void 0:a.limit)&&void 0!==i?i:0)>Env.MODEL_LIMIT_MAX&&(a.limit=Env.MODEL_LIMIT_MAX),this.applySearch(r,a),s){const e=this.applyWhere(r,a);if(e)return null==r||r.error(e),{count:0,records:[]}}const[l,u]=yield Promise.all([this.model.count(Object.assign(Object.assign({},a),{distinct:!!a.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error).then(e=>null!=e?e:0),this.model.findAll(a).catch(this.error).then(e=>null!=e?e:[])]),c={count:l,records:n?yield n(u):u};return null==r||r.prepare(d.OK,c),c})}findOne(e){return Ne(this,void 0,void 0,function*(){var t,i,r;const{callback:n,ctx:s,id:a,options:u={},query:c=!0}=e,{primaryKeyAttribute:p}=this.model,v=null!==(t=null==s?void 0:s.getParam(p))&&void 0!==t?t:a;if(D(v))return null==s||s.error(new l),null;const g=W({},u);g.attributes=this.getAttributes(null!==(i=null==g?void 0:g.attributes)&&void 0!==i?i:[]),c&&this.applySelect(s,g);const h=yield this.model.findOne(Object.assign(Object.assign({},g),{where:{[he.and]:Object.assign({[p]:v},null!==(r=null==g?void 0:g.where)&&void 0!==r?r:{})}})).catch(this.error);return h?(null==s||s.prepare(d.OK,n?yield n(h):h.toJSON()),h):(null==s||s.error(new o),null)})}getAttributes(e){return this.filterAttributes(this.attributes,e)}include(e,t){var i;const r=z(t),{ctx:n}=null!=t?t:{};r.attributes=this.filterAttributes(Object.keys(e.getAttributes()),null!==(i=r.attributes)&&void 0!==i?i:[]),this.applySearch(n,r);const o=this.applyWhere(n,r,t.name);return o?(null==n||n.error(o),null):(this.applySelect(n,r,t.name),Object.assign({model:e},r))}name(){return this.model.tableName}sync(){return Ne(this,void 0,void 0,function*(){if(!this.permissions.length)return;const e=this.name().toLowerCase(),t={description:"",active:!0};yield G(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`,n=J(e.replace(/_/g," ")," ");yield wt.findOrCreate({where:{key:r},defaults:Object.assign({name:`${n} ${J(i," ")}`,key:r,tags:n},t)})}))})}update(e){return Ne(this,void 0,void 0,function*(){var t,i,r,n;const{ctx:s,body:a,id:d,options:u={}}=e,{primaryKeyAttribute:c}=this.model,p=null!==(t=null==s?void 0:s.getParam(c))&&void 0!==t?t:d;if(D(p))return null==s||s.error(new l),!1;const v=W({},u),g=W({},null!==(r=null===(i=null==s?void 0:s.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{},null!=a?a:{}),h=yield this.model.findOne(Object.assign(Object.assign({},v),{attributes:this.getAttributes([c,...Object.keys(g)]),where:{[he.and]:Object.assign({[c]:p},null!==(n=null==v?void 0:v.where)&&void 0!==n?n:{})}})).catch(this.error);return h?(h.set(g),h.changed()?(null==s||s.success("OK"),yield h.save(Object.assign({},{ctx:s})).catch(this.error),!0):(null==s||s.success("Record not changed"),!1)):(null==s||s.error(new o),!1)})}}let Ut=class UserService extends qt{constructor(){super(...arguments),this.hashOptions={algorithm:Env.PASSWORD_ALGORITHM,memoryCost:Env.PASSWORD_MEMORY_COST,parallelism:Env.PASSWORD_PARALLELISM,timeCost:Env.PASSWORD_TIME_COST}}createPassword(e,t,i){return Ne(this,void 0,void 0,function*(){yield Dt.update({revoked_at:new Date},{where:{revoked_at:null,user_id:e}}).catch(this.error);const r=Ae(t+Env.PASSWORD_PEPPER,this.hashOptions);yield Dt.create({hash:r,user_id:e},Object.assign({},{ctx:i})).catch(this.error)})}getGroups(e,t){return Ne(this,void 0,void 0,function*(){var i;return Q((null!==(i=yield xt.findAll({attributes:["name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||X(t)?{tenant_id:t}:{})}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name))})}getPermissions(e,t){return Ne(this,void 0,void 0,function*(){var i;return(null!==(i=yield wt.findAll({attributes:["name"],where:{active:!0},include:[{association:"groups_permissions",required:!0,include:[{association:"group",required:!0,attributes:["id","name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||X(t)?{tenant_id:t}:{})}]}]}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name)})}getTenants(e){return Ne(this,void 0,void 0,function*(){var t;return(null!==(t=yield Rt.findAll({attributes:["id","name"],where:{status:Ke.ACTIVE},include:[{association:"users_tenants",required:!0,where:{user_id:e}}]}).catch(this.error))&&void 0!==t?t:[]).map(e=>({id:e.id,name:e.name}))})}};Ut=Re([_e()],Ut);class Application extends u{constructor(e,t){super(e,W({},{cross:!!Env.HTTP_CROSS&&("*"===Env.HTTP_CROSS||{origin:Env.HTTP_CROSS.split(",")}),hybrid:Env.API_HTTP_HYBRID,json:{strict:Env.API_BODYPARSER_STRICT,inflate:Env.API_BODYPARSER_INFLATE,limit:Env.API_BODYPARSER_LIMIT,type:Env.API_BODYPARSER_TYPE},notfound:Env.API_HTTP_NOTFOUND,path:Env.API_HTTP_PATH,port:Env.HTTP_PORT,public:Env.HTTP_PUBLIC,redirect:Env.API_HTTP_REDIRECT,session:{store:new SessionStore,name:Env.API_SESSION_NAME,secret:Env.API_SESSION_SECRET,cookie:{maxAge:Env.API_SESSION_LIFETIME},genid:B},tls:{ca:Env.HTTP_TLS_CA,cert:Env.HTTP_TLS_CRT,key:Env.HTTP_TLS_KEY}},null!=t?t:{})),this.hash=new R(Env.API_KEY_HASH)}error(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.error(e.message,t,Env.CONSOLE_ERROR)}log(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.info(e,t,!0)}listen(){const e=Object.create(null,{listen:{get:()=>super.listen}});return Ne(this,void 0,void 0,function*(){yield He.sync(),yield this.migrations(He),yield Z(this.controllers,e=>Ne(this,void 0,void 0,function*(){N(e.sync)&&(yield e.sync(this))})),this.authService=new Vt,this.userService=new Ut,yield e.listen.call(this),Env.API_WEBSOCKET_START&&this.server&&(this._webSocket=new ne({server:this.server,verifyClient:(e,t)=>t(Env.API_WEBSOCKET_START)}),this._webSocket.on("connection",(e,t)=>Ne(this,void 0,void 0,function*(){t.url||(t.url=""),e.on("close",()=>{}),yield ee(2e3)})))})}migrations(e){return Ne(this,void 0,void 0,function*(){const t=[];yield Z(Object.keys(e.models),i=>Ne(this,void 0,void 0,function*(){var r;const n=e.models[i],o=n.version();if(!o)return;const[s,a]=null!==(r=yield Bt.findOrCreate({where:{model:n.tableName},defaults:{model:n.tableName,version:""}}).catch(this.error))&&void 0!==r?r:[];s&&(a||s.version!=o)&&(s.version=o,yield s.save().catch(this.error),t.push(n))})),yield Z(t,e=>Ne(this,void 0,void 0,function*(){return yield e.updateAttributes()}))})}websocket(){return this._webSocket}}let Yt=class BaseController extends te{constructor(){super(...arguments),this.permissions=[]}name(){var e,t;return(null!==(t=null===(e=this.constructor)||void 0===e?void 0:e.name)&&void 0!==t?t:"api").replace(/(([a-z])([A-Z]))/g,"$2_$3")}session(e,t,i){return Ne(this,void 0,void 0,function*(){i.auth&&i.user&&(i.user_agent?i.user_agent!=t&&i.regenerate(Y):(i.user_agent=t,i.save(Y))),e.next()})}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=J(e.replace(/_/g," ")," ");yield Z(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${J(i," ")}`,active:!0}})}))})}};Re([je(0,c()),je(1,p("user-agent")),je(2,v()),De("design:type",Function),De("design:paramtypes",[n,String,Object]),De("design:returntype",Promise)],Yt.prototype,"session",null),Yt=Re([fe(Loggable)],Yt);let $t=class ModelController extends Yt{constructor(){super(...arguments),this.attributes=[],this.permissions=["create","read","update","delete"],this.search=[]}countAll(e){return Ne(this,void 0,void 0,function*(){return yield this.service.countAll(e)})}create(e){return Ne(this,void 0,void 0,function*(){return yield this.service.create(e)})}delete(e){return Ne(this,void 0,void 0,function*(){return yield this.service.delete(e)})}findAll(e){return Ne(this,void 0,void 0,function*(){return yield this.service.findAll(e)})}findOne(e){return Ne(this,void 0,void 0,function*(){return yield this.service.findOne(e)})}include(e,t){return this.service.include(e,t)}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=J(e.replace(/_/g," ")," ");yield Z(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${J(i," ")}`,active:!0}})})),this.service=new ModelService(this.model,{attributes:this.attributes.length?this.attributes:void 0,search:this.search.length?this.search:void 0})})}update(e){return Ne(this,void 0,void 0,function*(){return yield this.service.update(e)})}name(){return this.model.tableName}};$t=Re([g(Yt)],$t);let Wt=class AuditsController extends $t{constructor(){super(...arguments),this.model=Lt,this.permissions=["read"]}all(e,t,i){return Ne(this,void 0,void 0,function*(){const r={};t&&(r.type=t),i&&(r.table=i),yield this.findAll({ctx:e,options:{attributes:{exclude:["currently","previously"]},where:r,order:[["created_at","DESC"]]}})})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}};Re([h(),Je(),$e(),je(0,c()),je(1,y("type")),je(2,y("table")),De("design:type",Function),De("design:paramtypes",[n,String,String]),De("design:returntype",Promise)],Wt.prototype,"all",null),Re([h("/:id"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Wt.prototype,"get",null),Wt=Re([m("/audits"),g($t)],Wt);let zt=class AuthController extends Yt{constructor(){super(...arguments),this.authService=new Vt}login(e,i,r,n,o,s){return Ne(this,void 0,void 0,function*(){var a;yield ee(Env.SLEEP_AUTH);const d=yield Nt.findOne({where:{[he.or]:[{email:r},{username:r}]}}).catch(this.error);if(!d)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const l=yield Dt.findOne({where:{revoked_at:null,user_id:d.id}}).catch(this.error);if(n+=Env.PASSWORD_PEPPER,!l||!(yield Te(l.hash,n).catch(Y)))return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const u=yield It.findOne({where:{active:!0,user_id:d.id}}).catch(this.error);if(u)return e.error(new t("Activation Required")),s.emit("auth.activation",{ctx:e,register:u,user:d}),void this.emit("auth.activation",{ctx:e,register:u,user:d});if(d.status!=qe.ACTIVE)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e,user:d}),void this.emit("auth.failure",{ctx:e,user:d});const{auth:c,token:p}=null!==(a=yield this.authService.create(d).catch(t=>{e.error(t),s.emit("auth.failure",{ctx:e}),this.emit("auth.failure",{ctx:e})}))&&void 0!==a?a:{};c&&p&&(c.user_agent=i,c.ip_address=e.getIp(),yield c.save().catch(this.error),Env.API_TOKEN_COOKIE_SET&&e.setCookie(Env.API_TOKEN_COOKIE,p,{maxAge:o?Env.TOKEN_TTL:void 0}),e.json({token:p}),s.emit("auth.login",{ctx:e,auth:c,user:d}),this.emit("auth.login",{ctx:e,auth:c,user:d}))})}logout(e,i,r,n){return Ne(this,void 0,void 0,function*(){if(yield this.authService.destroy(i))return Env.API_TOKEN_COOKIE_SET&&e.clearCookie(Env.API_TOKEN_COOKIE),e.success("OK"),n.emit("auth.logout",{auth:i,ctx:e,user:r}),void this.emit("auth.logout",{auth:i,ctx:e,user:r});e.error(new t("Access Denied"))})}renew(e,t,i,r){return Ne(this,void 0,void 0,function*(){var n;const{auth:o,token:s}=null!==(n=yield this.authService.renew(i).catch(t=>{e.error(t)}))&&void 0!==n?n:{};o&&s&&(o.user_agent=t,yield o.save().catch(this.error),e.json({token:s}),r.emit("auth.renew",{auth:o,ctx:e}),this.emit("auth.renew",{auth:o,ctx:e}))})}user(e,t){return Ne(this,void 0,void 0,function*(){const{groups:i,permissions:r,tenants:n}=e.req;if(!i||!r||!n)return e.error(new s);e.json(Object.assign(Object.assign({},t.toJSON()),{groups:i,permissions:r,tenants:n}))})}};Re([E("/login"),f(e=>({username:e.string().min(3),password:e.string().min(5),remember:e.boolean().parse().default(!1)})),je(0,c()),je(1,p("user-agent")),je(2,_("username")),je(3,_("password")),je(4,_("remember")),je(5,S()),De("design:type",Function),De("design:paramtypes",[n,String,String,String,Boolean,Application]),De("design:returntype",Promise)],zt.prototype,"login",null),Re([h("/logout"),Je(),je(0,c()),je(1,Qe()),je(2,it()),je(3,S()),De("design:type",Function),De("design:paramtypes",[n,Pt,Nt,Application]),De("design:returntype",Promise)],zt.prototype,"logout",null),Re([E("/renew"),f(e=>({token:e.string()})),je(0,c()),je(1,p("user-agent")),je(2,_("token")),je(3,S()),De("design:type",Function),De("design:paramtypes",[n,String,String,Application]),De("design:returntype",Promise)],zt.prototype,"renew",null),Re([h(),h("/me"),Je(),je(0,c()),je(1,it()),De("design:type",Function),De("design:paramtypes",[n,Nt]),De("design:returntype",Promise)],zt.prototype,"user",null),zt=Re([m("/auth"),g(Yt)],zt);let Gt=class CrudController extends $t{constructor(){super(...arguments),this._crud={}}CrudArgumentsCountAll(e){return{ctx:e}}CrudArgumentsCreate(e){return{ctx:e}}CrudArgumentsFindAll(e){return{ctx:e}}CrudArgumentsFindOne(e){return{ctx:e}}CrudArgumentsDelete(e){return{ctx:e}}CrudArgumentsUpdate(e){return{ctx:e}}CrudValidateCreate(){return this._crud}CrudValidateUpdate(){return this._crud}add(e){return Ne(this,void 0,void 0,function*(){yield this.create(this.CrudArgumentsCreate(e))})}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll(this.CrudArgumentsFindAll(e))})}rows(e){return Ne(this,void 0,void 0,function*(){yield this.countAll(this.CrudArgumentsCountAll(e))})}del(e){return Ne(this,void 0,void 0,function*(){yield this.delete(this.CrudArgumentsDelete(e))})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne(this.CrudArgumentsFindOne(e))})}set(e){return Ne(this,void 0,void 0,function*(){yield this.update(this.CrudArgumentsUpdate(e))})}validate(e,t){var i,r;const n=V.object(t).parse().validate(null!==(r=null===(i=e.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{});if(n.error)return e.error(new a(n.message||n.error));e.req.body=n.value,e.next()}validateCreate(e){const t=this.CrudValidateCreate();if(t==this._crud)return e.error(new s);this.validate(e,t)}validateUpdate(e){const t=this.CrudValidateUpdate();if(t==this._crud)return e.error(new s);this.validate(e,t)}};Re([E(),Je(),Ue(),O("validateCreate"),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"add",null),Re([h(),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"all",null),Re([h("/count"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"rows",null),Re([A("/:id"),Je(),Ye(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"del",null),Re([h("/:id"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"get",null),Re([T("/:id"),Je(),We(),O("validateUpdate"),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"set",null),Re([je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",void 0)],Gt.prototype,"validateCreate",null),Re([je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",void 0)],Gt.prototype,"validateUpdate",null),Gt=Re([g($t)],Gt);let Jt=class FilesController extends Yt{constructor(){super(...arguments),this.directory=Env.HTTP_PUBLIC||"./",this.permissions=["delete","download","edit","list","read","rename","upload","write"]}files(e){return Ne(this,void 0,void 0,function*(){let{path:t}=e.req;t=t.replace(/(^\/path(\/)?)|([\\.]{1,2}\/)/g,"");const i=Ce(this.directory,t);if(!be(i)||!Ie(i).isDirectory())return e.error(new o);let r;return r=Pe(i),r=r.map(e=>this.info(Ce(i,e))),r=r.filter(ie),Object.assign(Object.assign({},this.info(i)),{files:r})})}info(e){if(!be(e))return null;const t=Ie(e),i=e.split("/").pop();e=e.replace(this.directory,"/").replace(/^\/\//,"/");const r=t.isDirectory();return{name:i,path:e.replace(/^\/\//,"/"),size:t.size,extension:r?"":"."