@andrewcaires/api 5.3.5 → 5.3.6

package/dist/index.esm.js

@@ -1,7 +1,7 @@
 /*!
- * @andrewcaires/api v5.3.5
+ * @andrewcaires/api v5.3.6
  * Simple api for small applications using express, jsonwebtoken, sequelize and websocket
  * (c) 2026 Andrew Caires
  * @license: MIT
  */
-import{Use as e,UnauthorizedError as t,parameterFactory as i,ResponseError as r,Context as n,NotFoundError as o,InternalServerError as s,ValidationError as d,StatusCodes as a,BadRequestError as l,Application as u,Ctx as c,Headers as p,Session as v,Extends as g,Get as h,Controller as y,Post as m,ValidateBody as E,Body as f,App as _,Middleware as S,Delete as O,Put as A,Params as T,All as b,Options as P,Upload as w}from"@andrewcaires/express";import{Env as I,Log as x,LogColor as C,Encryptor as M,sha256 as R}from"@andrewcaires/node";import{isUndefined as j,isFunction as D,includesArray as N,isPlainObject as k,isString as L,isNumber as F,uuidv7 as H,isArray as K,isValidationShape as B,Validation as q,getConstructor as U,noop as V,clamp as Y,merge as $,clone as G,forEachAsync as z,upperCamelCase as W,uniqueArray as J,isNull as Q,forEachSeries as X,sleep as Z,EventEmitter as ee,isDef as te,uniqueID as ie}from"@andrewcaires/utils.js";import{WebSocketServer as re}from"ws";import{Sequelize as ne,Hooks as oe,Column as se,Association as de,Database as ae,ModelName as le,Version as ue,Model as ce,Index as pe,DefaultValue as ve,Op as ge,Where as he}from"@andrewcaires/sequelize";import{config as ye}from"dotenv";import{metadata as me,Trait as Ee,Singleton as fe}from"@andrewcaires/decorator";import{Store as _e}from"express-session";import Se from"jsonwebtoken";import{hashSync as Oe,verify as Ae}from"@node-rs/argon2";import{existsSync as Te,statSync as be,readdirSync as Pe,mkdirSync as we,lstatSync as Ie,rmSync as xe}from"fs";import{join as Ce}from"path";function Me(e,t,i,r){var n,o=arguments.length,s=o<3?t:null===r?r=Object.getOwnPropertyDescriptor(t,i):r;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)s=Reflect.decorate(e,t,i,r);else for(var d=e.length-1;d>=0;d--)(n=e[d])&&(s=(o<3?n(s):o>3?n(t,i,s):n(t,i))||s);return o>3&&s&&Object.defineProperty(t,i,s),s}function Re(e,t){return function(i,r){t(i,r,e)}}function je(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function De(e,t,i,r){return new(i||(i=Promise))(function(n,o){function s(e){try{a(r.next(e))}catch(e){o(e)}}function d(e){try{a(r.throw(e))}catch(e){o(e)}}function a(e){var t;e.done?n(e.value):(t=e.value,t instanceof i?t:new i(function(e){e(t)})).then(s,d)}a((r=r.apply(e,t||[])).next())})}var Ne;"function"==typeof SuppressedError&&SuppressedError,ye({quiet:!0});class Env extends I{}Ne=Env,Env.BASE_NAME=Ne.getString("BASE_NAME",""),Env.CONSOLE_ERROR=Ne.getBool("CONSOLE_ERROR",!1),Env.DATABASE_URI=Ne.getString("DATABASE_URI","",!0),Env.DATABASE_LOG=Ne.getBool("DATABASE_LOG",!1),Env.DATABASE_AUDIT=Ne.getBool("DATABASE_AUDIT",!0),Env.DATABASE_PREFIX=Ne.getString("DATABASE_PREFIX",""),Env.DATABASE_TIMEZONE=Ne.getString("DATABASE_TIMEZONE","+00:00"),Env.ENCRYPTION_SECRET=Ne.getString("ENCRYPTION_SECRET",""),Env.HTTP_CROSS=Ne.getString("HTTP_CROSS",""),Env.HTTP_PORT=Ne.getInt("HTTP_PORT",Ne.getInt("PORT",3e3)),Env.HTTP_PUBLIC=Ne.getString("HTTP_PUBLIC",""),Env.HTTP_TLS_CA=Ne.getFile("HTTP_TLS_CA"),Env.HTTP_TLS_CRT=Ne.getFile("HTTP_TLS_CRT"),Env.HTTP_TLS_KEY=Ne.getFile("HTTP_TLS_KEY"),Env.KEY_HEADER=Ne.getString("KEY_HEADER","x-api-key"),Env.MODEL_LIMIT=Ne.getInt("MODEL_LIMIT",10),Env.MODEL_LIMIT_MAX=Ne.getInt("MODEL_LIMIT_MAX",100),Env.MCP_SESSION_TTL=Ne.getMs("MCP_SESSION_TTL","30m"),Env.PASSWORD_ALGORITHM=Ne.getInt("PASSWORD_ALGORITHM",2),Env.PASSWORD_MEMORY_COST=Ne.getInt("PASSWORD_MEMORY_COST",4096),Env.PASSWORD_PARALLELISM=Ne.getInt("PASSWORD_PARALLELISM",1),Env.PASSWORD_PEPPER=Ne.getString("PASSWORD_PEPPER",""),Env.PASSWORD_TIME_COST=Ne.getInt("PASSWORD_TIME_COST",3),Env.SLEEP_AUTH=Ne.getMs("SLEEP_AUTH","2s"),Env.SLEEP_FORGOT=Ne.getMs("SLEEP_FORGOT","5s"),Env.SLEEP_REGISTRY=Ne.getMs("SLEEP_REGISTRY","5s"),Env.TENANT_HEADER=Ne.getString("TENANT_HEADER","x-tenant-id"),Env.TOKEN_CRT=Ne.getFile("TOKEN_CRT"),Env.TOKEN_HEADER=Ne.getString("TOKEN_HEADER","authorization"),Env.TOKEN_KEY=Ne.getFile("TOKEN_KEY"),Env.TOKEN_TTL=Ne.getMs("TOKEN_TTL","1d"),Env.TOKEN_TTL_FORGOT=Ne.getMs("TOKEN_TTL_FORGOT","1d"),Env.TOKEN_TTL_RENEW=Ne.getMs("TOKEN_TTL_RENEW","1d"),Env.TOKEN_TYPE=Ne.getString("TOKEN_TYPE","bearer"),Env.API_BODYPARSER_STRICT=Ne.getBool("API_BODYPARSER_STRICT",!0),Env.API_BODYPARSER_INFLATE=Ne.getBool("API_BODYPARSER_INFLATE",!0),Env.API_BODYPARSER_LIMIT=Ne.getString("API_BODYPARSER_LIMIT","10mb"),Env.API_BODYPARSER_TYPE=Ne.getString("API_BODYPARSER_TYPE","json"),Env.API_HTTP_HYBRID=Ne.getBool("API_HTTP_HYBRID",!1),Env.API_HTTP_NOTFOUND=Ne.getString("API_HTTP_NOTFOUND",""),Env.API_HTTP_PATH=Ne.getString("API_HTTP_PATH","/api"),Env.API_HTTP_REDIRECT=Ne.getString("API_HTTP_REDIRECT",""),Env.API_SESSION_NAME=Ne.getString("API_SESSION_NAME","session.id"),Env.API_SESSION_LIFETIME=Ne.getMs("API_SESSION_LIFETIME","1d"),Env.API_SESSION_SECRET=Ne.getString("API_SESSION_SECRET","yoursecret"),Env.API_TOKEN_COOKIE=Ne.getString("API_TOKEN_COOKIE","authorization"),Env.API_TOKEN_COOKIE_SET=Ne.getBool("API_TOKEN_COOKIE_SET",!0),Env.API_USER_HISTORY=Ne.getBool("API_USER_HISTORY",!0),Env.API_WEBSOCKET_START=Ne.getBool("API_WEBSOCKET_START",!1);const ke=new ne({uri:Env.DATABASE_URI,logging:!!Env.DATABASE_LOG&&(e=>x.console(C.Magenta,"sql",e)),prefix:Env.DATABASE_PREFIX,timezone:Env.DATABASE_TIMEZONE});var Le,Fe,He,Ke,Be;!function(e){e.CREATE="CREATE",e.DELETE="DELETE",e.UPDATE="UPDATE"}(Le||(Le={})),function(e){e.SYSTEM="system",e.TENANT="tenant"}(Fe||(Fe={})),function(e){e.INFO="info",e.WARN="warn",e.ERROR="error"}(He||(He={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.SUSPENDED="suspended",e.DISABLED="disabled",e.ARCHIVED="archived"}(Ke||(Ke={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.DISABLED="disabled",e.LOCKED="locked",e.ARCHIVED="archived"}(Be||(Be={}));const qe=i=>r=>(n,o,s)=>{e(e=>De(void 0,void 0,void 0,function*(){var n;j(r)&&(r=D(e.controller.name)?e.controller.name():null===(n=e.controller.constructor)||void 0===n?void 0:n.name);const{permissions:o=[]}=e.req;if(o.includes(`${r}.${i}`))return e.next();e.error(new t("Access Denied"))}))(n,o,s)},Ue=qe("create"),Ve=qe("delete"),Ye=qe("read"),$e=qe("update"),Ge=(...i)=>(r,n,o)=>{e(e=>De(void 0,void 0,void 0,function*(){const{groups:r=[]}=e.req;if(N(i,r))return e.next();e.error(new t("Access Denied"))}))(r,n,o)},ze=(...i)=>(r,n,o)=>{e(e=>De(void 0,void 0,void 0,function*(){const{permissions:r}=e.req;if(N(i,null!=r?r:[]))return e.next();e.error(new t("Access Denied"))}))(r,n,o)},We=()=>(i,r,n)=>{e(e=>De(void 0,void 0,void 0,function*(){yield(e=>De(void 0,void 0,void 0,function*(){var i,r,n,o;if(e.req.auth&&e.req.user)return e.next();const{[Env.KEY_HEADER]:s,[Env.TOKEN_HEADER]:d,[Env.TENANT_HEADER]:a,"user-agent":l}=e.getHeaders(),u=e.getQuery(Env.KEY_HEADER),c=(null===(i=s||u)||void 0===i?void 0:i.toString())||"";let p=e.getCookie(Env.API_TOKEN_COOKIE);p=`${Env.TOKEN_TYPE} ${p}`;const[v,g]=null!==(n=null===(r=d||p)||void 0===r?void 0:r.split(" "))&&void 0!==n?n:["",""];if(!(c||g&&v.toLowerCase()==Env.TOKEN_TYPE))return e.error(new t("Invalid token"));const{authService:h,userService:y}=e.app,{auth:m,user:E}=null!==(o=yield(c?h.key(c.toString()):h.user(g)).catch(t=>{e.error(t)}))&&void 0!==o?o:{};if(!m||!E)return;if(!c&&m.user_agent&&m.user_agent!=l)return e.error(new t("Invalid token"));e.req.auth=m,e.req.user=E;const f=a||null,_=yield y.getTenants(E.id);if(f&&!_.find(e=>e.id==f))return e.error(new t("Invalid token"));const S=y.getGroups(E.id,f),O=y.getPermissions(E.id,f),[A,T]=yield Promise.all([S,O]);e.req.groups=A,e.req.permissions=T,e.req.tenants=_,e.next()}))(e)}))(i,r,n)},Je=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.auth}),Qe=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.groups)&&void 0!==r?r:[]).includes(t)}),Xe=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.groups)&&void 0!==i?i:[]}),Ze=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.permissions)&&void 0!==r?r:[]).includes(t)}),et=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.permissions)&&void 0!==i?i:[]}),tt=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.user}),it={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,ServerError:-32e3,InvalidSession:-32001};class McpError extends r{constructor(e,t=it.ServerError,i=200,r){super(e,i),this.code=t,this.data=r,this.name=this.constructor.name}}class McpParseError extends McpError{constructor(e="Parse error",t){super(e,it.ParseError,400,t)}}class McpInvalidRequestError extends McpError{constructor(e="Invalid Request",t){super(e,it.InvalidRequest,400,t)}}class McpMethodNotFoundError extends McpError{constructor(e){super(`Method not found: ${e}`,it.MethodNotFound,200)}}class McpInvalidParamsError extends McpError{constructor(e="Invalid params",t){super(e,it.InvalidParams,200,t)}}class McpInternalError extends McpError{constructor(e="Internal error",t){super(e,it.InternalError,200,t)}}class McpServerError extends McpError{constructor(e="Server error",t){super(e,it.ServerError,500,t)}}class McpInvalidSessionError extends McpError{constructor(e="Invalid MCP session",t=404){super(e,it.InvalidSession,t)}}class McpToolNotFoundError extends McpError{constructor(e){super("Tool not found",it.InvalidParams,200,{toolName:e})}}const rt=e=>L(e)||F(e),nt=(e,t)=>({jsonrpc:"2.0",id:e,result:t}),ot=(e,t)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t.code,message:t.message},void 0!==t.data?{data:t.data}:{})}),st=(e,t,i,r)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t,message:i},void 0!==r?{data:r}:{})}),dt=e=>{if(!k(e))throw new McpInvalidRequestError("Invalid Request");if("2.0"!==e.jsonrpc)throw new McpInvalidRequestError("Invalid JSON-RPC version");if(!L(e.method))throw new McpInvalidRequestError("Invalid method");if(void 0!