+e.split(".").pop(),created:t.birthtime,modified:t.mtime,directory:r,symlink:t.isSymbolicLink()}}name(){return"files"}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=J(e.replace(/_/g," ")," ");yield Z(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${J(i," ")}`,active:!0}})}))})}};Re([h("/path"),h("/path/*path"),Je(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Jt.prototype,"files",null),Jt=Re([m("/files"),g(Yt)],Jt);let Qt=class ForgotController extends Yt{check(e,t){return Ne(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i||!i.user)return e.error(new o);i.secret=re(),yield i.save(),e.json({token:i.secret})})}forgot(e,t,i){return Ne(this,void 0,void 0,function*(){yield ee(Env.SLEEP_FORGOT);const r=t,n=yield Nt.findOne({where:{[he.or]:[{email:r},{username:t}]}}).catch(this.error);if(!n)return e.error(new o);const s=re(),a=Date.now()+6e4*Env.TOKEN_TTL_FORGOT,d=yield kt.create({token:s,timestamp:a,active:!0,user_id:n.id});e.success("OK"),i.emit("forgot.send",{ctx:e,forgot:d,user:n}),this.emit("forgot.send",{ctx:e,forgot:d,user:n})})}reset(e,t,i,r){return Ne(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i)return e.error(new o);i.active=!1,yield i.save().catch(this.error),yield i.user.save().catch(this.error),e.success("OK"),r.emit("forgot.reset",{ctx:e,user:i.user}),this.emit("forgot.reset",{ctx:e,user:i.user})})}find(e){return Ne(this,void 0,void 0,function*(){return yield kt.findOne({where:{token:e,active:!0},include:[{association:"users",required:!0}]}).catch(this.error)})}};Re([h("/check"),f(e=>({token:e.string()})),je(0,c()),je(1,_("token")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],Qt.prototype,"check",null),Re([E(),f(e=>({username:e.string().min(4)})),je(0,c()),je(1,_("username")),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],Qt.prototype,"forgot",null),Re([E("/reset"),f(e=>({token:e.string(),password:e.string().min(5)})),je(0,c()),je(1,_("token")),je(2,_("password")),je(3,S()),De("design:type",Function),De("design:paramtypes",[n,String,String,Application]),De("design:returntype",Promise)],Qt.prototype,"reset",null),Qt=Re([m("/forgot"),g(Yt)],Qt);let Xt=class GroupsController extends Gt{constructor(){super(...arguments),this.model=xt,this.schemaCreate={name:V.string(),description:V.string().default(""),type:V.enum(Object.keys(Fe)).default(Fe.SYSTEM),active:V.boolean().parse(),metadata:V.object().parse().default({})},this.schemaUpdate={description:V.string().optional(),type:V.enum(Object.keys(Fe)).optional(),active:V.boolean().parse().optional(),metadata:V.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}};Xt=Re([m("/groups"),g(Gt)],Xt);let Zt=class GroupsPermissionsController extends $t{constructor(){super(...arguments),this.model=Mt,this.permissions=[]}all(e,t){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{where:{group_id:t},include:[{association:"permission"}]},callback:e=>e.map(e=>e.permission),query:!1})})}set(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield xt.findByPk(t,{attributes:["id"]}).catch(this.error);if(!r)return e.error(new o);const n=r.id,s=[];yield Z(Q(i),t=>Ne(this,void 0,void 0,function*(){var i;if(!(yield wt.count({where:{id:t}})))return;const[r]=null!==(i=yield Mt.findOrCreate(Object.assign({where:{group_id:n,permission_id:t},defaults:{group_id:n,permission_id:t}},{ctx:e})).catch(this.error))&&void 0!==i?i:[];r&&s.push(t)})),yield Mt.destroy(Object.assign({where:{group_id:n,permission_id:{[he.notIn]:s}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}};Re([h("/:id/permissions"),Je(),$e("groups"),je(0,c()),je(1,b("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],Zt.prototype,"all",null),Re([T("/:id/permissions"),Je(),We("groups"),f(e=>({permissions:e.array(e.string().uuid())})),je(0,c()),je(1,b("id")),je(2,_("permissions")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Zt.prototype,"set",null),Zt=Re([m("/groups"),g($t)],Zt);let ei=class HealthController{ping(e){return Ne(this,void 0,void 0,function*(){e.json({status:"ok",timestamp:Date.now(),uptime:process.uptime()})})}};Re([I("/"),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ei.prototype,"ping",null),ei=Re([m("/health")],ei);let ti=class LogsController extends $t{constructor(){super(...arguments),this.model=Ft,this.permissions=["read"]}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}};Re([h(),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ti.prototype,"all",null),ti=Re([m("/logs"),g($t)],ti);let ii=class McpController extends Yt{constructor(){super(...arguments),this.tools=new McpToolRegistry,this.toolsRegistered=!1,this.handler=new McpHttpHandler({sessions:new McpSessionStore(Env.MCP_SESSION_TTL),tools:this.tools,allowedOrigins:Env.MCP_ALLOWED_ORIGINS?Env.MCP_ALLOWED_ORIGINS.split(",").map(e=>e.trim()).filter(Boolean):[],logger:{toolCall:e=>Ne(this,void 0,void 0,function*(){yield Log.info(JSON.stringify(e),"mcp")})}}),this.rateLimiter=new McpRateLimiter(Env.MCP_RATE_LIMIT_MAX,Env.MCP_RATE_LIMIT_WINDOW)}sync(e){const t=Object.create(null,{sync:{get:()=>super.sync}});return Ne(this,void 0,void 0,function*(){yield t.sync.call(this),this.toolsRegistered||(this.toolsRegistered=!0,e&&(e.instance.use((e,t,i,r)=>{if(!this.isMcpEndpoint(t))return r(e);const n=this.jsonParseErrorResponse(e);if(!n)return r(e);i.status(n.status).json(n.body)}),e.instance.use((e,t,i)=>{if(!this.isMcpEndpoint(e)||!["GET","HEAD"].includes(e.method))return i();t.setHeader("Allow",gt),t.status(405).end()}),this.discoverMcpTools(e.controllers).forEach(e=>this.tools.register(e))))})}options(e){return Ne(this,void 0,void 0,function*(){this.respond(e,this.handler.options(this.request(e)))})}post(e){return Ne(this,void 0,void 0,function*(){this.rateLimiter.consume(e.getIp()||"unknown")?this.respond(e,yield this.handler.post(this.request(e))):e.res.status(429).end()})}delete(e){return Ne(this,void 0,void 0,function*(){this.respond(e,this.handler.delete(this.request(e)))})}getMcpToolMetadata(e){const t=Ee(mt,e,[]);return t.length||"function"==typeof e?t:Ee(mt,Object.getPrototypeOf(e),[])}discoverMcpTools(e){const t=[];for(const i of e)for(const e of this.getMcpToolMetadata(i))t.push(this.createMcpToolFromMetadata(i,e));return t}createMcpToolFromMetadata(e,t){const i=e[t.propertyKey];if(!N(i))throw new Error(`MCP tool "${t.name}" handler was not found`);return Et(t),Object.assign(Object.assign(Object.assign({name:t.name,title:t.title,description:t.description},void 0!==t.input?{input:t.input}:{}),void 0!==t.output?{output:t.output}:{}),{run:(t,r)=>i.call(e,t,r)})}request(e){const t=e.req.user;return{body:e.getBody(),headers:e.getHeaders(),ip:e.getIp(),context:{auth:e.req.auth,groups:e.req.groups,permissions:e.req.permissions,profile:e.req.profile,user:t,userId:null==t?void 0:t.id}}}isJsonParseError(e){if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode}isMcpEndpoint(e){const t=(e.originalUrl||e.url).split("?")[0].replace(/\/+$/g,"")||"/";return t===`${(Env.API_HTTP_PATH||"/").replace(/\/+$/g,"")||""}/mcp`.replace(/\/+/g,"/")||"/mcp"===t}jsonParseErrorResponse(e){if(this.isJsonParseError(e))return{status:400,body:st(null,new McpParseError("Parse error",{message:e.message}))}}respond(e,t){var i;for(const[r,n]of Object.entries(null!==(i=t.headers)&&void 0!==i?i:{}))e.res.setHeader(r,n);void 0!==t.body?e.res.status(t.status).json(t.body):e.res.status(t.status).end()}};Re([P(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"options",null),Re([E(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"post",null),Re([A(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"delete",null),ii=Re([m("/mcp"),g(Yt)],ii);let ri=class PermissionsController extends Gt{constructor(){super(...arguments),this.model=wt,this.schemaCreate={name:V.string(),description:V.string().default(""),active:V.boolean().parse(),metadata:V.object().parse().default({})},this.schemaUpdate={description:V.string().optional(),active:V.boolean().parse().optional(),metadata:V.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}};ri=Re([m("/permissions"),g(Gt)],ri);let ni=class RegisterController extends Yt{register(e,t,i){return Ne(this,void 0,void 0,function*(){yield ee(Env.SLEEP_REGISTRY);const{name:r,date:n,email:o,username:a,password:d,confirm:l}=t,u=a||o,c=j(d);if(yield Nt.count({where:{[he.or]:[{email:o},{username:u}]}}).catch(this.error))return e.error("INVALID EMAIL OR USERNAME");if(c!=j(l))return e.error("INVALID PASSWORD");const p=yield Nt.create({name:r,email:o,username:u,password:c,avatar:"",date:n,description:"",status:qe.PENDING}).catch(this.error);if(!p)return e.error(new s);const v=yield It.create({token:yield this.getId(),active:!0,user_id:p.id}).catch(this.error);if(!v)return yield p.destroy().catch(this.error),e.error(new s);e.success("OK"),i.emit("register.user",{ctx:e,register:v,user:p}),this.emit("register.user",{ctx:e,register:v,user:p})})}confirm(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield It.findOne({where:{token:t,active:!0},include:[{association:"users",required:!0}]}).catch(this.error);if(!r)return e.error(new o);r.active=!1,yield r.save().catch(this.error),r.user.status=qe.ACTIVE,yield r.user.save().catch(this.error),e.success("OK"),i.emit("register.confirm",{ctx:e,register:r,user:r.user}),this.emit("register.confirm",{ctx:e,register:r,user:r.user})})}send(e,t,i){return Ne(this,void 0,void 0,function*(){const r=t,n=yield It.findOne({where:{active:!0},include:[{model:Nt,required:!0,where:{[he.or]:[{email:r},{username:t}]}}]}).catch(this.error);if(!n)return e.error(new o);e.success("OK"),i.emit("register.send",{ctx:e,register:n,user:n.user}),this.emit("register.send",{ctx:e,register:n,user:n.user})})}getId(){return Ne(this,void 0,void 0,function*(){const e=B();return(yield It.count({where:{token:e}}))?this.getId():e})}};Re([E(),f(e=>({name:e.string(),date:e.date(),email:e.string().email(),username:e.string().min(4).default(e.ref("email")),password:e.string().min(5),confirm:e.string().min(5)})),je(0,c()),je(1,_()),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,Object,Application]),De("design:returntype",Promise)],ni.prototype,"register",null),Re([E("/confirm"),f(e=>({token:e.string()})),je(0,c()),je(1,_("token")),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],ni.prototype,"confirm",null),Re([E("/send"),f(e=>({username:e.string().min(4)})),je(0,c()),je(1,_("username")),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],ni.prototype,"send",null),ni=Re([m("/register"),g(Yt)],ni);let oi=class SetupController extends Yt{constructor(){super(...arguments),this.userService=new Ut}setup(e){return Ne(this,void 0,void 0,function*(){var t;if(yield Nt.count())return e.error(new o("Endpoint Not Found"));const i=yield Nt.create({name:"Admin",username:"admin",email:"admin@localhost.com",notes:"",status:qe.ACTIVE},Object.assign({},{ctx:e})).catch(this.error);if(!i)return e.error(new s);yield this.userService.createPassword(i.id,"admin",e);const r=yield xt.create({name:"root",description:"Root",active:!0},Object.assign({},{ctx:e}));yield jt.create({user_id:i.id,group_id:r.id},Object.assign({},{ctx:e})),yield xt.create({name:"admin",description:"Admin",active:!0},Object.assign({},{ctx:e})),yield xt.create({name:"user",description:"User",active:!0},Object.assign({},{ctx:e}));const n=null!==(t=yield wt.findAll({where:{active:!0}}).catch(this.error))&&void 0!==t?t:[];yield Z(n,t=>Ne(this,void 0,void 0,function*(){yield Mt.create({group_id:r.id,permission_id:t.id},Object.assign({},{ctx:e}))})),e.success("OK")})}};Re([h(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],oi.prototype,"setup",null),oi=Re([m("/setup"),g(Yt)],oi);let si=class TestController extends Yt{json(e){return Ne(this,void 0,void 0,function*(){e.json({ok:!0,message:"hello",timestamp:Date.now()})})}sum(e,t){return Ne(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t+i}})}multiply(e,t){return Ne(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t*i}})}average(e,t){return Ne(this,void 0,void 0,function*(){const t=e.values;return{value:t.reduce((e,t)=>e+t,0)/t.length,count:t.length}})}validationString(e,t){return Ne(this,void 0,void 0,function*(){const t=e.text;return{length:t.length,normalized:t.trim()}})}validationNumber(e,t){return Ne(this,void 0,void 0,function*(){return{doubled:2*e.value}})}validationBoolean(e,t){return Ne(this,void 0,void 0,function*(){return{active:e.active}})}validationArray(e,t){return Ne(this,void 0,void 0,function*(){return{count:e.tags.length}})}validationObject(e,t){return Ne(this,void 0,void 0,function*(){const t=e.profile;return{summary:{name:t.name,adult:t.age>=18}}})}validationEnum(e,t){return Ne(this,void 0,void 0,function*(){return{status:e.status}})}validationDate(e,t){return Ne(this,void 0,void 0,function*(){const t=e.date;return{iso:t.toISOString(),timestamp:t.getTime()}})}validationOptional(e,t){return Ne(this,void 0,void 0,function*(){const t=e.nickname;return Object.assign({name:e.name,hasNickname:Boolean(t)},t?{nickname:t}:{})})}validationDefaults(e,t){return Ne(this,void 0,void 0,function*(){return{name:e.name,limit:e.limit}})}validationParse(e,t){return Ne(this,void 0,void 0,function*(){return{active:e.active,amount:e.amount}})}validationNested(e,t){return Ne(this,void 0,void 0,function*(){const t=e.payload;return{userId:t.user.id,scoreCount:t.scores.length}})}};Re([h(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],si.prototype,"json",null),Re([ft({name:"sum",title:"Somar numeros",description:"Soma dois numeros.",input:{a:V.number().description("valor a"),b:V.number().description("valor b")},output:{value:V.number().description("resultado da soma de a + b")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"sum",null),Re([ft({name:"multiply",title:"Multiplicar numeros",description:"Multiplica dois numeros.",input:{a:V.number().description("valor a"),b:V.number().description("valor b")},output:{value:V.number().description("resultado da multiplicação de a * b")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"multiply",null),Re([ft({name:"average",title:"Calcular media",description:"Calcula a media de uma lista de numeros.",input:{values:V.array(V.number().description("numero usado no calculo da media")).min(1).max(10).description("lista de numeros para calcular a media")},output:{value:V.number().description("media calculada"),count:V.number().description("quantidade de numeros usados")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"average",null),Re([ft({name:"validation.string",title:"Validacao de string",description:"Exemplo de validacao de texto com tamanho minimo e maximo.",input:{text:V.string().min(5).max(50).description("Texto entre 5 e 50 caracteres.")},output:{length:V.number().description("Quantidade de caracteres do texto."),normalized:V.string().description("Texto normalizado sem espacos nas pontas.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationString",null),Re([ft({name:"validation.number",title:"Validacao de number",description:"Exemplo de validacao numerica com minimo e maximo.",input:{value:V.number().min(0).max(100).description("Numero entre 0 e 100.")},output:{doubled:V.number().description("Numero multiplicado por dois.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationNumber",null),Re([ft({name:"validation.boolean",title:"Validacao de boolean",description:"Exemplo de validacao de booleano sem parse implicito.",input:{active:V.boolean().description("Indica se o registro esta ativo.")