==e.id&&!rt(e.id))throw new McpInvalidRequestError("Invalid id");return e},at=["2025-11-25","2025-06-18"],lt=at[0],ut="MCP-Protocol-Version",ct="MCP-Session-Id",pt=["POST","DELETE","OPTIONS"],vt=pt.join(", "),gt=e=>{if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode},ht=e=>{if(gt(e))return{status:400,body:ot(null,new McpParseError("Parse error",{message:e.message}))}};class McpHttpHandler{constructor(e){var t,i;this.sessions=e.sessions,this.tools=e.tools,this.logger=e.logger,this.serverName=null!==(t=e.serverName)&&void 0!==t?t:"andrewcaires-api-mcp",this.serverVersion=null!==(i=e.serverVersion)&&void 0!==i?i:"1.0.0"}post(e){return De(this,void 0,void 0,function*(){var t;let i=null;try{const r=dt(e.getBody());if(i=null!==(t=r.id)&&void 0!==t?t:null,"initialize"===r.method)return this.withTransportHeaders(this.initialize(r.id,r.params));if("notifications/initialized"===r.method)return this.withTransportHeaders(this.initialized(r.id,r.params,e));if("ping"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withSession(r.id,e,e=>({status:200,body:nt(e,{})})));if("tools/list"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withInitializedSession(r.id,e,e=>({status:200,body:nt(e,{tools:this.tools.list()})})));if("tools/call"===r.method)return this.withTransportHeaders(yield this.callTool(r.id,r.params,e));if(void 0===r.id)return this.withTransportHeaders({status:202});throw new McpMethodNotFoundError(r.method)}catch(e){return this.withTransportHeaders(this.errorResponse(i,e))}})}delete(e){const t=e.getHeader("mcp-session-id");if(!t)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError(`${ct} header is required`,400)));return this.sessions.get(t)?(this.sessions.delete(t),this.withTransportHeaders({status:204})):this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError))}initialize(e,t){const i=this.requireRequestId({jsonrpc:"2.0",id:e,method:"initialize",params:t}),r=this.negotiateProtocolVersion(t),n=this.sessions.create(r);return{status:200,headers:{[ct]:n.sessionId,[ut]:n.protocolVersion},body:nt(i,{protocolVersion:n.protocolVersion,capabilities:{tools:{listChanged:!1}},serverInfo:{name:this.serverName,version:this.serverVersion}})}}initialized(e,t,i){if(void 0!==e)throw new McpInvalidRequestError("notifications/initialized must not include id");this.validateObjectParams(t);const r=this.requireSession(i);return this.sessions.markInitialized(r.sessionId),{status:202}}callTool(e,t,i){return De(this,void 0,void 0,function*(){return this.withInitializedSession(e,i,(e,i)=>De(this,void 0,void 0,function*(){var r;const n=this.parseToolCallParams(t),o=Date.now();let s,d=!1;try{const t=yield this.tools.call(n.name,n.arguments,i);return d=!t.isError,s=t.isError?"Tool execution failed":void 0,{status:200,body:nt(e,t)}}catch(e){if(e instanceof McpError)throw s=e.message,e;throw s="Internal error",e}finally{null===(r=this.logger)||void 0===r||r.toolCall(Object.assign({sessionId:i.sessionId,toolName:n.name,durationMs:Date.now()-o,success:d},s?{error:s}:{}))}}))})}requireRequestId(e){if(!rt(e.id))throw new McpInvalidRequestError("Request id is required");return e.id}withSession(e,t,i){return i(this.requireRequestId({jsonrpc:"2.0",id:e,method:"session"}),this.requireSession(t))}withInitializedSession(e,t,i){return this.withSession(e,t,(e,t)=>{if(!t.initialized)throw new McpInvalidRequestError("Session not initialized");return i(e,t)})}requireSession(e){const t=e.getHeader("mcp-session-id");if(!t)throw new McpInvalidSessionError(`${ct} header is required`,400);return this.sessions.require(t)}negotiateProtocolVersion(e){if(!k(e)||!L(e.protocolVersion))throw new McpInvalidParamsError("params.protocolVersion is required");return at.includes(e.protocolVersion)?e.protocolVersion:lt}parseToolCallParams(e){if(!k(e)||!L(e.name))throw new McpInvalidParamsError("params.name is required");return{name:e.name,arguments:e.arguments}}validateObjectParams(e){if(void 0!==e&&!k(e))throw new McpInvalidParamsError("params must be an object")}withTransportHeaders(e){var t;return Object.assign(Object.assign({},e),{headers:Object.assign({Allow:vt,"Access-Control-Allow-Methods":vt,"Access-Control-Allow-Headers":`Content-Type, Accept, ${ct}, ${ut}`},null!==(t=e.headers)&&void 0!==t?t:{})})}errorResponse(e,t){if(t instanceof McpError)return{status:t.status,body:ot(e,t)};const i=new McpServerError;return{status:i.status,body:ot(e,i)}}}class McpSessionStore{constructor(e=18e5,t=()=>Date.now()){this.sessions=new Map,this.ttl=e,this.now=t}create(e){this.cleanup();const t=this.now(),i={sessionId:H(),createdAt:t,expiresAt:t+this.ttl,protocolVersion:e,initialized:!1};return this.sessions.set(i.sessionId,i),i}get(e){this.cleanup();const t=this.sessions.get(e);if(t){if(!this.isExpired(t))return t;this.sessions.delete(e)}}require(e){const t=this.get(e);if(!t)throw new McpInvalidSessionError;return t}markInitialized(e){const t=this.require(e);return t.initialized=!0,t}delete(e){return this.cleanup(),this.sessions.delete(e)}cleanup(){const e=this.now();for(const[t,i]of