},output:{active:V.boolean().description("Booleano validado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationBoolean",null),Re([ft({name:"validation.array",title:"Validacao de array",description:"Exemplo de validacao de array com limites e item tipado.",input:{tags:V.array(V.string().min(2).max(20).description("Tag entre 2 e 20 caracteres.")).min(1).max(5).description("Lista de tags entre 1 e 5 itens.")},output:{count:V.number().description("Quantidade de tags recebidas.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationArray",null),Re([ft({name:"validation.object",title:"Validacao de object",description:"Exemplo de validacao de objeto simples.",input:{profile:V.object({name:V.string().min(2).max(60).description("Nome do perfil."),age:V.number().min(0).max(120).description("Idade do perfil."),nickname:V.string().empty().max(30).description("Apelido opcional do perfil.")}).description("Objeto de perfil.")},output:{summary:V.object({name:V.string().description("Nome validado."),adult:V.boolean().description("Indica se a idade e maior ou igual a 18.")}).description("Resumo do perfil.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationObject",null),Re([ft({name:"validation.enum",title:"Validacao de enum",description:"Exemplo de validacao de lista fechada de valores.",input:{status:V.enum(["draft","active","archived"]).description("Status permitido.")},output:{status:V.string().description("Status validado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationEnum",null),Re([ft({name:"validation.date",title:"Validacao de date",description:"Exemplo de validacao e parse de data.",input:{date:V.date().parse().description("Data em formato aceito pelo Date.")},output:{iso:V.string().description("Data em ISO string."),timestamp:V.number().description("Data em timestamp Unix em milissegundos.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationDate",null),Re([ft({name:"validation.optional",title:"Validacao de campo opcional",description:"Exemplo de campo opcional aceitando ausencia.",input:{name:V.string().min(2).description("Nome obrigatorio."),nickname:V.string().empty().max(30).description("Apelido opcional.")},output:{name:V.string().description("Nome validado."),hasNickname:V.boolean().description("Indica se apelido foi enviado."),nickname:V.string().empty().description("Apelido validado quando enviado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationOptional",null),Re([ft({name:"validation.defaults",title:"Validacao de valores padrao",description:"Exemplo de campos opcionais com valores padrao.",input:{name:V.string().default("guest").description("Nome opcional com valor padrao."),limit:V.number().parse().default(10).min(1).max(100).description("Limite opcional com valor padrao.")},output:{name:V.string().description("Nome final."),limit:V.number().description("Limite final.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationDefaults",null),Re([ft({name:"validation.parse",title:"Validacao com parse",description:"Exemplo de parse de boolean e number antes da validacao final.",input:{active:V.boolean().parse().default(!1).description("Booleano aceitando valores parseaveis."),amount:V.number().parse().min(1).max(1e3).description("Numero aceitando string numerica.")},output:{active:V.boolean().description("Booleano parseado."),amount:V.number().description("Numero parseado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationParse",null),Re([ft({name:"validation.nested",title:"Validacao de objeto aninhado",description:"Exemplo de objeto aninhado com array interno.",input:{payload:V.object({user:V.object({id:V.string().min(3).max(30).description("Identificador do usuario."),email:V.string().email().description("Email do usuario.")}).description("Usuario do payload."),scores:V.array(V.number().min(0).max(100).description("Pontuacao individual.")).min(1).max(3).description("Pontuacoes do usuario.")}).description("Payload aninhado.")},output:{userId:V.string().description("Identificador validado."),scoreCount:V.number().description("Quantidade de pontuacoes.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationNested",null),si=Re([m("/test"),g(Yt)],si);let ai=class UsersController extends $t{constructor(){super(),this.model=Nt,this.path=Env.HTTP_PUBLIC+"/avatar",Env.HTTP_PUBLIC&&be(Env.HTTP_PUBLIC)&&!be(this.path)&&we(this.path)}avatar(e,t){return Ne(this,void 0,void 0,function*(){var i;const r=e.getFiles();if(r.file&&r.file.length){const{filename:n,path:o}=null!==(i=r.file[0])&&void 0!==i?i:{};if(n){const i=yield Nt.findOne({where:{id:t.id}}).catch(this.error);if(!i)return Me(o).isFile()&&xe(o),e.error(new s);const r=this.path+"/"+i.metadata.avatar_url;if(be(r)&&Me(r).isFile()&&xe(r),i.changed("metadata",!0),i.metadata.avatar_url=n,yield i.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK")}}e.success("Record not Changed")})}token_new(){return Ne(this,void 0,void 0,function*(){var e;const t=B();return(null!==(e=yield this.model.count({where:{token:t}}).catch(this.error))&&void 0!==e?e:0)?this.token_new():t})}add(e){return Ne(this,void 0,void 0,function*(){yield this.create({ctx:e})})}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}rows(e){return Ne(this,void 0,void 0,function*(){yield this.countAll({ctx:e})})}del(e,t,i){return Ne(this,void 0,void 0,function*(){if(i.id==t)return e.error(new o);yield this.delete({ctx:e})})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}set(e){return Ne(this,void 0,void 0,function*(){yield this.update({ctx:e})})}};Re([E("/avatar"),Je(),w({file:{count:1,path:`${Env.HTTP_PUBLIC}/avatar`,types:["image/bmp","image/jpeg","image/png"],size:32}}),je(0,c()),je(1,it()),De("design:type",Function),De("design:paramtypes",[n,Nt]),De("design:returntype",Promise)],ai.prototype,"avatar",null),Re([E(),Je(),Ue(),f(e=>({name:e.string(),email:e.string().email(),username:e.string().min(3),notes:e.string().default(""),status:e.enum(Object.keys(qe)).default(qe.ACTIVE),metadata:e.object().parse().default({})})),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"add",null),Re([h(),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"all",null),Re([h("/count"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"rows",null),Re([A("/:id"),Je(),Ye(),je(0,c()),je(1,b("id")),je(2,it()),De("design:type",Function),De("design:paramtypes",[n,String,Nt]),De("design:returntype",Promise)],ai.prototype,"del",null),Re([h("/:id"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"get",null),Re([T("/:id"),Je(),We(),f(e=>({name:e.string().optional(),email:e.string().email().optional(),username:e.string().min(3).optional(),notes:e.string().optional(),status:e.enum(Object.keys(qe)).optional(),metadata:e.object().parse().optional()})),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"set",null),ai=Re([m("/users"),g($t),De("design:paramtypes",[])],ai);let di=class UsersGroupsController extends $t{constructor(){super(...arguments),this.model=jt,this.permissions=[]}all(e,t){return Ne(this,void 0,void 0,function*(){if(!(yield Nt.findByPk(t,{attributes:["id"]}).catch(this.error)))return e.error(new o("User Not Found"));yield this.findAll({ctx:e,options:{where:{user_id:t},include:[{association:"group"}]},callback:e=>e.map(e=>e.group),query:!1})})}set(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield Nt.findByPk(t,{attributes:["id"]}).catch(this.error);if(!r)return e.error(new o("User Not Found"));const n=r.id,s=[];yield Z(Q(i),t=>Ne(this,void 0,void 0,function*(){var i;if(!(yield xt.count({where:{id:t}})))return;const[r]=null!==(i=yield jt.findOrCreate(Object.assign({where:{user_id:n,group_id:t},defaults:{user_id:n,group_id:t}},{ctx:e})).catch(this.error))&&void 0!==i?i:[];r&&s.push(t)})),yield jt.destroy(Object.assign({where:{user_id:n,group_id:{[he.notIn]:s}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}};Re([h("/:id/groups"),Je(),$e("users"),je(0,c()),je(1,b("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],di.prototype,"all",null),Re([T("/:id/groups"),Je(),We("users"),f(e=>({groups:e.array(e.string().uuid())})),je(0,c()),je(1,b("id")),je(2,_("groups")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],di.prototype,"set",null),di=Re([m("/users"),g($t)],di);export{Application,bt as Audit,Lt as AuditModel,ke as AuditTypes,Wt as AuditsController,zt as AuthController,Vt as AuthService,Yt as BaseController,Ue as CanCreate,Ye as CanDelete,$e as CanRead,We as CanUpdate,Config,Ht as ConfigModel,Gt as CrudController,Env,Jt as FilesController,Qt as ForgotController,kt as ForgotModel,xt as GroupModel,Mt as GroupPermissionModel,Fe as GroupTypes,Xt as GroupsController,Zt as GroupsPermissionsController,ze as HasGroups,Ge as HasPermissions,ei as HealthController,Je as IsAuthenticated,Log,Be as LogLevels,Ft as LogModel,Loggable,ti as LogsController,ut as MCP_DEFAULT_PROTOCOL_VERSION,gt as MCP_HTTP_ALLOW,vt as MCP_HTTP_ALLOWED_METHODS,ct as MCP_PROTOCOL_VERSION_HEADER,pt as MCP_SESSION_ID_HEADER,lt as MCP_SUPPORTED_PROTOCOL_VERSIONS,mt as MCP_TOOL_METADATA,ii as McpController,McpError,rt as McpErrorCode,McpHttpHandler,McpInternalError,McpInvalidParamsError,McpInvalidRequestError,McpInvalidSessionError,McpMethodNotFoundError,McpParseError,McpRateLimiter,McpServerError,McpSessionStore,ft as McpTool,McpToolNotFoundError,McpToolRegistry,Bt as MigrationModel,$t as ModelController,ModelService,wt as PermissionModel,ri as PermissionsController,ni as RegisterController,It as RegisterModel,Qe as ReqAuth,Xe as ReqGroup,Ze as ReqGroups,et as ReqPermission,tt as ReqPermissions,it as ReqUser,qt as Service,Kt as SessionModel,SessionStore,oi as SetupController,Rt as TenantModel,Ke as TenantStatus,si as TestController,Pt as UserAuthModel,jt as UserGroupModel,Nt as UserModel,Dt as UserPasswordModel,Ut as UserService,qe as UserStatus,Ct as UserTenantModel,ai as UsersController,di as UsersGroupsController,Et as assertValidMcpToolDefinition,Ve as canFactory,ht as isJsonParseError,nt as isJsonRpcId,yt as jsonParseErrorResponse,st as jsonRpcError,at as jsonRpcErrorFromCode,ot as jsonRpcResult,dt as parseJsonRpcRequest,He as sequelize};
+import{Use as e,UnauthorizedError as t,parameterFactory as i,ResponseError as r,Context as n,NotFoundError as o,InternalServerError as s,ValidationError as a,StatusCodes as d,BadRequestError as l,Application as u,Ctx as c,Headers as p,Session as v,Extends as g,Get as h,Query as y,Controller as m,Post as E,Validate as f,Body as _,App as S,Middleware as A,Delete as O,Put as T,Params as b,All as P,Options as I,Upload as w}from"@andrewcaires/express";import{Env as x,Log as C,LogColor as M,Hash as R,sha256 as j}from"@andrewcaires/node";import{isUndefined as D,isFunction as N,includesArray as L,isPlainObject as H,isString as F,isNumber as k,uuidv7 as B,isArray as K,isValidationShape as q,Validation as U,getConstructor as V,noop as Y,clamp as $,merge as z,clone as W,forEachAsync as G,upperCamelCase as J,uniqueArray as Q,isNull as X,forEachSeries as Z,sleep as ee,EventEmitter as te,isDef as ie,uniqueID as re}from"@andrewcaires/utils.js";import{WebSocketServer as ne}from"ws";import{Sequelize as oe,Hooks as se,Column as ae,Association as de,Database as le,ModelName as ue,Version as ce,Model as pe,Index as ve,DefaultValue as ge,Op as he,Where as ye}from"@andrewcaires/sequelize";import{config as me}from"dotenv";import{metadata as Ee,Trait as fe,Singleton as _e}from"@andrewcaires/decorator";import{Store as Se}from"express-session";import Ae from"jsonwebtoken";import{hashSync as Oe,verify as Te}from"@node-rs/argon2";import{existsSync as be,statSync as Pe,readdirSync as Ie,mkdirSync as we,lstatSync as xe,rmSync as Ce}from"fs";import{join as Me}from"path";function Re(e,t,i,r){var n,o=arguments.length,s=o<3?t:null===r?r=Object.getOwnPropertyDescriptor(t,i):r;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)s=Reflect.decorate(e,t,i,r);else for(var a=e.length-1;a>=0;a--)(n=e[a])&&(s=(o<3?n(s):o>3?n(t,i,s):n(t,i))||s);return o>3&&s&&Object.defineProperty(t,i,s),s}function je(e,t){return function(i,r){t(i,r,e)}}function De(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function Ne(e,t,i,r){return new(i||(i=Promise))(function(n,o){function s(e){try{d(r.next(e))}catch(e){o(e)}}function a(e){try{d(r.throw(e))}catch(e){o(e)}}function d(e){var t;e.done?n(e.value):(t=e.value,t instanceof i?t:new i(function(e){e(t)})).then(s,a)}d((r=r.apply(e,t||[])).next())})}var Le;"function"==typeof SuppressedError&&SuppressedError,me({quiet:!0});class Env extends x{}Le=Env,Env.BASE_NAME=Le.getString("BASE_NAME",""),Env.CONSOLE_ERROR=Le.getBool("CONSOLE_ERROR",!1),Env.DATABASE_URI=Le.getString("DATABASE_URI","",!0),Env.DATABASE_LOG=Le.getBool("DATABASE_LOG",!1),Env.DATABASE_AUDIT=Le.getBool("DATABASE_AUDIT",!0),Env.DATABASE_PREFIX=Le.getString("DATABASE_PREFIX",""),Env.DATABASE_TIMEZONE=Le.getString("DATABASE_TIMEZONE","+00:00"),Env.HTTP_CROSS=Le.getString("HTTP_CROSS",""),Env.HTTP_PORT=Le.getInt("HTTP_PORT",Le.getInt("PORT",3e3)),Env.HTTP_PUBLIC=Le.getString("HTTP_PUBLIC",""),Env.HTTP_TLS_CA=Le.getFile("HTTP_TLS_CA"),Env.HTTP_TLS_CRT=Le.getFile("HTTP_TLS_CRT"),Env.HTTP_TLS_KEY=Le.getFile("HTTP_TLS_KEY"),Env.KEY_HEADER=Le.getString("KEY_HEADER","x-api-key"),Env.MODEL_LIMIT=Le.getInt("MODEL_LIMIT",10),Env.MODEL_LIMIT_MAX=Le.getInt("MODEL_LIMIT_MAX",100),Env.MCP_SESSION_TTL=Le.getMs("MCP_SESSION_TTL","30m"),Env.PASSWORD_ALGORITHM=Le.getInt("PASSWORD_ALGORITHM",2),Env.PASSWORD_MEMORY_COST=Le.getInt("PASSWORD_MEMORY_COST",4096),Env.PASSWORD_PARALLELISM=Le.getInt("PASSWORD_PARALLELISM",1),Env.PASSWORD_PEPPER=Le.getString("PASSWORD_PEPPER",""),Env.PASSWORD_TIME_COST=Le.getInt("PASSWORD_TIME_COST",3),Env.SLEEP_AUTH=Le.getMs("SLEEP_AUTH","2s"),Env.SLEEP_FORGOT=Le.getMs("SLEEP_FORGOT","5s"),Env.SLEEP_REGISTRY=Le.getMs("SLEEP_REGISTRY","5s"),Env.TENANT_HEADER=Le.getString("TENANT_HEADER","x-tenant-id"),Env.TOKEN_CRT=Le.getFile("TOKEN_CRT"),Env.TOKEN_HEADER=Le.getString("TOKEN_HEADER","authorization"),Env.TOKEN_KEY=Le.getFile("TOKEN_KEY"),Env.TOKEN_TTL=Le.getMs("TOKEN_TTL","1d"),Env.TOKEN_TTL_FORGOT=Le.getMs("TOKEN_TTL_FORGOT","1d"),Env.TOKEN_TTL_RENEW=Le.getMs("TOKEN_TTL_RENEW","1d"),Env.TOKEN_TYPE=Le.getString("TOKEN_TYPE","bearer"),Env.API_BODYPARSER_STRICT=Le.getBool("API_BODYPARSER_STRICT",!0),Env.API_BODYPARSER_INFLATE=Le.getBool("API_BODYPARSER_INFLATE",!0),Env.API_BODYPARSER_LIMIT=Le.getString("API_BODYPARSER_LIMIT","10mb"),Env.API_BODYPARSER_TYPE=Le.getString("API_BODYPARSER_TYPE","json"),Env.API_HTTP_HYBRID=Le.getBool("API_HTTP_HYBRID",!1),Env.API_HTTP_NOTFOUND=Le.getString("API_HTTP_NOTFOUND",""),Env.API_HTTP_PATH=Le.getString("API_HTTP_PATH","/api"),Env.API_HTTP_REDIRECT=Le.getString("API_HTTP_REDIRECT",""),Env.API_KEY_HASH=Le.getString("API_KEY_HASH",""),Env.API_SESSION_NAME=Le.getString("API_SESSION_NAME","session.id"),Env.API_SESSION_LIFETIME=Le.getMs("API_SESSION_LIFETIME","1d"),Env.API_SESSION_SECRET=Le.getString("API_SESSION_SECRET","yoursecret"),Env.API_TOKEN_COOKIE=Le.getString("API_TOKEN_COOKIE","authorization"),Env.API_TOKEN_COOKIE_SET=Le.getBool("API_TOKEN_COOKIE_SET",!0),Env.API_USER_HISTORY=Le.getBool("API_USER_HISTORY",!0),Env.API_WEBSOCKET_START=Le.getBool("API_WEBSOCKET_START",!1);const He=new oe({uri:Env.DATABASE_URI,logging:!!Env.DATABASE_LOG&&(e=>C.console(M.Magenta,"sql",e)),prefix:Env.DATABASE_PREFIX,timezone:Env.DATABASE_TIMEZONE});var Fe,ke,Be,Ke,qe;!function(e){e.CREATE="CREATE",e.DELETE="DELETE",e.UPDATE="UPDATE"}(Fe||(Fe={})),function(e){e.SYSTEM="system",e.TENANT="tenant"}(ke||(ke={})),function(e){e.INFO="info",e.WARN="warn",e.ERROR="error"}(Be||(Be={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.SUSPENDED="suspended",e.DISABLED="disabled",e.ARCHIVED="archived"}(Ke||(Ke={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.DISABLED="disabled",e.LOCKED="locked",e.ARCHIVED="archived"}(qe||(qe={}));const Ue=i=>r=>(n,o,s)=>{e(e=>Ne(void 0,void 0,void 0,function*(){var n;D(r)&&(r=N(e.controller.name)?e.controller.name():null===(n=e.controller.constructor)||void 0===n?void 0:n.name);const{permissions:o=[]}=e.req;if(o.includes(`${r}.