this.sessions)i.expiresAt<=e&&this.sessions.delete(t)}size(){return this.cleanup(),this.sessions.size}isExpired(e){return e.expiresAt<=this.now()}}const yt=Symbol.for("@andrewcaires/api:mcp:tool"),mt=e=>{if(!L(e.name)||!e.name.trim())throw new Error("MCP tool name is required");if(!L(e.title)||!e.title.trim())throw new Error(`MCP tool "${e.name}" title is required`);if(!L(e.description)||!e.description.trim())throw new Error(`MCP tool "${e.name}" description is required`);if(j(e.input))throw new Error(`MCP tool "${e.name}" input must be declared`)};class McpToolRegistry{constructor(e=[]){this.tools=new Map,e.forEach(e=>this.register(e))}register(e){var t,i;if(mt(e),this.tools.has(e.name))throw new Error(`Duplicate MCP tool name: ${e.name}`);const r=this.normalizeMcpValidation(null!==(t=e.input)&&void 0!==t?t:{},"object"),n=e.output?this.normalizeMcpValidation(null!==(i=e.output)&&void 0!==i?i:{},"any"):void 0;this.tools.set(e.name,{inputSchema:r.schema,inputValidation:r.validation,outputSchema:null==n?void 0:n.schema,outputValidation:null==n?void 0:n.validation,tool:e})}list(){return Array.from(this.tools.values()).map(({tool:e})=>{var t,i,r,n;return Object.assign({name:e.name,title:e.title,description:e.description,inputSchema:null!==(i=null===(t=this.tools.get(e.name))||void 0===t?void 0:t.inputSchema)&&void 0!==i?i:{}},(null===(r=this.tools.get(e.name))||void 0===r?void 0:r.outputSchema)?{outputSchema:null===(n=this.tools.get(e.name))||void 0===n?void 0:n.outputSchema}:{})})}call(e,t,i){return De(this,void 0,void 0,function*(){var r;const n=this.tools.get(e);if(!n)throw new McpToolNotFoundError(e);const o=null!=t?t:{};if(!k(o))return this.toolInputValidationError(["arguments must be an object"]);const s={session:i};let d=o;const a=this.validateAdditionalProperties(n.inputSchema,o);if(a.length)return this.toolInputValidationError(a);if(n.inputValidation){const e=n.inputValidation.validate(o,s);if(e.error)return this.toolInputValidationError([e.error]);d=null!==(r=e.value)&&void 0!==r?r:{}}try{const e=yield n.tool.run(d,s);if(!n.outputValidation&&this.isCallToolResult(e))return e;let t=e;if(n.outputValidation){const i=n.outputValidation.validate(e,s);if(i.error)return this.outputValidationError();t=i.value}return{content:[{type:"text",text:JSON.stringify(t)}],structuredContent:t}}catch(e){return{isError:!0,content:[{type:"text",text:"Tool execution failed."}]}}})}isCallToolResult(e){return k(e)&&K(e.content)}normalizeMcpValidation(e,t="object"){if(B(e)){const t=q.object(e).parse();return{schema:t.toSchema(),validation:t}}const i="object"===t?q.object({}).parse():q.any();return{schema:i.toSchema(),validation:i}}outputValidationError(){return{isError:!0,content:[{type:"text",text:"Tool output validation failed."}]}}toolInputValidationError(e){return{isError:!0,content:[{type:"text",text:"Invalid tool arguments."}],structuredContent:{errors:e}}}validateAdditionalProperties(e,t){if("object"!==e.type||!1!==e.additionalProperties||!k(e.properties))return[];const i=Object.keys(e.properties);return Object.keys(t).filter(e=>!i.includes(e)).map(e=>`additional property "${e}" is not allowed`)}}const Et=e=>(mt(e),(t,i)=>{ft(i)?i.addInitializer(function(){_t(this.constructor,i.name,e)}):_t(t,i,e)}),ft=e=>"object"==typeof e&&null!==e&&"kind"in e&&"method"===e.kind&&"name"in e&&"addInitializer"in e,_t=(e,t,i)=>{const r=me(yt,e,[]),n=Object.assign(Object.assign({},i),{propertyKey:t});r.some(e=>e.propertyKey===n.propertyKey&&e.name===n.name)||r.push(n)},St=(e,t,i)=>{var r,o,s,d,a,l,u,c,p,v,g;const h=i.ctx instanceof n?i.ctx:null,y=null!==(r=null==h?void 0:h.id)&&void 0!==r?r:null,m=null!==(a=null!==(d=null===(s=null===(o=null==h?void 0:h.req)||void 0===o?void 0:o.user)||void 0===s?void 0:s.id)&&void 0!==d?d:i.user_id)&&void 0!==a?a:null,E={type:e,model:null!==(l=null==t?void 0:t.getTableName())&&void 0!==l?l:null,source:null!==(u=Env.BASE_NAME)&&void 0!==u?u:"",request_id:y,user_id:m};return h?Object.assign(Object.assign({},E),{full_url:null!==(c=h.getUrl())&&void 0!==c?c:"",ip_address:null!==(p=h.getIp())&&void 0!==p?p:"",user_agent:null!==(g=null===(v=h.req)||void 0===v?void 0:v.headers["user-agent"])&&void 0!==g?g:""}):E},Ot=e=>{const t=U(e),i=t.primaryKeyAttribute;return{model:t,record_id:i?e.getDataValue(i):null}},At={afterCreate:(e,t)=>De(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ot(e);yield Nt.create(Object.assign(Object.assign({},St(Le.CREATE,i,t)),{record:r,currently:e.toJSON()})).catch(x.catch)}),afterUpdate:(e,t)=>De(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ot(e),n={},o={},s=e.changed();s&&s.length&&s.forEach(t=>{n[t]=e.getDataValue(t),o[t]=e.previous(t)}),yield Nt.create(Object.assign(Object.assign({},St(Le.UPDATE,i,t)),{record:r,currently:n,previously:o})).catch(x.catch)}),afterDestroy:(e,t)=>De(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ot(e);yield Nt.create(Object.assign(Object.assign({},St(Le.DELETE,i,t)),{record:r,currently:e.toJSON()})).catch(x.catch)})},Tt=e=>(j(e)&&(e=Env.DATABASE_AUDIT),oe(e?At:{}));let