${i}`))return e.next();e.error(new t("Access Denied"))}))(n,o,s)},Ve=Ue("create"),Ye=Ue("delete"),$e=Ue("read"),ze=Ue("update"),We=(...i)=>(r,n,o)=>{e(e=>Ne(void 0,void 0,void 0,function*(){const{groups:r=[]}=e.req;if(L(i,r))return e.next();e.error(new t("Access Denied"))}))(r,n,o)},Ge=(...i)=>(r,n,o)=>{e(e=>Ne(void 0,void 0,void 0,function*(){const{permissions:r}=e.req;if(L(i,null!=r?r:[]))return e.next();e.error(new t("Access Denied"))}))(r,n,o)},Je=()=>(i,r,n)=>{e(e=>Ne(void 0,void 0,void 0,function*(){yield(e=>Ne(void 0,void 0,void 0,function*(){var i,r,n,o;if(e.req.auth&&e.req.user)return e.next();const{[Env.KEY_HEADER]:s,[Env.TOKEN_HEADER]:a,[Env.TENANT_HEADER]:d,"user-agent":l}=e.getHeaders(),u=e.getQuery(Env.KEY_HEADER),c=(null===(i=s||u)||void 0===i?void 0:i.toString())||"";let p=e.getCookie(Env.API_TOKEN_COOKIE);p=`${Env.TOKEN_TYPE} ${p}`;const[v,g]=null!==(n=null===(r=a||p)||void 0===r?void 0:r.split(" "))&&void 0!==n?n:["",""];if(!(c||g&&v.toLowerCase()==Env.TOKEN_TYPE))return e.error(new t("Invalid token"));const{authService:h,userService:y}=e.app,{auth:m,user:E}=null!==(o=yield(c?h.key(c.toString()):h.user(g)).catch(t=>{e.error(t)}))&&void 0!==o?o:{};if(!m||!E)return;if(!c&&m.user_agent&&m.user_agent!=l)return e.error(new t("Invalid token"));e.req.auth=m,e.req.user=E;const f=d||null,_=yield y.getTenants(E.id);if(f&&!_.find(e=>e.id==f))return e.error(new t("Invalid token"));const S=y.getGroups(E.id,f),A=y.getPermissions(E.id,f),[O,T]=yield Promise.all([S,A]);e.req.groups=O,e.req.permissions=T,e.req.tenants=_,e.next()}))(e)}))(i,r,n)},Qe=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.auth}),Xe=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.groups)&&void 0!==r?r:[]).includes(t)}),Ze=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.groups)&&void 0!==i?i:[]}),et=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.permissions)&&void 0!==r?r:[]).includes(t)}),tt=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.permissions)&&void 0!==i?i:[]}),it=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.user}),rt={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,ServerError:-32e3,InvalidSession:-32001};class McpError extends r{constructor(e,t=rt.ServerError,i=200,r){super(e,i),this.code=t,this.data=r,this.name=this.constructor.name}}class McpParseError extends McpError{constructor(e="Parse error",t){super(e,rt.ParseError,400,t)}}class McpInvalidRequestError extends McpError{constructor(e="Invalid Request",t){super(e,rt.InvalidRequest,400,t)}}class McpMethodNotFoundError extends McpError{constructor(e){super(`Method not found: ${e}`,rt.MethodNotFound,200)}}class McpInvalidParamsError extends McpError{constructor(e="Invalid params",t){super(e,rt.InvalidParams,200,t)}}class McpInternalError extends McpError{constructor(e="Internal error",t){super(e,rt.InternalError,200,t)}}class McpServerError extends McpError{constructor(e="Server error",t){super(e,rt.ServerError,500,t)}}class McpInvalidSessionError extends McpError{constructor(e="Invalid MCP session",t=404){super(e,rt.InvalidSession,t)}}class McpToolNotFoundError extends McpError{constructor(e){super("Tool not found",rt.InvalidParams,200,{toolName:e})}}const nt=e=>F(e)||k(e),ot=(e,t)=>({jsonrpc:"2.0",id:e,result:t}),st=(e,t)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t.code,message:t.message},void 0!==t.data?{data:t.data}:{})}),at=(e,t,i,r)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t,message:i},void 0!==r?{data:r}:{})}),dt=e=>{if(!H(e))throw new McpInvalidRequestError("Invalid Request");if("2.0"!==e.jsonrpc)throw new McpInvalidRequestError("Invalid JSON-RPC version");if(!F(e.method))throw new McpInvalidRequestError("Invalid method");if(void 0!==e.id&&!nt(e.id))throw new McpInvalidRequestError("Invalid id");return e},lt=["2025-11-25","2025-06-18"],ut=lt[0],ct="MCP-Protocol-Version",pt="MCP-Session-Id",vt=["POST","DELETE","OPTIONS"],gt=vt.join(", "),ht=e=>{if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode},yt=e=>{if(ht(e))return{status:400,body:st(null,new McpParseError("Parse error",{message:e.message}))}};class McpHttpHandler{constructor(e){var t,i;this.sessions=e.sessions,this.tools=e.tools,this.logger=e.logger,this.serverName=null!==(t=e.serverName)&&void 0!==t?t:"andrewcaires-api-mcp",this.serverVersion=null!==(i=e.serverVersion)&&void 0!==i?i:"1.0.0"}post(e){return Ne(this,void 0,void 0,function*(){var t;let i=null;try{const r=dt(e.getBody());if(i=null!==(t=r.id)&&void 0!==t?t:null,"initialize"===r.method)return this.withTransportHeaders(this.initialize(r.id,r.params));if("notifications/initialized"===r.method)return this.withTransportHeaders(this.initialized(r.id,r.params,e));if("ping"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withSession(r.id,e,e=>({status:200,body:ot(e,{})})));if("tools/list"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withInitializedSession(r.id,e,e=>({status:200,body:ot(e,{tools:this.tools.list()})})));if("tools/call"===r.method)return this.withTransportHeaders(yield this.callTool(r.id,r.params,e));if(void 0===r.id)return this.withTransportHeaders({status:202});throw new McpMethodNotFoundError(r.method)}catch(e){return this.withTransportHeaders(this.errorResponse(i,e))}})}delete(e){const t=e.getHeader("mcp-session-id");if(!t)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError(`${pt} header is required`,400)));return this.sessions.get(t)?(this.sessions.delete(t),this.withTransportHeaders({status:204})):this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError))}initialize(e,t){const i=this.requireRequestId({jsonrpc:"2.0",id:e,method:"initialize",params:t}),r=this.negotiateProtocolVersion(t),n=this.sessions.create(r);return{status:200,headers:{[pt]:n.sessionId,[ct]:n.protocolVersion},body:ot(i,{protocolVersion:n.protocolVersion,capabilities:{tools:{listChanged:!1}},serverInfo:{name:this.serverName,version:this.serverVersion}})}}initialized(e,t,i){if(void 0!==e)throw new McpInvalidRequestError("notifications/initialized must not include id");this.validateObjectParams(t);const r=this.requireSession(i);return this.sessions.markInitialized(r.sessionId),{status:202}}callTool(e,t,i){return Ne(this,void 0,void 0,function*(){return this.withInitializedSession(e,i,(e,i)=>Ne(this,void 0,void 0,function*(){var r;const n=this.parseToolCallParams(t),o=Date.now();let s,a=!1;try{const t=yield this.tools.call(n.name,n.arguments,i);return a=!t.isError,s=t.isError?"Tool execution failed":void 0,{status:200,body:ot(e,t)}}catch(e){if(e instanceof McpError)throw s=e.message,e;throw s="Internal error",e}finally{null===(r=this.logger)||void 0===r||r.toolCall(Object.assign({sessionId:i.sessionId,toolName:n.name,durationMs:Date.now()-o,success:a},s?{error:s}:{}))}}))})}requireRequestId(e){if(!nt(e.id))throw new McpInvalidRequestError("Request id is required");return e.id}withSession(e,t,i){return i(this.requireRequestId({jsonrpc:"2.0",id:e,method:"session"}),this.requireSession(t))}withInitializedSession(e,t,i){return this.withSession(e,t,(e,t)=>{if(!t.initialized)throw new McpInvalidRequestError("Session not initialized");return i(e,t)})}requireSession(e){const t=e.getHeader("mcp-session-id");if(!t)throw new McpInvalidSessionError(`${pt} header is required`,400);return this.sessions.require(t)}negotiateProtocolVersion(e){if(!H(e)||!F(e.protocolVersion))throw new McpInvalidParamsError("params.protocolVersion is required");return lt.includes(e.protocolVersion)?e.protocolVersion:ut}parseToolCallParams(e){if(!H(e)||!F(e.name))throw new McpInvalidParamsError("params.name is required");return{name:e.name,arguments:e.arguments}}validateObjectParams(e){if(void 0!==e&&!H(e))throw new McpInvalidParamsError("params must be an object")}withTransportHeaders(e){var t;return Object.assign(Object.assign({},e),{headers:Object.assign({Allow:gt,"Access-Control-Allow-Methods":gt,"Access-Control-Allow-Headers":`Content-Type, Accept, ${pt}, ${ct}`},null!==(t=e.headers)&&void 0!==t?t:{})})}errorResponse(e,t){if(t instanceof McpError)return{status:t.status,body:st(e,t)};const i=new McpServerError;return{status:i.status,body:st(e,i)}}}class McpSessionStore{constructor(e=18e5,t=()=>Date.now()){this.sessions=new Map,this.ttl=e,this.now=t}create(e){this.cleanup();const t=this.now(),i={sessionId:B(),createdAt:t,expiresAt:t+this.ttl,protocolVersion:e,initialized:!1};return this.sessions.set(i.sessionId,i),i}get(e){this.cleanup();const t=this.sessions.get(e);if(t){if(!this.isExpired(t))return t;this.sessions.delete(e)}}require(e){const t=this.get(e);if(!t)throw new McpInvalidSessionError;return t}markInitialized(e){const t=this.require(e);return t.initialized=!0,t}delete(e){return this.cleanup(),this.sessions.delete(e)}cleanup(){const e=this.now();for(const[t,i]of this.sessions)i.expiresAt<=e&&this.sessions.delete(t)}size(){return this.cleanup(),this.sessions.size}isExpired(e){return e.expiresAt<=this.now()}}const mt=Symbol.for("@andrewcaires/api:mcp:tool"),Et=e=>{if(!F(e.name)||!e.name.trim())throw new Error("MCP tool name is required");if(!F(e.title)||!e.title.trim())throw new Error(`MCP tool "${e.name}" title is required`);if(!F(e.description)||!e.description.trim())throw new Error(`MCP tool "${e.name}" description is required`);if(D(e.input))throw new Error(`MCP tool "${e.name}" input must be declared`)};class McpToolRegistry{constructor(e=[]){this.tools=new Map,e.forEach(e=>this.register(e))}register(e){var t,i;if(Et(e),this.tools.has(e.name))throw new Error(`Duplicate MCP tool name: ${e.name}`);const r=this.normalizeMcpValidation(null!==(t=e.input)&&void 0!==t?t:{},"object"),n=e.output?this.normalizeMcpValidation(null!==(i=e.output)&&void 0!==i?i:{},"any"):void 0;this.tools.set(e.name,{inputSchema:r.schema,inputValidation:r.validation,outputSchema:null==n?void 0:n.schema,outputValidation:null==n?void 0:n.validation,tool:e})}list(){return Array.from(this.tools.values()).map(({tool:e})=>{var t,i,r,n;return Object.assign({name:e.name,title:e.title,description:e.description,inputSchema:null!==(i=null===(t=this.tools.get(e.name))||void 0===t?void 0:t.inputSchema)&&void 0!==i?i:{}},(null===(r=this.tools.get(e.name))||void 0===r?void 0:r.outputSchema)?{outputSchema:null===(n=this.tools.get(e.name))||void 0===n?void 0:n.outputSchema}:{})})}call(e,t,i){return Ne(this,void 0,void 0,function*(){var r;const n=this.tools.get(e);if(!n)throw new McpToolNotFoundError(e);const o=null!=t?t:{};if(!H(o))return this.toolInputValidationError(["arguments must be an object"]);const s={session:i};let a=o;const d=this.validateAdditionalProperties(n.inputSchema,o);if(d.length)return this.toolInputValidationError(d);if(n.inputValidation){const e=n.inputValidation.validate(o,s);if(e.error)return this.toolInputValidationError([e.error]);a=null!==(r=e.value)&&void 0!==r?r:{}}try{const e=yield n.tool.run(a,s);if(!n.outputValidation&&this.isCallToolResult(e))return e;let t=e;if(n.outputValidation){const i=n.outputValidation.validate(e,s);if(i.error)return this.outputValidationError();t=i.value}return{content:[{type:"text",text:JSON.stringify(t)}],structuredContent:t}}catch(e){return{isError:!0,content:[{type:"text",text:"Tool execution failed."}]}}})}isCallToolResult(e){return H(e)&&K(e.content)}normalizeMcpValidation(e,t="object"){if(q(e)){const t=U.object(e).parse();return{schema:t.toSchema(),validation:t}}const i="object"===t?U.object({}).parse():U.any();return{schema:i.toSchema(),validation:i}}outputValidationError(){return{isError:!0,content:[{type:"text",text:"Tool output validation failed."}]}}toolInputValidationError(e){return{isError:!0,content:[{type:"text",text:"Invalid tool arguments."}],structuredContent:{errors:e}}}validateAdditionalProperties(e,t){if("object"!==e.type||!1!==e.additionalProperties||!H(e.properties))return[];const i=Object.keys(e.properties);return Object.keys(t).filter(e=>!i.includes(e)).map(e=>`additional property "${e}" is not allowed`)}}const ft=e=>(Et(e),(t,i)=>{_t(i)?i.addInitializer(function(){St(this.constructor,i.name,e)}):St(t,i,e)}),_t=e=>"object"==typeof e&&null!==e&&"kind"in e&&"method"===e.kind&&"name"in e&&"addInitializer"in e,St=(e,t,i)=>{const r=Ee(mt,e,[]),n=Object.assign(Object.assign({},i),{propertyKey:t});r.some(e=>e.propertyKey===n.propertyKey&&e.name===n.name)||r.push(n)},At=(e,t,i)=>{var r,o,s,a,d,l,u,c,p,v,g;const h=i.ctx instanceof n?i.ctx:null,y=null!==(r=null==h?void 0:h.id)&&void 0!==r?r:null,m=null!==(d=null!==(a=null===(s=null===(o=null==h?void 0:h.req)||void 0===o?void 0:o.user)||void 0===s?void 0:s.id)&&void 0!==a?a:i.user_id)&&void 0!==d?d:null,E={type:e,model:null!==(l=null==t?void 0:t.getTableName())&&void 0!==l?l:null,source:null!==(u=Env.BASE_NAME)&&void 0!==u?u:"",request_id:y,user_id:m};return h?Object.assign(Object.assign({},E),{full_url:null!==(c=h.getUrl())&&void 0!==c?c:"",ip_address:null!==(p=h.getIp())&&void 0!==p?p:"",user_agent:null!==(g=null===(v=h.req)||void 0===v?void 0:v.headers["user-agent"])&&void 0!==g?g:""}):E},Ot=e=>{const t=V(e),i=t.primaryKeyAttribute;return{model:t,record_id:i?e.getDataValue(i):null}},Tt={afterCreate:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ot(e);yield Lt.create(Object.assign(Object.assign({},At(Fe.CREATE,i,t)),{record:r,currently:e.toJSON()})).catch(C.catch)}),afterUpdate:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ot(e),n={},o={},s=e.changed();s&&s.length&&s.forEach(t=>{n[t]=e.getDataValue(t),o[t]=e.previous(t)}),yield Lt.create(Object.assign(Object.assign({},At(Fe.UPDATE,i,t)),{record:r,currently:n,previously:o})).catch(C.catch)}),afterDestroy:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ot(e);yield Lt.create(Object.assign(Object.assign({},At(Fe.DELETE,i,t)),{record:r,currently:e.toJSON()})).catch(C.catch)})},bt=e=>(D(e)&&(e=Env.DATABASE_AUDIT),se(e?Tt:{}));let Pt=class RegisterModel extends pe{};Re([ae.Id(7),De("design:type",String)],Pt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Pt.prototype,"secret",void 0),Re([ae.FullDate(),De("design:type",Number)],Pt.prototype,"expired_at",void 0),Re([ae.Boolean(),De("design:type",Boolean)],Pt.prototype,"active",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Pt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Pt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Pt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Pt.prototype,"user_id",void 0),Pt=Re([le(He),ue("register"),ce("5.3.1")],Pt);let It=class UserAuthModel extends pe{};Re([ae.Id(7),De("design:type",String)],It.