bt=class RegisterModel extends ce{};Me([se.Id(7),je("design:type",String)],bt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],bt.prototype,"secret",void 0),Me([se.FullDate(),je("design:type",Number)],bt.prototype,"expired_at",void 0),Me([se.Boolean(),je("design:type",Boolean)],bt.prototype,"active",void 0),Me([se.CreatedAt(),je("design:type",Date)],bt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],bt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],bt.prototype,"deleted_at",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],bt.prototype,"user_id",void 0),bt=Me([ae(ke),le("register"),ue("5.3.5")],bt);let Pt=class UserAuthModel extends ce{};Me([se.Id(7),je("design:type",String)],Pt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],Pt.prototype,"secret",void 0),Me([se.String(),je("design:type",String)],Pt.prototype,"ip_address",void 0),Me([se.String(),je("design:type",String)],Pt.prototype,"user_agent",void 0),Me([se.FullDate(),je("design:type",Object)],Pt.prototype,"revoked_at",void 0),Me([se.CreatedAt(),je("design:type",Date)],Pt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Pt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],Pt.prototype,"deleted_at",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],Pt.prototype,"user_id",void 0),Pt=Me([ae(ke),le("users_auth"),ue("5.3.5")],Pt);let wt=class PermissionModel extends ce{};Me([se.Id(7),je("design:type",String)],wt.prototype,"id",void 0),Me([se.String(),pe(),je("design:type",String)],wt.prototype,"name",void 0),Me([se.Text(),je("design:type",String)],wt.prototype,"description",void 0),Me([se.Boolean(),je("design:type",Boolean)],wt.prototype,"active",void 0),Me([se.Json(),ve(()=>({})),je("design:type",Object)],wt.prototype,"metadata",void 0),Me([se.CreatedAt(),je("design:type",Date)],wt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],wt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],wt.prototype,"deleted_at",void 0),Me([de.HasMany(()=>It),je("design:type",Array)],wt.prototype,"groups_permissions",void 0),wt=Me([ae(ke),le("permission"),Tt(),ue("5.3.5")],wt);let It=class GroupPermissionModel extends ce{};Me([se.Id(7),je("design:type",String)],It.prototype,"id",void 0),Me([se.CreatedAt(),je("design:type",Date)],It.prototype,"created_at",void 0),Me([de.BelongsTo(()=>xt),je("design:type",String)],It.prototype,"group_id",void 0),Me([de.BelongsTo(()=>wt),je("design:type",String)],It.prototype,"permission_id",void 0),It=Me([ae(ke),le("groups_permissions"),Tt(),ue("5.3.5")],It);let xt=class GroupModel extends ce{};Me([se.Id(7),je("design:type",String)],xt.prototype,"id",void 0),Me([se.String(),pe(),je("design:type",String)],xt.prototype,"name",void 0),Me([se.Text(),je("design:type",String)],xt.prototype,"description",void 0),Me([se.Enum(Fe),ve(Fe.SYSTEM),je("design:type",String)],xt.prototype,"type",void 0),Me([se.Boolean(),je("design:type",Boolean)],xt.prototype,"active",void 0),Me([se.Json(),ve(()=>({})),je("design:type",Object)],xt.prototype,"metadata",void 0),Me([se.CreatedAt(),je("design:type",Date)],xt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],xt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],xt.prototype,"deleted_at",void 0),Me([de.HasMany(()=>Rt),je("design:type",Array)],xt.prototype,"users_groups",void 0),Me([de.HasMany(()=>It),je("design:type",Array)],xt.prototype,"groups_permissions",void 0),xt=Me([ae(ke),le("group"),Tt(),ue("5.3.5")],xt);let Ct=class UserTenantModel extends ce{};Me([se.Id(7),je("design:type",String)],Ct.prototype,"id",void 0),Me([se.CreatedAt(),je("design:type",Date)],Ct.prototype,"created_at",void 0),Me([de.BelongsTo(()=>Mt),je("design:type",String)],Ct.prototype,"tenant_id",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],Ct.prototype,"user_id",void 0),Ct=Me([ae(ke),le("users_tenants"),Tt(),ue("5.3.5")],Ct);let Mt=class TenantModel extends ce{};Me([se.Id(7),je("design:type",String)],Mt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],Mt.prototype,"name",void 0),Me([se.Text(),je("design:type",String)],Mt.prototype,"description",void 0),Me([se.Enum(Ke),ve(Ke.ACTIVE),je("design:type",String)],Mt.prototype,"status",void 0),Me([se.Json(),ve(()=>({})),je("design:type",Object)],Mt.prototype,"metadata",void 0),Me([se.CreatedAt(),je("design:type",Date)],Mt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Mt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],Mt.prototype,"deleted_at",void 0),Me([de.HasMany(()=>Ct),je("design:type",Array)],Mt.prototype,"users_tenants",void 0),Mt=Me([ae(ke),le("tenant"),Tt(),ue("5.3.5")],Mt);let Rt=class UserGroupModel extends ce{};Me([se.Id(7),je("design:type",String)],Rt.prototype,"id",void 0),Me([se.CreatedAt(),je("design:type",Date)],Rt.prototype,"created_at",void 0),Me([de.BelongsTo(()=>xt),je("design:type",String)],Rt.prototype,"group_id",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],Rt.prototype,"user_id",void 0),Me([de.BelongsTo(()=>Mt),je("design:type",String)],Rt.prototype,"tenant_id",void 