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],It.prototype,"secret",void 0),Re([ae.String(),De("design:type",String)],It.prototype,"ip_address",void 0),Re([ae.String(),De("design:type",String)],It.prototype,"user_agent",void 0),Re([ae.FullDate(),De("design:type",Object)],It.prototype,"revoked_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],It.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],It.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],It.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],It.prototype,"user_id",void 0),It=Re([le(He),ue("users_auth"),ce("5.3.1")],It);let wt=class PermissionModel extends pe{};Re([ae.Id(7),De("design:type",String)],wt.prototype,"id",void 0),Re([ae.String(),ve(),De("design:type",String)],wt.prototype,"name",void 0),Re([ae.Text(),De("design:type",String)],wt.prototype,"description",void 0),Re([ae.Boolean(),De("design:type",Boolean)],wt.prototype,"active",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],wt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],wt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],wt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],wt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>xt),De("design:type",Array)],wt.prototype,"groups_permissions",void 0),wt=Re([le(He),ue("permission"),bt(),ce("5.3.1")],wt);let xt=class GroupPermissionModel extends pe{};Re([ae.Id(7),De("design:type",String)],xt.prototype,"id",void 0),Re([ae.CreatedAt(),De("design:type",Date)],xt.prototype,"created_at",void 0),Re([de.BelongsTo(()=>Ct),De("design:type",String)],xt.prototype,"group_id",void 0),Re([de.BelongsTo(()=>wt),De("design:type",String)],xt.prototype,"permission_id",void 0),xt=Re([le(He),ue("groups_permissions"),bt(),ce("5.3.1")],xt);let Ct=class GroupModel extends pe{};Re([ae.Id(7),De("design:type",String)],Ct.prototype,"id",void 0),Re([ae.String(),ve(),De("design:type",String)],Ct.prototype,"name",void 0),Re([ae.Text(),De("design:type",String)],Ct.prototype,"description",void 0),Re([ae.Enum(ke),ge(ke.SYSTEM),De("design:type",String)],Ct.prototype,"type",void 0),Re([ae.Boolean(),De("design:type",Boolean)],Ct.prototype,"active",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],Ct.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Ct.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Ct.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Ct.prototype,"deleted_at",void 0),Re([de.HasMany(()=>jt),De("design:type",Array)],Ct.prototype,"users_groups",void 0),Re([de.HasMany(()=>xt),De("design:type",Array)],Ct.prototype,"groups_Permission",void 0),Ct=Re([le(He),ue("group"),bt(),ce("5.3.1")],Ct);let Mt=class UserTenantModel extends pe{};Re([ae.Id(7),De("design:type",String)],Mt.prototype,"id",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Mt.prototype,"created_at",void 0),Re([de.BelongsTo(()=>Rt),De("design:type",String)],Mt.prototype,"tenant_id",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Mt.prototype,"user_id",void 0),Mt=Re([le(He),ue("users_tenants"),bt(),ce("5.3.1")],Mt);let Rt=class TenantModel extends pe{};Re([ae.Id(7),De("design:type",String)],Rt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Rt.prototype,"name",void 0),Re([ae.Enum(Ke),ge(Ke.ACTIVE),De("design:type",String)],Rt.prototype,"status",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],Rt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Rt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Rt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Rt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>Mt),De("design:type",Array)],Rt.prototype,"users_tenants",void 0),Rt=Re([le(He),ue("tenant"),bt(),ce("5.3.1")],Rt);let jt=class UserGroupModel extends pe{};Re([ae.Id(7),De("design:type",String)],jt.prototype,"id",void 0),Re([ae.CreatedAt(),De("design:type",Date)],jt.prototype,"created_at",void 0),Re([de.BelongsTo(()=>Ct),De("design:type",String)],jt.prototype,"group_id",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],jt.prototype,"user_id",void 0),Re([de.BelongsTo(()=>Rt),De("design:type",String)],jt.prototype,"tenant_id",void 0),jt=Re([le(He),ue("users_groups"),bt(),ce("5.3.1")],jt);let Dt=class UserPasswordModel extends pe{};Re([ae.Id(7),De("design:type",String)],Dt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Dt.prototype,"hash",void 0),Re([ae.FullDate(),De("design:type",Object)],Dt.prototype,"revoked_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Dt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Dt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Dt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Dt.prototype,"user_id",void 0),Dt=Re([le(He),ue("users_password"),bt(),ce("5.3.1")],Dt);let Nt=class UserModel extends pe{};Re([ae.Id(7),De("design:type",String)],Nt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Nt.prototype,"name",void 0),Re([ae.String(),De("design:type",String)],Nt.prototype,"username",void 0),Re([ae.String(),De("design:type",String)],Nt.prototype,"email",void 0),Re([ae.Text(),De("design:type",String)],Nt.prototype,"notes",void 0),Re([ae.Enum(qe),ge(qe.ACTIVE),De("design:type",String)],Nt.prototype,"status",void 0),Re([ae.Json(),ge(()=>({})),De("design:type",Object)],Nt.prototype,"metadata",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Nt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Nt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Nt.prototype,"deleted_at",void 0),Re([de.HasMany(()=>Lt),De("design:type",Array)],Nt.prototype,"audits",void 0),Re([de.HasMany(()=>It),De("design:type",Array)],Nt.prototype,"users_auths",void 0),Re([de.HasMany(()=>Pt),De("design:type",Array)],Nt.prototype,"registers",void 0),Re([de.HasMany(()=>jt),De("design:type",Array)],Nt.prototype,"users_groups",void 0),Re([de.HasMany(()=>Dt),De("design:type",Array)],Nt.prototype,"users_passwords",void 0),Re([de.HasMany(()=>Mt),De("design:type",Array)],Nt.prototype,"users_tenants",void 0),Nt=Re([le(He),ue("user"),bt(),ce("5.3.1")],Nt);let Lt=class AuditModel extends pe{};Re([ae.Id(7),De("design:type",String)],Lt.prototype,"id",void 0),Re([ae.Enum(Fe),De("design:type",String)],Lt.prototype,"type",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"model",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"record",void 0),Re([ae.Json(),De("design:type",Object)],Lt.prototype,"currently",void 0),Re([ae.Json(),De("design:type",Object)],Lt.prototype,"previously",void 0),Re([ae.String(36),De("design:type",String)],Lt.prototype,"request_id",void 0),Re([ae.Text(),De("design:type",String)],Lt.prototype,"full_url",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"ip_address",void 0),Re([ae.Text(),De("design:type",String)],Lt.prototype,"user_agent",void 0),Re([ae.String(),De("design:type",String)],Lt.prototype,"source",void 0),Re([ae.FullDate(),De("design:type",Object)],Lt.prototype,"reverted_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Lt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Lt.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Lt.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Lt.prototype,"user_id",void 0),Lt=Re([le(He),ue("audit"),ce("5.3.1")],Lt);let Ht=class ConfigModel extends pe{};Re([ae.Id(7),De("design:type",String)],Ht.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Ht.prototype,"key",void 0),Re([ae.Text(),De("design:type",String)],Ht.prototype,"value",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Ht.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Ht.prototype,"updated_at",void 0),Ht=Re([le(He),ue("configs"),ce("5.3.1")],Ht);let Ft=class ForgotModel extends pe{};Re([ae.Id(7),De("design:type",String)],Ft.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Ft.prototype,"secret",void 0),Re([ae.FullDate(),De("design:type",Number)],Ft.prototype,"expired_at",void 0),Re([ae.Boolean(),De("design:type",Boolean)],Ft.prototype,"active",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Ft.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Ft.prototype,"updated_at",void 0),Re([ae.DeletedAt(),De("design:type",Object)],Ft.prototype,"deleted_at",void 0),Re([de.BelongsTo(()=>Nt),De("design:type",String)],Ft.prototype,"user_id",void 0),Ft=Re([le(He),ue("forgot"),ce("5.3.1")],Ft);let kt=class LogModel extends pe{};Re([ae.Id(7),De("design:type",String)],kt.prototype,"id",void 0),Re([ae.Enum(Be),ge(Be.INFO),De("design:type",String)],kt.prototype,"level",void 0),Re([ae.Text(),De("design:type",String)],kt.prototype,"message",void 0),Re([ae.String(),De("design:type",String)],kt.prototype,"source",void 0),Re([ae.CreatedAt(),De("design:type",Date)],kt.prototype,"created_at",void 0),kt=Re([le(He),ue("log"),ce("5.3.1")],kt);let Bt=class MigrationModel extends pe{};Re([ae.Id(7),De("design:type",String)],Bt.prototype,"id",void 0),Re([ae.String(),De("design:type",String)],Bt.prototype,"model",void 0),Re([ae.String(),De("design:type",String)],Bt.prototype,"version",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Bt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Bt.prototype,"updated_at",void 0),Bt=Re([le(He),ue("migration"),ce("5.3.1")],Bt);let Kt=class SessionModel extends pe{};Re([ae.Id(7),De("design:type",String)],Kt.prototype,"id",void 0),Re([ae.Json(),De("design:type",Object)],Kt.prototype,"data",void 0),Re([ae.FullDate(),De("design:type",Date)],Kt.prototype,"expired_at",void 0),Re([ae.CreatedAt(),De("design:type",Date)],Kt.prototype,"created_at",void 0),Re([ae.UpdatedAt(),De("design:type",Date)],Kt.prototype,"updated_at",void 0),Kt=Re([le(He),ue("session"),ce("5.3.1")],Kt);class Log{static error(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("error",e,t,i)})}static info(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("info",e,t,i)})}static warn(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("warn",e,t,i)})}static writeRaw(e,t,i,r){return Ne(this,void 0,void 0,function*(){var n;r&&C.console(null!==(n=this.colors[e])&&void 0!==n?n:M.White,e,t),He&&(yield kt.create({level:e,message:t,source:null!=i?i:""}).catch(C.catch))})}}Log.colors={error:M.Red,info:M.Cyan,warn:M.Yellow};class Loggable{get log(){return e=>Loggable.logInfo(this,e)}static get log(){return e=>this.logInfo(this,e)}get error(){return e=>Loggable.logError(this,e)}static get error(){return e=>this.logError(this,e)}static logError(e,t){var i,r;Log.error(null!==(r=null!==(i=null==t?void 0:t.message)&&void 0!==i?i:t)&&void 0!==r?r:"",this.source(e),Env.CONSOLE_ERROR)}static logInfo(e,t){Log.info(null!=t?t:"",this.source(e),Env.CONSOLE_ERROR)}static source(e){var t,i,r;const n=null!==(r=null!==(i=null===(t=null==e?void 0:e.constructor)||void 0===t?void 0:t.name)&&void 0!==i?i:null==e?void 0:e.name)&&void 0!==r?r:"null";return Env.BASE_NAME?`${Env.BASE_NAME}.${n}`:n}}class Config extends Loggable{static all(e){return Ne(this,void 0,void 0,function*(){var t;const i=null!==(t=yield Ht.findAll({where:(null==e?void 0:e.length)?{key:{[he.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[];return Object.fromEntries(i.map(e=>[e.key,e.value]))})}static del(e){return Ne(this,void 0,void 0,function*(){return((yield Ht.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return Ne(this,arguments,void 0,function*(e,t=""){const[i]=(yield Ht.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];return i?i.value:t})}static set(e,t){return Ne(this,void 0,void 0,function*(){const[i,r]=(yield Ht.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];i&&!r&&(i.value=t,yield i.save().catch(this.error))})}}class SessionStore extends Se{constructor(){super(),this.all=e=>Ne(this,void 0,void 0,function*(){e=e||Y;const t=yield Kt.findAll({attributes:["id","expired_at"],where:{expired_at:{[he.gte]:new Date}}}).catch(t=>(e(t),null));t&&e(null,t.map(e=>e.id)),e()}),this.clear=e=>Ne(this,void 0,void 0,function*(){yield Kt.destroy().catch(C.catch),e&&e()}),this.destroy=(e,t)=>Ne(this,void 0,void 0,function*(){yield Kt.destroy({where:{id:e}}).catch(C.catch),t&&t()}),this.expired=()=>Ne(this,void 0,void 0,function*(){yield Kt.destroy({where:{expired_at:{[he.lt]:new Date}}}).catch(C.catch)}),this.get=(e,t)=>Ne(this,void 0,void 0,function*(){t=t||Y;const i=yield Kt.findOne({where:{id:e,expired_at:{[he.gte]:new Date}}}).catch(e=>(t(e),null));if(i){if(i.data.cookie){if(new Date(i.data.cookie.expires).getTime()<=Date.now())return yield i.destroy().catch(C.catch),void t(null)}t(null,i.data)}else t(null)}),this.length=e=>Ne(this,void 0,void 0,function*(){e&&e(null,(yield Kt.count().catch(C.catch))||0)}),this.set=(e,t,i)=>Ne(this,void 0,void 0,function*(){i=i||Y;const r=new Date;r.setTime(r.getTime()+Env.API_SESSION_LIFETIME);const[n,o]=(yield Kt.findOrCreate({where:{id:e},defaults:{id:e,data:t,expired_at:r}}).catch(C.catch))||[];n?(o||(n.data=t,n.expired_at=r,yield n.save().catch(C.catch)),i()):i()}),setInterval(this.expired,6e4)}}let qt=class Service{};qt=Re([fe(Loggable)],qt);let Ut=class AuthService extends qt{constructor(){super(...arguments),this.userAttributes={exclude:["username","notes","deleted_at"]}}create(e){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new o("TOKEN_KEY not found");const{id:t}=e,i=B(),r=yield It.create({secret:i,user_id:t}).catch(this.error);if(!r)throw new s;return{auth:r,token:Ae.sign({id:t,secret:i},Env.TOKEN_KEY,this.options())}})}destroy(e){return Ne(this,void 0,void 0,function*(){return!(!e||e.revoked_at)&&(e.revoked_at=new Date,yield e.save(),!0)})}renew(e){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new o("TOKEN_KEY not found");const{decode:i}=yield this.verify(e,Env.TOKEN_TTL_RENEW/1e3);if(!i)throw new t("Invalid token");const{id:r,secret:n}=i;if(r&&n){const e=yield Nt.findOne({where:{id:r,status:qe.ACTIVE}}).catch(this.error);if(e){const t=yield It.findOne({where:{secret:n,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at){t.secret=B(),yield t.save().catch(this.error);return{auth:t,token:Ae.sign({id:r,secret:t.secret},Env.TOKEN_KEY,this.options())}}}}throw new t("Invalid token")})}user(e){return Ne(this,void 0,void 0,function*(){const{decode:i}=yield this.verify(e);if(!i)throw new t("Invalid token");const{id:r,secret:n}=i;if(r&&n){const e=yield Nt.findOne({attributes:this.userAttributes,where:{id:r,status:qe.ACTIVE}}).catch(this.error);if(e){const t=yield It.findOne({where:{secret:n,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at)return{auth:t,user:e}}}throw new t("Invalid token")})}options(){return{algorithm:"RS256",expiresIn:`${Env.TOKEN_TTL}ms`}}verify(e,i){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_CRT)throw new o("TOKEN_CRT not found");if(!e||e.split(".").length<3)throw new t("Invalid token");try{return{decode:Ae.verify(e,Env.TOKEN_CRT,{clockTolerance:i})}}catch(e){throw new t("Invalid token")}})}key(e){return Ne(this,void 0,void 0,function*(){if(!e)throw new t("Invalid token");const i=yield Nt.findOne({attributes:this.userAttributes,where:{token:e,status:qe.ACTIVE}}).catch(this.error);if(i){const t=e.replace(/(-[\w]{4})/g,"-****"),[r]=(yield It.findOrCreate({where:{secret:t,user_id:i.id},defaults:{secret:t,user_id:i.id}}).catch(this.error))||[];if(r)return r.revoked_at&&(r.revoked_at=null,yield r.save().catch(this.error)),{auth:r,user:i}}throw new t("Invalid token")})}};Ut=Re([_e()],Ut);class ModelService extends qt{constructor(e,t){var i,r;super(),this.attributes=[],this.permissions=[],this.search=[],this.model=e,(null==t?void 0:t.permissions)&&(this.permissions=t.permissions);const n=Object.keys(e.getAttributes());this.attributes=this.filterAttributes(n,null!==(i=null==t?void 0:t.attributes)&&void 0!==i?i:[]),this.search=this.filterAttributes(n,null!==(r=null==t?void 0:t.search)&&void 0!==r?r:this.attributes)}applySelect(e,t,i){if(!t)return;const r=null==e?void 0:e.getQuery(i?`${i}_select`:"select"),n=t.attributes,o=e=>n.includes(e);t.attributes=[],F(r)&&r.length&&t.attributes.push(...r.split(/\s*,\s*/g).filter(o)),t.attributes.length||(t.attributes=n)}applyOrders(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("asc"),r=null==e?void 0:e.getQuery("desc"),n=[],o=t.attributes,s=e=>o.includes(e);F(i)&&i.length&&n.push(...i.split(/\s*,\s*/g).filter(s).map(e=>[e,"ASC"])),F(r)&&r.length&&n.push(...r.split(/\s*,\s*/g).filter(s).map(e=>[e,"DESC"])),n.length&&(t.order=n)}applyPagination(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("limit"),r=null==e?void 0:e.getQuery("offset");D(t.limit)&&(t.limit=Env.MODEL_LIMIT,F(i)&&(t.limit=parseInt(i)||0),t.limit=$(t.limit,-1,Env.MODEL_LIMIT_MAX)),t.limit<0&&(t.limit=void 0),F(r)&&(t.offset=parseInt(r)||0,t.offset<0&&(t.offset=void 0))}applySearch(e,t){var i;if(!t)return;const r=null==e?void 0:e.getQuery("search");r&&F(r)&&(t.where=Object.assign(Object.assign({},null!==(i=t.where)&&void 0!==i?i:{}),{[he.or]:this.search.map(e=>({[e]:{[he.substring]:r}}))}))}applyWhere(e,t,i){var r,n;if(!t)return null;const o=null==e?void 0:e.getQuery(i?`${i}_where`:"where");if(!F(o))return null;const s=t.attributes,d=ye.parse(s,o);return D(d.error)?(t.where=Object.assign(Object.assign({},null!==(r=t.where)&&void 0!==r?r:{}),null!==(n=d.value)&&void 0!==n?n:{}),null):new a(d.error.join(", "))}countAll(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,options:n={}}=e,o=z({},n);o.attributes=this.getAttributes(null!==(t=null==o?void 0:o.attributes)&&void 0!==t?t:[]),this.applySearch(r,o);const s=this.applyWhere(r,o);if(s)return null==r||r.error(s),0;this.applySelect(r,o);const a=null!==(i=yield this.model.count(Object.assign(Object.assign({},o),{distinct:!!o.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error))&&void 0!==i?i:0;return null==r||r.prepare(d.OK,{count:a}),a})}create(e){return Ne(this,void 0,void 0,function*(){var t,i;const{body:r={},ctx:n,options:o={}}=e,a=z({},o),l=yield this.model.create(Object.assign({},z({},null!==(i=null===(t=null==n?void 0:n.req)||void 0===t?void 0:t.body)&&void 0!==i?i:{},r)),Object.assign(Object.assign({},a),{ctx:n})).catch(this.error);if(!l)return null==n||n.error(new s),null;const{primaryKeyAttribute:u}=this.model;return null==n||n.prepare(d.OK,{[u]:l.getDataValue(u)}),l})}delete(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,id:n,options:s={}}=e,{primaryKeyAttribute:a}=this.model,d=null!==(t=null==r?void 0:r.getParam(a))&&void 0!==t?t:n;if(D(d))return null==r||r.error(new l),0;const u=z({},s),c=yield this.model.destroy(Object.assign(Object.assign(Object.assign({},u),{where:{[he.and]:Object.assign({[a]:d},null!==(i=null==u?void 0:u.where)&&void 0!==i?i:{})},individualHooks:!0}),{ctx:r})).catch(this.error);return c?(null==r||r.success("OK"),c):(null==r||r.error(new o),0)})}filterAttributes(e,t){if(K(t))return t.length?t.filter(t=>F(t)&&e.includes(t)):e;const{exclude:i,include:r}=t,n=D(r)?e:r.filter(t=>F(t)&&e.includes(t)),o=null!=i?i:[];return o.length?n.filter(e=>!o.includes(e)):n}findAll(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,callback:n,options:o={},query:s=!0}=e,a=z({},o);if(a.attributes=this.getAttributes(null!==(t=null==a?void 0:a.attributes)&&void 0!==t?t:[]),s&&this.applySelect(r,a),this.applyOrders(r,a),this.applyPagination(r,a),(null!==(i=null==a?void 0:a.limit)&&void 0!==i?i:0)>Env.MODEL_LIMIT_MAX&&(a.limit=Env.MODEL_LIMIT_MAX),this.applySearch(r,a),s){const e=this.applyWhere(r,a);if(e)return null==r||r.error(e),{count:0,records:[]}}const[l,u]=yield Promise.all([this.model.count(Object.assign(Object.assign({},a),{distinct:!!a.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error).then(e=>null!=e?e:0),this.model.findAll(a).catch(this.error).then(e=>null!=e?e:[])]),c={count:l,records:n?yield n(u):u};return null==r||r.prepare(d.OK,c),c})}findOne(e){return Ne(this,void 0,void 0,function*(){var t,i,r;const{callback:n,ctx:s,id:a,options:u={},query:c=!0}=e,{primaryKeyAttribute:p}=this.model,v=null!==(t=null==s?void 0:s.getParam(p))&&void 0!==t?t:a;if(D(v))return null==s||s.error(new l),null;const g=z({},u);g.attributes=this.getAttributes(null!==(i=null==g?void 0:g.attributes)&&void 0!==i?i:[]),c&&this.applySelect(s,g);const h=yield this.model.findOne(Object.assign(Object.assign({},g),{where:{[he.and]:Object.assign({[p]:v},null!==(r=null==g?void 0:g.where)&&void 0!==r?r:{})}})).catch(this.error);return h?(null==s||s.prepare(d.OK,n?yield n(h):h.toJSON()),h):(null==s||s.error(new o),null)})}getAttributes(e){return this.filterAttributes(this.attributes,e)}include(e,t){var i;const r=W(t),{ctx:n}=null!=t?t:{};r.attributes=this.filterAttributes(Object.keys(e.getAttributes()),null!==(i=r.attributes)&&void 0!==i?i:[]),this.applySearch(n,r);const o=this.applyWhere(n,r,t.name);return o?(null==n||n.error(o),null):(this.applySelect(n,r,t.name),Object.assign({model:e},r))}name(){return this.model.tableName}sync(){return Ne(this,void 0,void 0,function*(){if(!this.permissions.length)return;const e=this.name().toLowerCase(),t={description:"",active:!0};yield G(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`,n=J(e.replace(/_/g," ")," ");yield wt.findOrCreate({where:{key:r},defaults:Object.assign({name:`${n} ${J(i," ")}`,key:r,tags:n},t)})}))})}update(e){return Ne(this,void 0,void 0,function*(){var t,i,r,n;const{ctx:s,body:a,id:d,options:u={}}=e,{primaryKeyAttribute:c}=this.model,p=null!==(t=null==s?void 0:s.getParam(c))&&void 0!==t?t:d;if(D(p))return null==s||s.error(new l),!1;const v=z({},u),g=z({},null!==(r=null===(i=null==s?void 0:s.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{},null!=a?a:{}),h=yield this.model.findOne(Object.assign(Object.assign({},v),{attributes:this.getAttributes([c,...Object.keys(g)]),where:{[he.and]:Object.assign({[c]:p},null!==(n=null==v?void 0:v.where)&&void 0!==n?n:{})}})).catch(this.error);return h?(h.set(g),h.changed()?(null==s||s.success("OK"),yield h.save(Object.assign({},{ctx:s})).catch(this.error),!0):(null==s||s.success("Record not changed"),!1)):(null==s||s.error(new o),!1)})}}let Vt=class UserService extends qt{constructor(){super(...arguments),this.hashOptions={algorithm:Env.PASSWORD_ALGORITHM,memoryCost:Env.PASSWORD_MEMORY_COST,parallelism:Env.PASSWORD_PARALLELISM,timeCost:Env.PASSWORD_TIME_COST}}createPassword(e,t,i){return Ne(this,void 0,void 0,function*(){yield Dt.update({revoked_at:new Date},{where:{revoked_at:null,user_id:e}}).catch(this.error);const r=Oe(t+Env.PASSWORD_PEPPER,this.hashOptions);yield Dt.create({hash:r,user_id:e},Object.assign({},{ctx:i})).catch(this.error)})}getGroups(e,t){return Ne(this,void 0,void 0,function*(){var i;return Q((null!==(i=yield Ct.findAll({attributes:["name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||X(t)?{tenant_id:t}:{})}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name))})}getPermissions(e,t){return Ne(this,void 0,void 0,function*(){var i;return(null!==(i=yield wt.findAll({attributes:["name"],where:{active:!0},include:[{association:"groups_permissions",required:!0,include:[{association:"group",required:!0,attributes:["id","name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||X(t)?{tenant_id:t}:{})}]}]}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name)})}getTenants(e){return Ne(this,void 0,void 0,function*(){var t;return(null!==(t=yield Rt.findAll({attributes:["id","name"],where:{status:Ke.ACTIVE},include:[{association:"users_tenants",required:!0,where:{user_id:e}}]}).catch(this.error))&&void 0!==t?t:[]).map(e=>({id:e.id,name:e.name}))})}};Vt=Re([_e()],Vt);class Application extends u{constructor(e,t){super(e,z({},{cross:!!Env.HTTP_CROSS&&("*"===Env.HTTP_CROSS||{origin:Env.HTTP_CROSS.split(",")}),hybrid:Env.API_HTTP_HYBRID,json:{strict:Env.API_BODYPARSER_STRICT,inflate:Env.API_BODYPARSER_INFLATE,limit:Env.API_BODYPARSER_LIMIT,type:Env.API_BODYPARSER_TYPE},notfound:Env.API_HTTP_NOTFOUND,path:Env.API_HTTP_PATH,port:Env.HTTP_PORT,public:Env.HTTP_PUBLIC,redirect:Env.API_HTTP_REDIRECT,session:{store:new SessionStore,name:Env.API_SESSION_NAME,secret:Env.API_SESSION_SECRET,cookie:{maxAge:Env.API_SESSION_LIFETIME},genid:B},tls:{ca:Env.HTTP_TLS_CA,cert:Env.HTTP_TLS_CRT,key:Env.HTTP_TLS_KEY}},null!=t?t:{})),this.hash=new R(Env.API_KEY_HASH)}error(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.error(e.message,t,Env.CONSOLE_ERROR)}log(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.info(e,t,!0)}listen(){const e=Object.create(null,{listen:{get:()=>super.listen}});return Ne(this,void 0,void 0,function*(){yield He.sync(),yield this.migrations(He),yield Z(this.controllers,e=>Ne(this,void 0,void 0,function*(){N(e.sync)&&(yield e.sync(this))})),this.authService=new Ut,this.userService=new Vt,yield e.listen.call(this),Env.API_WEBSOCKET_START&&this.server&&(this._webSocket=new ne({server:this.server,verifyClient:(e,t)=>t(Env.API_WEBSOCKET_START)}),this._webSocket.on("connection",(e,t)=>Ne(this,void 0,void 0,function*(){t.url||(t.url=""),e.on("close",()=>{}),yield ee(2e3)})))})}migrations(e){return Ne(this,void 0,void 0,function*(){const t=[];yield Z(Object.keys(e.models),i=>Ne(this,void 0,void 0,function*(){var r;const n=e.models[i],o=n.version();if(!o)return;const[s,a]=null!==(r=yield Bt.findOrCreate({where:{model:n.tableName},defaults:{model:n.tableName,version:""}}).catch(this.error))&&void 0!==r?r:[];s&&(a||s.version!=o)&&(s.version=o,yield s.save().catch(this.error),t.push(n))})),yield Z(t,e=>Ne(this,void 0,void 0,function*(){return yield e.updateAttributes()}))})}websocket(){return this._webSocket}}let Yt=class BaseController extends te{constructor(){super(...arguments),this.permissions=[]}name(){var e,t;return(null!==(t=null===(e=this.constructor)||void 0===e?void 0:e.name)&&void 0!==t?t:"api").replace(/(([a-z])([A-Z]))/g,"$2_$3")}session(e,t,i){return Ne(this,void 0,void 0,function*(){i.auth&&i.user&&(i.user_agent?i.user_agent!=t&&i.regenerate(Y):(i.user_agent=t,i.save(Y))),e.next()})}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=J(e.replace(/_/g," ")," ");yield Z(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${J(i," ")}`,active:!0}})}))})}};Re([je(0,c()),je(1,p("user-agent")),je(2,v()),De("design:type",Function),De("design:paramtypes",[n,String,Object]),De("design:returntype",Promise)],Yt.prototype,"session",null),Yt=Re([fe(Loggable)],Yt);let $t=class ModelController extends Yt{constructor(){super(...arguments),this.attributes=[],this.permissions=["create","read","update","delete"],this.search=[]}countAll(e){return Ne(this,void 0,void 0,function*(){return yield this.service.countAll(e)})}create(e){return Ne(this,void 0,void 0,function*(){return yield this.service.create(e)})}delete(e){return Ne(this,void 0,void 0,function*(){return yield this.service.delete(e)})}findAll(e){return Ne(this,void 0,void 0,function*(){return yield this.service.findAll(e)})}findOne(e){return Ne(this,void 0,void 0,function*(){return yield this.service.findOne(e)})}include(e,t){return this.service.include(e,t)}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=J(e.replace(/_/g," ")," ");yield Z(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${J(i," ")}`,active:!0}})})),this.service=new ModelService(this.model,{attributes:this.attributes.length?this.attributes:void 0,search:this.search.length?this.search:void 0})})}update(e){return Ne(this,void 0,void 0,function*(){return yield this.service.update(e)})}name(){return this.model.tableName}};$t=Re([g(Yt)],$t);let zt=class AuditsController extends $t{constructor(){super(...arguments),this.model=Lt,this.permissions=["read"]}all(e,t,i){return Ne(this,void 0,void 0,function*(){const r={};t&&(r.type=t),i&&(r.table=i),yield this.findAll({ctx:e,options:{attributes:{exclude:["currently","previously"]},where:r,order:[["created_at","DESC"]]}})})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}};Re([h(),Je(),$e(),je(0,c()),je(1,y("type")),je(2,y("table")),De("design:type",Function),De("design:paramtypes",[n,String,String]),De("design:returntype",Promise)],zt.prototype,"all",null),Re([h("/:id"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],zt.prototype,"get",null),zt=Re([m("/audits"),g($t)],zt);let Wt=class AuthController extends Yt{constructor(){super(...arguments),this.authService=new Ut}login(e,i,r,n,o,s){return Ne(this,void 0,void 0,function*(){var a;yield ee(Env.SLEEP_AUTH);const d=yield Nt.findOne({where:{[he.or]:[{email:r},{username:r}]}}).catch(this.error);if(!d)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const l=yield Dt.findOne({where:{revoked_at:null,user_id:d.id}}).catch(this.error);if(n+=Env.PASSWORD_PEPPER,!l||!(yield Te(l.hash,n).catch(Y)))return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const u=yield Pt.findOne({where:{active:!0,user_id:d.id}}).catch(this.error);if(u)return e.error(new t("Activation Required")),s.emit("auth.activation",{ctx:e,register:u,user:d}),void this.emit("auth.activation",{ctx:e,register:u,user:d});if(d.status!=qe.ACTIVE)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e,user:d}),void this.emit("auth.failure",{ctx:e,user:d});const{auth:c,token:p}=null!==(a=yield this.authService.create(d).catch(t=>{e.error(t),s.emit("auth.failure",{ctx:e}),this.emit("auth.failure",{ctx:e})}))&&void 0!==a?a:{};c&&p&&(c.user_agent=i,c.ip_address=e.getIp(),yield c.save().catch(this.error),Env.API_TOKEN_COOKIE_SET&&e.setCookie(Env.API_TOKEN_COOKIE,p,{maxAge:o?Env.TOKEN_TTL:void 0}),e.json({token:p}),s.emit("auth.login",{ctx:e,auth:c,user:d}),this.emit("auth.login",{ctx:e,auth:c,user:d}))})}logout(e,i,r,n){return Ne(this,void 0,void 0,function*(){if(yield this.authService.destroy(i))return Env.API_TOKEN_COOKIE_SET&&e.clearCookie(Env.API_TOKEN_COOKIE),e.success("OK"),n.emit("auth.logout",{auth:i,ctx:e,user:r}),void this.emit("auth.logout",{auth:i,ctx:e,user:r});e.error(new t("Access Denied"))})}renew(e,t,i,r){return Ne(this,void 0,void 0,function*(){var n;const{auth:o,token:s}=null!==(n=yield this.authService.renew(i).catch(t=>{e.error(t)}))&&void 0!