0),Rt=Me([ae(ke),le("users_groups"),Tt(),ue("5.3.5")],Rt);let jt=class UserPasswordModel extends ce{};Me([se.Id(7),je("design:type",String)],jt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],jt.prototype,"hash",void 0),Me([se.FullDate(),je("design:type",Object)],jt.prototype,"revoked_at",void 0),Me([se.CreatedAt(),je("design:type",Date)],jt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],jt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],jt.prototype,"deleted_at",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],jt.prototype,"user_id",void 0),jt=Me([ae(ke),le("users_password"),Tt(),ue("5.3.5")],jt);let Dt=class UserModel extends ce{};Me([se.Id(7),je("design:type",String)],Dt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],Dt.prototype,"name",void 0),Me([se.String(),je("design:type",String)],Dt.prototype,"username",void 0),Me([se.String(),je("design:type",String)],Dt.prototype,"email",void 0),Me([se.Text(),je("design:type",String)],Dt.prototype,"notes",void 0),Me([se.Enum(Be),ve(Be.ACTIVE),je("design:type",String)],Dt.prototype,"status",void 0),Me([se.Json(),ve(()=>({})),je("design:type",Object)],Dt.prototype,"metadata",void 0),Me([se.CreatedAt(),je("design:type",Date)],Dt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Dt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],Dt.prototype,"deleted_at",void 0),Me([de.HasMany(()=>Nt),je("design:type",Array)],Dt.prototype,"audits",void 0),Me([de.HasMany(()=>Pt),je("design:type",Array)],Dt.prototype,"users_auths",void 0),Me([de.HasMany(()=>bt),je("design:type",Array)],Dt.prototype,"registers",void 0),Me([de.HasMany(()=>Rt),je("design:type",Array)],Dt.prototype,"users_groups",void 0),Me([de.HasMany(()=>jt),je("design:type",Array)],Dt.prototype,"users_passwords",void 0),Me([de.HasMany(()=>Ct),je("design:type",Array)],Dt.prototype,"users_tenants",void 0),Dt=Me([ae(ke),le("user"),Tt(),ue("5.3.5")],Dt);let Nt=class AuditModel extends ce{};Me([se.Id(7),je("design:type",String)],Nt.prototype,"id",void 0),Me([se.Enum(Le),je("design:type",String)],Nt.prototype,"type",void 0),Me([se.String(),je("design:type",String)],Nt.prototype,"model",void 0),Me([se.String(),je("design:type",String)],Nt.prototype,"record",void 0),Me([se.Json(),je("design:type",Object)],Nt.prototype,"currently",void 0),Me([se.Json(),je("design:type",Object)],Nt.prototype,"previously",void 0),Me([se.String(36),je("design:type",String)],Nt.prototype,"request_id",void 0),Me([se.Text(),je("design:type",String)],Nt.prototype,"full_url",void 0),Me([se.String(),je("design:type",String)],Nt.prototype,"ip_address",void 0),Me([se.Text(),je("design:type",String)],Nt.prototype,"user_agent",void 0),Me([se.String(),je("design:type",String)],Nt.prototype,"source",void 0),Me([se.FullDate(),je("design:type",Object)],Nt.prototype,"reverted_at",void 0),Me([se.CreatedAt(),je("design:type",Date)],Nt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Nt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],Nt.prototype,"deleted_at",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],Nt.prototype,"user_id",void 0),Nt=Me([ae(ke),le("audit"),ue("5.3.5")],Nt);let kt=class ConfigModel extends ce{};Me([se.Id(7),je("design:type",String)],kt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],kt.prototype,"key",void 0),Me([se.Text(),je("design:type",String)],kt.prototype,"value",void 0),Me([se.CreatedAt(),je("design:type",Date)],kt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],kt.prototype,"updated_at",void 0),kt=Me([ae(ke),le("configs"),ue("5.3.5")],kt);let Lt=class ForgotModel extends ce{};Me([se.Id(7),je("design:type",String)],Lt.prototype,"id",void 0),Me([se.String(),je("design:type",String)],Lt.prototype,"secret",void 0),Me([se.FullDate(),je("design:type",Number)],Lt.prototype,"expired_at",void 0),Me([se.Boolean(),je("design:type",Boolean)],Lt.prototype,"active",void 0),Me([se.CreatedAt(),je("design:type",Date)],Lt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Lt.prototype,"updated_at",void 0),Me([se.DeletedAt(),je("design:type",Object)],Lt.prototype,"deleted_at",void 0),Me([de.BelongsTo(()=>Dt),je("design:type",String)],Lt.prototype,"user_id",void 0),Lt=Me([ae(ke),le("forgot"),ue("5.3.5")],Lt);let Ft=class LogModel extends ce{};Me([se.Id(7),je("design:type",String)],Ft.prototype,"id",void 0),Me([se.Enum(He),ve(He.INFO),je("design:type",String)],Ft.prototype,"level",void 0),Me([se.Text(),je("design:type",String)],Ft.prototype,"message",void 0),Me([se.String(),je("design:type",String)],Ft.prototype,"source",void 0),Me([se.CreatedAt(),je("design:type",Date)],Ft.prototype,"created_at",void 0),Ft=Me([ae(ke),le("log"),ue("5.3.5")],Ft);let Ht=class MigrationModel extends ce{};Me([se.Id(7),je("design:type",String)],Ht.prototype,"id",void 0),Me([se.String(),je("design:type",String)],Ht.prototype,"model",void 0),Me([se.String(),je("design:type",String)],Ht.prototype,"version",void 0),Me([se.CreatedAt(),je("design:type",Date)],Ht.