==n?n:{};o&&s&&(o.user_agent=t,yield o.save().catch(this.error),e.json({token:s}),r.emit("auth.renew",{auth:o,ctx:e}),this.emit("auth.renew",{auth:o,ctx:e}))})}user(e,t){return Ne(this,void 0,void 0,function*(){const{groups:i,permissions:r,tenants:n}=e.req;if(!i||!r||!n)return e.error(new s);e.json(Object.assign(Object.assign({},t.toJSON()),{groups:i,permissions:r,tenants:n}))})}};Re([E("/login"),f(e=>({username:e.string().min(3),password:e.string().min(5),remember:e.boolean().parse().default(!1)})),je(0,c()),je(1,p("user-agent")),je(2,_("username")),je(3,_("password")),je(4,_("remember")),je(5,S()),De("design:type",Function),De("design:paramtypes",[n,String,String,String,Boolean,Application]),De("design:returntype",Promise)],Wt.prototype,"login",null),Re([h("/logout"),Je(),je(0,c()),je(1,Qe()),je(2,it()),je(3,S()),De("design:type",Function),De("design:paramtypes",[n,It,Nt,Application]),De("design:returntype",Promise)],Wt.prototype,"logout",null),Re([E("/renew"),f(e=>({token:e.string()})),je(0,c()),je(1,p("user-agent")),je(2,_("token")),je(3,S()),De("design:type",Function),De("design:paramtypes",[n,String,String,Application]),De("design:returntype",Promise)],Wt.prototype,"renew",null),Re([h(),h("/me"),Je(),je(0,c()),je(1,it()),De("design:type",Function),De("design:paramtypes",[n,Nt]),De("design:returntype",Promise)],Wt.prototype,"user",null),Wt=Re([m("/auth"),g(Yt)],Wt);let Gt=class CrudController extends $t{constructor(){super(...arguments),this._crud={}}CrudArgumentsCountAll(e){return{ctx:e}}CrudArgumentsCreate(e){return{ctx:e}}CrudArgumentsFindAll(e){return{ctx:e}}CrudArgumentsFindOne(e){return{ctx:e}}CrudArgumentsDelete(e){return{ctx:e}}CrudArgumentsUpdate(e){return{ctx:e}}CrudValidateCreate(){return this._crud}CrudValidateUpdate(){return this._crud}add(e){return Ne(this,void 0,void 0,function*(){yield this.create(this.CrudArgumentsCreate(e))})}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll(this.CrudArgumentsFindAll(e))})}rows(e){return Ne(this,void 0,void 0,function*(){yield this.countAll(this.CrudArgumentsCountAll(e))})}del(e){return Ne(this,void 0,void 0,function*(){yield this.delete(this.CrudArgumentsDelete(e))})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne(this.CrudArgumentsFindOne(e))})}set(e){return Ne(this,void 0,void 0,function*(){yield this.update(this.CrudArgumentsUpdate(e))})}validate(e,t){var i,r;const n=U.object(t).parse().validate(null!==(r=null===(i=e.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{});if(n.error)return e.error(new a(n.message||n.error));e.req.body=n.value,e.next()}validateCreate(e){const t=this.CrudValidateCreate();if(t==this._crud)return e.error(new s);this.validate(e,t)}validateUpdate(e){const t=this.CrudValidateUpdate();if(t==this._crud)return e.error(new s);this.validate(e,t)}};Re([E(),Je(),Ve(),A("validateCreate"),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"add",null),Re([h(),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"all",null),Re([h("/count"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"rows",null),Re([O("/:id"),Je(),Ye(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"del",null),Re([h("/:id"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"get",null),Re([T("/:id"),Je(),ze(),A("validateUpdate"),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Gt.prototype,"set",null),Re([je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",void 0)],Gt.prototype,"validateCreate",null),Re([je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",void 0)],Gt.prototype,"validateUpdate",null),Gt=Re([g($t)],Gt);let Jt=class FilesController extends Yt{constructor(){super(...arguments),this.directory=Env.HTTP_PUBLIC||"./",this.permissions=["delete","download","edit","list","read","rename","upload","write"]}files(e){return Ne(this,void 0,void 0,function*(){let{path:t}=e.req;t=t.replace(/(^\/path(\/)?)|([\\.]{1,2}\/)/g,"");const i=Me(this.directory,t);if(!be(i)||!Pe(i).isDirectory())return e.error(new o);let r;return r=Ie(i),r=r.map(e=>this.info(Me(i,e))),r=r.filter(ie),Object.assign(Object.assign({},this.info(i)),{files:r})})}info(e){if(!be(e))return null;const t=Pe(e),i=e.split("/").pop();e=e.replace(this.directory,"/").replace(/^\/\//,"/");const r=t.isDirectory();return{name:i,path:e.replace(/^\/\//,"/"),size:t.size,extension:r?"":"."+e.split(".").pop(),created:t.birthtime,modified:t.mtime,directory:r,symlink:t.isSymbolicLink()}}name(){return"files"}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=J(e.replace(/_/g," ")," ");yield Z(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${J(i," ")}`,active:!0}})}))})}};Re([h("/path"),h("/path/*path"),Je(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],Jt.prototype,"files",null),Jt=Re([m("/files"),g(Yt)],Jt);let Qt=class ForgotController extends Yt{check(e,t){return Ne(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i||!i.user)return e.error(new o);i.secret=re(),yield i.save(),e.json({token:i.secret})})}forgot(e,t,i){return Ne(this,void 0,void 0,function*(){yield ee(Env.SLEEP_FORGOT);const r=t,n=yield Nt.findOne({where:{[he.or]:[{email:r},{username:t}]}}).catch(this.error);if(!n)return e.error(new o);const s=re(),a=Date.now()+6e4*Env.TOKEN_TTL_FORGOT,d=yield Ft.create({token:s,timestamp:a,active:!0,user_id:n.id});e.success("OK"),i.emit("forgot.send",{ctx:e,forgot:d,user:n}),this.emit("forgot.send",{ctx:e,forgot:d,user:n})})}reset(e,t,i,r){return Ne(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i)return e.error(new o);i.active=!1,yield i.save().catch(this.error),yield i.user.save().catch(this.error),e.success("OK"),r.emit("forgot.reset",{ctx:e,user:i.user}),this.emit("forgot.reset",{ctx:e,user:i.user})})}find(e){return Ne(this,void 0,void 0,function*(){return yield Ft.findOne({where:{token:e,active:!0},include:[{association:"users",required:!0}]}).catch(this.error)})}};Re([h("/check"),f(e=>({token:e.string()})),je(0,c()),je(1,_("token")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],Qt.prototype,"check",null),Re([E(),f(e=>({username:e.string().min(4)})),je(0,c()),je(1,_("username")),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],Qt.prototype,"forgot",null),Re([E("/reset"),f(e=>({token:e.string(),password:e.string().min(5)})),je(0,c()),je(1,_("token")),je(2,_("password")),je(3,S()),De("design:type",Function),De("design:paramtypes",[n,String,String,Application]),De("design:returntype",Promise)],Qt.prototype,"reset",null),Qt=Re([m("/forgot"),g(Yt)],Qt);let Xt=class GroupsController extends Gt{constructor(){super(...arguments),this.model=Ct,this.schemaCreate={name:U.string(),description:U.string().default(""),type:U.enum(Object.values(ke)).default(ke.SYSTEM),active:U.boolean().parse(),metadata:U.object().parse().default({})},this.schemaUpdate={description:U.string().optional(),type:U.enum(Object.values(ke)).optional(),active:U.boolean().parse().optional(),metadata:U.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}};Xt=Re([m("/groups"),g(Gt)],Xt);let Zt=class GroupsPermissionsController extends $t{constructor(){super(...arguments),this.model=xt,this.permissions=[]}all(e,t){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{where:{group_id:t},include:[{association:"permission",required:!0}]},callback:e=>e.map(e=>e.permission),query:!1})})}set(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield Ct.findByPk(t,{attributes:["id"]}).catch(this.error);if(!r)return e.error(new o);const n=r.id,s=[];yield Z(Q(i),t=>Ne(this,void 0,void 0,function*(){var i;if(!(yield wt.count({where:{id:t}})))return;const[r]=null!==(i=yield xt.findOrCreate(Object.assign({where:{group_id:n,permission_id:t},defaults:{group_id:n,permission_id:t}},{ctx:e})).catch(this.error))&&void 0!==i?i:[];r&&s.push(t)})),yield xt.destroy(Object.assign({where:{group_id:n,permission_id:{[he.notIn]:s}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}};Re([h("/:id/permissions"),Je(),$e("groups"),je(0,c()),je(1,b("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],Zt.prototype,"all",null),Re([T("/:id/permissions"),Je(),ze("groups"),f(e=>({permissions:e.array(e.string().uuid())})),je(0,c()),je(1,b("id")),je(2,_("permissions")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Zt.prototype,"set",null),Zt=Re([m("/groups"),g($t)],Zt);let ei=class HealthController{ping(e){return Ne(this,void 0,void 0,function*(){e.json({status:"ok",timestamp:Date.now(),uptime:process.uptime()})})}};Re([P("/"),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ei.prototype,"ping",null),ei=Re([m("/health")],ei);let ti=class LogsController extends $t{constructor(){super(...arguments),this.model=kt,this.permissions=["read"]}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}};Re([h(),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ti.prototype,"all",null),ti=Re([m("/logs"),g($t)],ti);let ii=class McpController extends Yt{constructor(){super(...arguments),this.tools=new McpToolRegistry,this.toolsRegistered=!1,this.handler=new McpHttpHandler({sessions:new McpSessionStore(Env.MCP_SESSION_TTL),tools:this.tools,logger:{toolCall:e=>Ne(this,void 0,void 0,function*(){yield Log.info(JSON.stringify(e),"mcp")})}})}sync(e){const t=Object.create(null,{sync:{get:()=>super.sync}});return Ne(this,void 0,void 0,function*(){yield t.sync.call(this),this.toolsRegistered||(this.toolsRegistered=!0,e&&(e.instance.use((e,t,i,r)=>{if(!this.isMcpEndpoint(t))return r(e);const n=this.jsonParseErrorResponse(e);if(!n)return r(e);i.status(n.status).json(n.body)}),e.instance.use((e,t,i)=>{if(!this.isMcpEndpoint(e)||!["GET","HEAD"].includes(e.method))return i();t.setHeader("Allow",gt),t.status(405).end()}),this.discoverMcpTools(e.controllers).forEach(e=>this.tools.register(e))))})}get(e){return Ne(this,void 0,void 0,function*(){this.setHeader(e),e.send(405)})}options(e){return Ne(this,void 0,void 0,function*(){this.setHeader(e),e.send(204)})}post(e){return Ne(this,void 0,void 0,function*(){this.respond(e,yield this.handler.post(e))})}delete(e){return Ne(this,void 0,void 0,function*(){this.respond(e,this.handler.delete(e))})}getMcpToolMetadata(e){const t=Ee(mt,e,[]);return t.length||"function"==typeof e?t:Ee(mt,Object.getPrototypeOf(e),[])}discoverMcpTools(e){const t=[];for(const i of e)for(const e of this.getMcpToolMetadata(i))t.push(this.createMcpToolFromMetadata(i,e));return t}createMcpToolFromMetadata(e,t){const i=e[t.propertyKey];if(!N(i))throw new Error(`MCP tool "${t.name}" handler was not found`);return Et(t),Object.assign(Object.assign(Object.assign({name:t.name,title:t.title,description:t.description},void 0!==t.input?{input:t.input}:{}),void 0!==t.output?{output:t.output}:{}),{run:(t,r)=>i.call(e,t,r)})}isJsonParseError(e){if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode}isMcpEndpoint(e){const t=(e.originalUrl||e.url).split("?")[0].replace(/\/+$/g,"")||"/";return t===`${(Env.API_HTTP_PATH||"/").replace(/\/+$/g,"")||""}/mcp`.replace(/\/+/g,"/")||"/mcp"===t}jsonParseErrorResponse(e){if(this.isJsonParseError(e))return{status:400,body:st(null,new McpParseError("Parse error",{message:e.message}))}}respond(e,t){var i;for(const[r,n]of Object.entries(null!==(i=t.headers)&&void 0!==i?i:{}))e.res.setHeader(r,n);void 0!==t.body?e.res.status(t.status).json(t.body):e.res.status(t.status).end()}setHeader(e,t){Object.entries(Object.assign({Allow:gt,"Access-Control-Allow-Methods":gt,"Access-Control-Allow-Headers":`Content-Type, Accept, ${pt}, ${ct}`},null!=t?t:{})).forEach(([t,i])=>{e.res.setHeader(t,i)})}};Re([h(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"get",null),Re([I(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"options",null),Re([E(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"post",null),Re([O(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"delete",null),ii=Re([m("/mcp"),g(Yt)],ii);let ri=class PermissionsController extends Gt{constructor(){super(...arguments),this.model=wt,this.schemaCreate={name:U.string(),description:U.string().default(""),active:U.boolean().parse(),metadata:U.object().parse().default({})},this.schemaUpdate={description:U.string().optional(),active:U.boolean().parse().optional(),metadata:U.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}};ri=Re([m("/permissions"),g(Gt)],ri);let ni=class RegisterController extends Yt{register(e,t,i){return Ne(this,void 0,void 0,function*(){yield ee(Env.SLEEP_REGISTRY);const{name:r,date:n,email:o,username:a,password:d,confirm:l}=t,u=a||o,c=j(d);if(yield Nt.count({where:{[he.or]:[{email:o},{username:u}]}}).catch(this.error))return e.error("INVALID EMAIL OR USERNAME");if(c!=j(l))return e.error("INVALID PASSWORD");const p=yield Nt.create({name:r,email:o,username:u,password:c,avatar:"",date:n,description:"",status:qe.PENDING}).catch(this.error);if(!p)return e.error(new s);const v=yield Pt.create({token:yield this.getId(),active:!0,user_id:p.id}).catch(this.error);if(!v)return yield p.destroy().catch(this.error),e.error(new s);e.success("OK"),i.emit("register.user",{ctx:e,register:v,user:p}),this.emit("register.user",{ctx:e,register:v,user:p})})}confirm(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield Pt.findOne({where:{token:t,active:!0},include:[{association:"users",required:!0}]}).catch(this.error);if(!r)return e.error(new o);r.active=!1,yield r.save().catch(this.error),r.user.status=qe.ACTIVE,yield r.user.save().catch(this.error),e.success("OK"),i.emit("register.confirm",{ctx:e,register:r,user:r.user}),this.emit("register.confirm",{ctx:e,register:r,user:r.user})})}send(e,t,i){return Ne(this,void 0,void 0,function*(){const r=t,n=yield Pt.findOne({where:{active:!0},include:[{model:Nt,required:!0,where:{[he.or]:[{email:r},{username:t}]}}]}).catch(this.error);if(!n)return e.error(new o);e.success("OK"),i.emit("register.send",{ctx:e,register:n,user:n.user}),this.emit("register.send",{ctx:e,register:n,user:n.user})})}getId(){return Ne(this,void 0,void 0,function*(){const e=B();return(yield Pt.count({where:{token:e}}))?this.getId():e})}};Re([E(),f(e=>({name:e.string(),date:e.date(),email:e.string().email(),username:e.string().min(4).default(e.ref("email")),password:e.string().min(5),confirm:e.string().min(5)})),je(0,c()),je(1,_()),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,Object,Application]),De("design:returntype",Promise)],ni.prototype,"register",null),Re([E("/confirm"),f(e=>({token:e.string()})),je(0,c()),je(1,_("token")),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],ni.prototype,"confirm",null),Re([E("/send"),f(e=>({username:e.string().min(4)})),je(0,c()),je(1,_("username")),je(2,S()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],ni.prototype,"send",null),ni=Re([m("/register"),g(Yt)],ni);let oi=class SetupController extends Yt{constructor(){super(...arguments),this.userService=new Vt}setup(e){return Ne(this,void 0,void 0,function*(){var t;if(yield Nt.count())return e.error(new o("Endpoint Not Found"));const i=yield Nt.create({name:"Admin",username:"admin",email:"admin@localhost.com",notes:"",status:qe.ACTIVE},Object.assign({},{ctx:e})).catch(this.error);if(!i)return e.error(new s);yield this.userService.createPassword(i.id,"admin",e);const r=yield Ct.create({name:"root",description:"Root",active:!0},Object.assign({},{ctx:e}));yield jt.create({user_id:i.id,group_id:r.id},Object.assign({},{ctx:e})),yield Ct.create({name:"admin",description:"Admin",active:!0},Object.assign({},{ctx:e})),yield Ct.create({name:"user",description:"User",active:!0},Object.assign({},{ctx:e}));const n=null!==(t=yield wt.findAll({where:{active:!0}}).catch(this.error))&&void 0!