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Ht.prototype,"updated_at",void 0),Ht=Me([ae(ke),le("migration"),ue("5.3.5")],Ht);let Kt=class SessionModel extends ce{};Me([se.Id(7),je("design:type",String)],Kt.prototype,"id",void 0),Me([se.Json(),je("design:type",Object)],Kt.prototype,"data",void 0),Me([se.FullDate(),je("design:type",Date)],Kt.prototype,"expired_at",void 0),Me([se.CreatedAt(),je("design:type",Date)],Kt.prototype,"created_at",void 0),Me([se.UpdatedAt(),je("design:type",Date)],Kt.prototype,"updated_at",void 0),Kt=Me([ae(ke),le("session"),ue("5.3.5")],Kt);class Log{static error(e,t,i){return De(this,void 0,void 0,function*(){yield this.writeRaw("error",e,t,i)})}static info(e,t,i){return De(this,void 0,void 0,function*(){yield this.writeRaw("info",e,t,i)})}static warn(e,t,i){return De(this,void 0,void 0,function*(){yield this.writeRaw("warn",e,t,i)})}static writeRaw(e,t,i,r){return De(this,void 0,void 0,function*(){var n;r&&x.console(null!==(n=this.colors[e])&&void 0!==n?n:C.White,e,t),ke&&(yield Ft.create({level:e,message:t,source:null!=i?i:""}).catch(x.catch))})}}Log.colors={error:C.Red,info:C.Cyan,warn:C.Yellow};class Loggable{get log(){return e=>Loggable.logInfo(this,e)}static get log(){return e=>this.logInfo(this,e)}get error(){return e=>Loggable.logError(this,e)}static get error(){return e=>this.logError(this,e)}static logError(e,t){var i,r;Log.error(null!==(r=null!==(i=null==t?void 0:t.message)&&void 0!==i?i:t)&&void 0!==r?r:"",this.source(e),Env.CONSOLE_ERROR)}static logInfo(e,t){Log.info(null!=t?t:"",this.source(e),Env.CONSOLE_ERROR)}static source(e){var t,i,r;const n=null!==(r=null!==(i=null===(t=null==e?void 0:e.constructor)||void 0===t?void 0:t.name)&&void 0!==i?i:null==e?void 0:e.name)&&void 0!==r?r:"null";return Env.BASE_NAME?`${Env.BASE_NAME}.${n}`:n}}class Config extends Loggable{static all(e){return De(this,void 0,void 0,function*(){var t;const i=null!==(t=yield kt.findAll({where:(null==e?void 0:e.length)?{key:{[ge.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[];return Object.fromEntries(i.map(e=>[e.key,e.value]))})}static del(e){return De(this,void 0,void 0,function*(){return((yield kt.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return De(this,arguments,void 0,function*(e,t=""){const[i]=(yield kt.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];return i?i.value:t})}static set(e,t){return De(this,void 0,void 0,function*(){const[i,r]=(yield kt.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];i&&!r&&(i.value=t,yield i.save().catch(this.error))})}}class SessionStore extends _e{constructor(){super(),this.all=e=>De(this,void 0,void 0,function*(){e=e||V;const t=yield Kt.findAll({attributes:["id","expired_at"],where:{expired_at:{[ge.gte]:new Date}}}).catch(t=>(e(t),null));t&&e(null,t.map(e=>e.id)),e()}),this.clear=e=>De(this,void 0,void 0,function*(){yield Kt.destroy().catch(x.catch),e&&e()}),this.destroy=(e,t)=>De(this,void 0,void 0,function*(){yield Kt.destroy({where:{id:e}}).catch(x.catch),t&&t()}),this.expired=()=>De(this,void 0,void 0,function*(){yield Kt.destroy({where:{expired_at:{[ge.lt]:new Date}}}).catch(x.catch)}),this.get=(e,t)=>De(this,void 0,void 0,function*(){t=t||V;const i=yield Kt.findOne({where:{id:e,expired_at:{[ge.gte]:new Date}}}).catch(e=>(t(e),null));if(i){if(i.data.cookie){if(new Date(i.data.cookie.expires).getTime()<=Date.now())return yield i.destroy().catch(x.catch),void t(null)}t(null,i.data)}else t(null)}),this.length=e=>De(this,void 0,void 0,function*(){e&&e(null,(yield Kt.count().catch(x.catch))||0)}),this.set=(e,t,i)=>De(this,void 0,void 0,function*(){i=i||V;const r=new Date;r.setTime(r.getTime()+Env.API_SESSION_LIFETIME);const[n,o]=(yield Kt.findOrCreate({where:{id:e},defaults:{id:e,data:t,expired_at:r}}).catch(x.catch))||[];n?(o||(n.data=t,n.expired_at=r,yield n.save().catch(x.catch)),i()):i()}),setInterval(this.expired,6e4)}}let Bt=class Service{};Bt=Me([Ee(Loggable)],Bt);let qt=class AuthService extends Bt{constructor(){super(...arguments),this.userAttributes={exclude:["username","notes","deleted_at"]}}create(e){return De(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new o("TOKEN_KEY not found");const{id:t}=e,i=H(),r=yield Pt.create({secret:i,user_id:t}).catch(this.error);if(!r)throw new s;return{auth:r,token:Se.sign({id:t,secret:i},Env.TOKEN_KEY,this.options())}})}destroy(e){return De(this,void 0,void 0,function*(){return!