==t?t:[];yield Z(n,t=>Ne(this,void 0,void 0,function*(){yield xt.create({group_id:r.id,permission_id:t.id},Object.assign({},{ctx:e}))})),e.success("OK")})}};Re([h(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],oi.prototype,"setup",null),oi=Re([m("/setup"),g(Yt)],oi);let si=class TestController extends Yt{json(e){return Ne(this,void 0,void 0,function*(){e.json({ok:!0,message:"hello",timestamp:Date.now()})})}sum(e,t){return Ne(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t+i}})}multiply(e,t){return Ne(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t*i}})}average(e,t){return Ne(this,void 0,void 0,function*(){const t=e.values;return{value:t.reduce((e,t)=>e+t,0)/t.length,count:t.length}})}validationString(e,t){return Ne(this,void 0,void 0,function*(){const t=e.text;return{length:t.length,normalized:t.trim()}})}validationNumber(e,t){return Ne(this,void 0,void 0,function*(){return{doubled:2*e.value}})}validationBoolean(e,t){return Ne(this,void 0,void 0,function*(){return{active:e.active}})}validationArray(e,t){return Ne(this,void 0,void 0,function*(){return{count:e.tags.length}})}validationObject(e,t){return Ne(this,void 0,void 0,function*(){const t=e.profile;return{summary:{name:t.name,adult:t.age>=18}}})}validationEnum(e,t){return Ne(this,void 0,void 0,function*(){return{status:e.status}})}validationDate(e,t){return Ne(this,void 0,void 0,function*(){const t=e.date;return{iso:t.toISOString(),timestamp:t.getTime()}})}validationOptional(e,t){return Ne(this,void 0,void 0,function*(){const t=e.nickname;return Object.assign({name:e.name,hasNickname:Boolean(t)},t?{nickname:t}:{})})}validationDefaults(e,t){return Ne(this,void 0,void 0,function*(){return{name:e.name,limit:e.limit}})}validationParse(e,t){return Ne(this,void 0,void 0,function*(){return{active:e.active,amount:e.amount}})}validationNested(e,t){return Ne(this,void 0,void 0,function*(){const t=e.payload;return{userId:t.user.id,scoreCount:t.scores.length}})}};Re([h(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],si.prototype,"json",null),Re([ft({name:"sum",title:"Somar numeros",description:"Soma dois numeros.",input:{a:U.number().description("valor a"),b:U.number().description("valor b")},output:{value:U.number().description("resultado da soma de a + b")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"sum",null),Re([ft({name:"multiply",title:"Multiplicar numeros",description:"Multiplica dois numeros.",input:{a:U.number().description("valor a"),b:U.number().description("valor b")},output:{value:U.number().description("resultado da multiplicação de a * b")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"multiply",null),Re([ft({name:"average",title:"Calcular media",description:"Calcula a media de uma lista de numeros.",input:{values:U.array(U.number().description("numero usado no calculo da media")).min(1).max(10).description("lista de numeros para calcular a media")},output:{value:U.number().description("media calculada"),count:U.number().description("quantidade de numeros usados")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"average",null),Re([ft({name:"validation.string",title:"Validacao de string",description:"Exemplo de validacao de texto com tamanho minimo e maximo.",input:{text:U.string().min(5).max(50).description("Texto entre 5 e 50 caracteres.")},output:{length:U.number().description("Quantidade de caracteres do texto."),normalized:U.string().description("Texto normalizado sem espacos nas pontas.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationString",null),Re([ft({name:"validation.number",title:"Validacao de number",description:"Exemplo de validacao numerica com minimo e maximo.",input:{value:U.number().min(0).max(100).description("Numero entre 0 e 100.")},output:{doubled:U.number().description("Numero multiplicado por dois.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationNumber",null),Re([ft({name:"validation.boolean",title:"Validacao de boolean",description:"Exemplo de validacao de booleano sem parse implicito.",input:{active:U.boolean().description("Indica se o registro esta ativo.")},output:{active:U.boolean().description("Booleano validado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationBoolean",null),Re([ft({name:"validation.array",title:"Validacao de array",description:"Exemplo de validacao de array com limites e item tipado.",input:{tags:U.array(U.string().min(2).max(20).description("Tag entre 2 e 20 caracteres.")).min(1).max(5).description("Lista de tags entre 1 e 5 itens.")},output:{count:U.number().description("Quantidade de tags recebidas.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationArray",null),Re([ft({name:"validation.object",title:"Validacao de object",description:"Exemplo de validacao de objeto simples.",input:{profile:U.object({name:U.string().min(2).max(60).description("Nome do perfil."),age:U.number().min(0).max(120).description("Idade do perfil."),nickname:U.string().empty().max(30).description("Apelido opcional do perfil.")}).description("Objeto de perfil.")},output:{summary:U.object({name:U.string().description("Nome validado."),adult:U.boolean().description("Indica se a idade e maior ou igual a 18.")}).description("Resumo do perfil.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationObject",null),Re([ft({name:"validation.enum",title:"Validacao de enum",description:"Exemplo de validacao de lista fechada de valores.",input:{status:U.enum(["draft","active","archived"]).description("Status permitido.")},output:{status:U.string().description("Status validado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationEnum",null),Re([ft({name:"validation.date",title:"Validacao de date",description:"Exemplo de validacao e parse de data.",input:{date:U.date().parse().description("Data em formato aceito pelo Date.")},output:{iso:U.string().description("Data em ISO string."),timestamp:U.number().description("Data em timestamp Unix em milissegundos.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationDate",null),Re([ft({name:"validation.optional",title:"Validacao de campo opcional",description:"Exemplo de campo opcional aceitando ausencia.",input:{name:U.string().min(2).description("Nome obrigatorio."),nickname:U.string().empty().max(30).description("Apelido opcional.")},output:{name:U.string().description("Nome validado."),hasNickname:U.boolean().description("Indica se apelido foi enviado."),nickname:U.string().empty().description("Apelido validado quando enviado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationOptional",null),Re([ft({name:"validation.defaults",title:"Validacao de valores padrao",description:"Exemplo de campos opcionais com valores padrao.",input:{name:U.string().default("guest").description("Nome opcional com valor padrao."),limit:U.number().parse().default(10).min(1).max(100).description("Limite opcional com valor padrao.")},output:{name:U.string().description("Nome final."),limit:U.number().description("Limite final.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationDefaults",null),Re([ft({name:"validation.parse",title:"Validacao com parse",description:"Exemplo de parse de boolean e number antes da validacao final.",input:{active:U.boolean().parse().default(!1).description("Booleano aceitando valores parseaveis."),amount:U.number().parse().min(1).max(1e3).description("Numero aceitando string numerica.")},output:{active:U.boolean().description("Booleano parseado."),amount:U.number().description("Numero parseado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationParse",null),Re([ft({name:"validation.nested",title:"Validacao de objeto aninhado",description:"Exemplo de objeto aninhado com array interno.",input:{payload:U.object({user:U.object({id:U.string().min(3).max(30).description("Identificador do usuario."),email:U.string().email().description("Email do usuario.")}).description("Usuario do payload."),scores:U.array(U.number().min(0).max(100).description("Pontuacao individual.")).min(1).max(3).description("Pontuacoes do usuario.")}).description("Payload aninhado.")},output:{userId:U.string().description("Identificador validado."),scoreCount:U.number().description("Quantidade de pontuacoes.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],si.prototype,"validationNested",null),si=Re([m("/test"),g(Yt)],si);let ai=class UsersController extends $t{constructor(){super(),this.model=Nt,this.path=Env.HTTP_PUBLIC+"/avatar",Env.HTTP_PUBLIC&&be(Env.HTTP_PUBLIC)&&!be(this.path)&&we(this.path)}avatar(e,t){return Ne(this,void 0,void 0,function*(){var i;const r=e.getFiles();if(r.file&&r.file.length){const{filename:n,path:o}=null!==(i=r.file[0])&&void 0!==i?i:{};if(n){const i=yield Nt.findOne({where:{id:t.id}}).catch(this.error);if(!i)return xe(o).isFile()&&Ce(o),e.error(new s);const r=this.path+"/"+i.metadata.avatar_url;if(be(r)&&xe(r).isFile()&&Ce(r),i.changed("metadata",!0),i.metadata.avatar_url=n,yield i.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK")}}e.success("Record not Changed")})}token_new(){return Ne(this,void 0,void 0,function*(){var e;const t=B();return(null!==(e=yield this.model.count({where:{token:t}}).catch(this.error))&&void 0!==e?e:0)?this.token_new():t})}add(e){return Ne(this,void 0,void 0,function*(){yield this.create({ctx:e})})}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}rows(e){return Ne(this,void 0,void 0,function*(){yield this.countAll({ctx:e})})}del(e,t,i){return Ne(this,void 0,void 0,function*(){if(i.id==t)return e.error(new o);yield this.delete({ctx:e})})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}set(e){return Ne(this,void 0,void 0,function*(){yield this.update({ctx:e})})}};Re([E("/avatar"),Je(),w({file:{count:1,path:`${Env.HTTP_PUBLIC}/avatar`,types:["image/bmp","image/jpeg","image/png"],size:32}}),je(0,c()),je(1,it()),De("design:type",Function),De("design:paramtypes",[n,Nt]),De("design:returntype",Promise)],ai.prototype,"avatar",null),Re([E(),Je(),Ve(),f(e=>({name:e.string(),email:e.string().email(),username:e.string().min(3),notes:e.string().default(""),status:e.enum(Object.values(qe)).default(qe.ACTIVE),metadata:e.object().parse().default({})})),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"add",null),Re([h(),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"all",null),Re([h("/count"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"rows",null),Re([O("/:id"),Je(),Ye(),je(0,c()),je(1,b("id")),je(2,it()),De("design:type",Function),De("design:paramtypes",[n,String,Nt]),De("design:returntype",Promise)],ai.prototype,"del",null),Re([h("/:id"),Je(),$e(),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"get",null),Re([T("/:id"),Je(),ze(),f(e=>({name:e.string().optional(),email:e.string().email().optional(),username:e.string().min(3).optional(),notes:e.string().optional(),status:e.enum(Object.values(qe)).optional(),metadata:e.object().parse().optional()})),je(0,c()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ai.prototype,"set",null),ai=Re([m("/users"),g($t),De("design:paramtypes",[])],ai);let di=class UsersGroupsController extends $t{constructor(){super(...arguments),this.model=jt,this.permissions=[]}all(e,t){return Ne(this,void 0,void 0,function*(){if(!(yield Nt.findByPk(t,{attributes:["id"]}).catch(this.error)))return e.error(new o("User Not Found"));yield this.findAll({ctx:e,options:{where:{user_id:t},include:[{association:"group",required:!0}]},callback:e=>e.map(e=>e.group),query:!1})})}set(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield Nt.findByPk(t,{attributes:["id"]}).catch(this.error);if(!r)return e.error(new o("User Not Found"));const n=r.id,s=[];yield Z(Q(i),t=>Ne(this,void 0,void 0,function*(){var i;if(!(yield Ct.count({where:{id:t}})))return;const[r]=null!==(i=yield jt.findOrCreate(Object.assign({where:{user_id:n,group_id:t},defaults:{user_id:n,group_id:t}},{ctx:e})).catch(this.error))&&void 0!==i?i:[];r&&s.push(t)})),yield jt.destroy(Object.assign({where:{user_id:n,group_id:{[he.notIn]:s}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}};Re([h("/:id/groups"),Je(),$e("users"),je(0,c()),je(1,b("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],di.prototype,"all",null),Re([T("/:id/groups"),Je(),ze("users"),f(e=>({groups:e.array(e.string().uuid())})),je(0,c()),je(1,b("id")),je(2,_("groups")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],di.prototype,"set",null),di=Re([m("/users"),g($t)],di);export{Application,bt as Audit,Lt as AuditModel,Fe as AuditTypes,zt as AuditsController,Wt as AuthController,Ut as AuthService,Yt as BaseController,Ve as CanCreate,Ye as CanDelete,$e as CanRead,ze as CanUpdate,Config,Ht as ConfigModel,Gt as CrudController,Env,Jt as FilesController,Qt as ForgotController,Ft as ForgotModel,Ct as GroupModel,xt as GroupPermissionModel,ke as GroupTypes,Xt as GroupsController,Zt as GroupsPermissionsController,We as HasGroups,Ge as HasPermissions,ei as HealthController,Je as IsAuthenticated,Log,Be as LogLevels,kt as LogModel,Loggable,ti as LogsController,ut as MCP_DEFAULT_PROTOCOL_VERSION,gt as MCP_HTTP_ALLOW,vt as MCP_HTTP_ALLOWED_METHODS,ct as MCP_PROTOCOL_VERSION_HEADER,pt as MCP_SESSION_ID_HEADER,lt as MCP_SUPPORTED_PROTOCOL_VERSIONS,mt as MCP_TOOL_METADATA,ii as McpController,McpError,rt as McpErrorCode,McpHttpHandler,McpInternalError,McpInvalidParamsError,McpInvalidRequestError,McpInvalidSessionError,McpMethodNotFoundError,McpParseError,McpServerError,McpSessionStore,ft as McpTool,McpToolNotFoundError,McpToolRegistry,Bt as MigrationModel,$t as ModelController,ModelService,wt as PermissionModel,ri as PermissionsController,ni as RegisterController,Pt as RegisterModel,Qe as ReqAuth,Xe as ReqGroup,Ze as ReqGroups,et as ReqPermission,tt as ReqPermissions,it as ReqUser,qt as Service,Kt as SessionModel,SessionStore,oi as SetupController,Rt as TenantModel,Ke as TenantStatus,si as TestController,It as UserAuthModel,jt as UserGroupModel,Nt as UserModel,Dt as UserPasswordModel,Vt as UserService,qe as UserStatus,Mt as UserTenantModel,ai as UsersController,di as UsersGroupsController,Et as assertValidMcpToolDefinition,Ue as canFactory,ht as isJsonParseError,nt as isJsonRpcId,yt as jsonParseErrorResponse,st as jsonRpcError,at as jsonRpcErrorFromCode,ot as jsonRpcResult,dt as parseJsonRpcRequest,He as sequelize};

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@andrewcaires/api",
-  "version": "5.3.2",
+  "version": "5.3.4",
   "description": "Simple api for small applications using express, jsonwebtoken, sequelize and websocket",
   "type": "module",
   "main": "./dist/index.cjs.js",
@@ -52,7 +52,7 @@
     "@andrewcaires/express": "^2.4.0",
     "@andrewcaires/node": "^1.4.0",
     "@andrewcaires/sequelize": "^3.2.2",
-    "@andrewcaires/utils.js": "^0.5.4",
+    "@andrewcaires/utils.js": "^0.5.6",
     "@node-rs/argon2": "^2.0.2",
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
@@ -70,13 +70,13 @@
     "@types/cors": "^2.8.19",
     "@types/express-session": "^1.19.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.3",
     "@types/ws": "^8.18.1",
     "eslint": "^10.4.1",
-    "mariadb": "^3.5.2",
-    "rollup": "^4.61.0",
+    "mariadb": "^3.5.3",
+    "rollup": "^4.61.1",
     "rollup-plugin-dts": "^6.4.1",
     "tslib": "^2.8.1",
-    "typescript-eslint": "^8.60.1"
+    "typescript-eslint": "^8.61.0"
   }
 }