(!e||e.revoked_at)&&(e.revoked_at=new Date,yield e.save(),!0)})}renew(e){return De(this,void 0,void 0,function*(){if(!Env.TOKEN_KEY)throw new o("TOKEN_KEY not found");const{decode:i}=yield this.verify(e,Env.TOKEN_TTL_RENEW/1e3);if(!i)throw new t("Invalid token");const{id:r,secret:n}=i;if(r&&n){const e=yield Dt.findOne({where:{id:r,status:Be.ACTIVE}}).catch(this.error);if(e){const t=yield Pt.findOne({where:{secret:n,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at){t.secret=H(),yield t.save().catch(this.error);return{auth:t,token:Se.sign({id:r,secret:t.secret},Env.TOKEN_KEY,this.options())}}}}throw new t("Invalid token")})}user(e){return De(this,void 0,void 0,function*(){const{decode:i}=yield this.verify(e);if(!i)throw new t("Invalid token");const{id:r,secret:n}=i;if(r&&n){const e=yield Dt.findOne({attributes:this.userAttributes,where:{id:r,status:Be.ACTIVE}}).catch(this.error);if(e){const t=yield Pt.findOne({where:{secret:n,user_id:e.id}}).catch(this.error);if(t&&!t.revoked_at)return{auth:t,user:e}}}throw new t("Invalid token")})}options(){return{algorithm:"RS256",expiresIn:`${Env.TOKEN_TTL}ms`}}verify(e,i){return De(this,void 0,void 0,function*(){if(!Env.TOKEN_CRT)throw new o("TOKEN_CRT not found");if(!e||e.split(".").length<3)throw new t("Invalid token");try{return{decode:Se.verify(e,Env.TOKEN_CRT,{clockTolerance:i})}}catch(e){throw new t("Invalid token")}})}key(e){return De(this,void 0,void 0,function*(){if(!e)throw new t("Invalid token");const i=yield Dt.findOne({attributes:this.userAttributes,where:{token:e,status:Be.ACTIVE}}).catch(this.error);if(i){const t=e.replace(/(-[\w]{4})/g,"-****"),[r]=(yield Pt.findOrCreate({where:{secret:t,user_id:i.id},defaults:{secret:t,user_id:i.id}}).catch(this.error))||[];if(r)return r.revoked_at&&(r.revoked_at=null,yield r.save().catch(this.error)),{auth:r,user:i}}throw new t("Invalid token")})}};qt=Me([fe()],qt);class ModelService extends Bt{constructor(e,t){var i,r;super(),this.attributes=[],this.permissions=[],this.search=[],this.model=e,(null==t?void 0:t.permissions)&&(this.permissions=t.permissions);const n=Object.keys(e.getAttributes());this.attributes=this.filterAttributes(n,null!==(i=null==t?void 0:t.attributes)&&void 0!==i?i:[]),this.search=this.filterAttributes(n,null!==(r=null==t?void 0:t.search)&&void 0!==r?r:this.attributes)}applySelect(e,t,i){if(!t)return;const r=null==e?void 0:e.getQuery(i?`${i}_select`:"select"),n=t.attributes,o=e=>n.includes(e);t.attributes=[],L(r)&&r.length&&t.attributes.push(...r.split(/\s*,\s*/g).filter(o)),t.attributes.length||(t.attributes=n)}applyOrders(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("asc"),r=null==e?void 0:e.getQuery("desc"),n=[],o=t.attributes,s=e=>o.includes(e);L(i)&&i.length&&n.push(...i.split(/\s*,\s*/g).filter(s).map(e=>[e,"ASC"])),L(r)&&r.length&&n.push(...r.split(/\s*,\s*/g).filter(s).map(e=>[e,"DESC"])),n.length&&(t.order=n)}applyPagination(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("limit"),r=null==e?void 0:e.getQuery("offset");j(t.limit)&&(t.limit=Env.MODEL_LIMIT,L(i)&&(t.limit=parseInt(i)||0),t.limit=Y(t.limit,-1,Env.MODEL_LIMIT_MAX)),t.limit<0&&(t.limit=void 0),L(r)&&(t.offset=parseInt(r)||0,t.offset<0&&(t.offset=void 0))}applySearch(e,t){var i;if(!t)return;const r=null==e?void 0:e.getQuery("search");r&&L(r)&&(t.where=Object.assign(Object.assign({},null!==(i=t.where)&&void 0!==i?i:{}),{[ge.or]:this.search.map(e=>({[e]:{[ge.substring]:r}}))}))}applyWhere(e,t,i){var r,n;if(!t)return null;const o=null==e?void 0:e.getQuery(i?`${i}_where`:"where");if(!L(o))return null;const s=t.attributes,a=he.parse(s,o);return j(a.error)?(t.where=Object.assign(Object.assign({},null!==(r=t.where)&&void 0!==r?r:{}),null!==(n=a.value)&&void 0!==n?n:{}),null):new d(a.error.join(", "))}countAll(e){return De(this,void 0,void 0,function*(){var t,i;const{ctx:r,options:n={}}=e,o=$({},n);o.attributes=this.getAttributes(null!==(t=null==o?void 0:o.attributes)&&void 0!==t?t:[]),this.applySearch(r,o);const s=this.applyWhere(r,o);if(s)return null==r||r.error(s),0;this.applySelect(r,o);const d=null!==(i=yield this.model.count(Object.assign(Object.assign({},o),{distinct:!!o.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error))&&void 0!==i?i:0;return null==r||r.prepare(a.OK,{count:d}),d})}create(e){return De(this,void 0,void 0,function*(){var t,i;const{body:r={},ctx:n,options:o={}}=e,d=$({},o),l=yield this.model.create(Object.assign({},$({},null!==(i=null===(t=null==n?void 0:n.req)||void 0===t?void 0:t.body)&&void 0!==i?i:{},r)),Object.assign(Object.assign({},d),{ctx:n})).catch(this.error);if(!l)return null==n||n.error(new s),null;const{primaryKeyAttribute:u}=this.model;return null==n||n.prepare(a.OK,{[u]:l.getDataValue(u)}),l})}delete(e){return De(this,void 0,void 0,function*(){var t,i;const{ctx:r,id:n,options:s={}}=e,{primaryKeyAttribute:d}=this.model,a=null!==(t=null==r?void 0:r.getParam(d))&&void 0!==t?t:n;if(j(a))return null==r||r.error(new l),0;const u=$({},s),c=yield this.model.destroy(Object.assign(Object.assign(Object.assign({},u),{where:{[ge.and]:Object.assign({[d]:a},null!==(i=null==u?void 0:u.where)&&void 0!==i?i:{})},individualHooks:!0}),{ctx:r})).catch(this.error);return c?(null==r||r.success("OK"),c):(null==r||r.error(new o),0)})}filterAttributes(e,t){if(K(t))return t.length?t.filter(t=>L(t)&&e.includes(t)):e;const{exclude:i,include:r}=t,n=j(r)?e:r.filter(t=>L(t)&&e.includes(t)),o=null!=i?i:[];return o.length?n.filter(e=>!o.includes(e)):n}findAll(e){return De(this,void 0,void 0,function*(){var t,i;const{ctx:r,callback:n,options:o={},query:s=!0}=e,d=$({},o);if(d.attributes=this.getAttributes(null!==(t=null==d?void 0:d.attributes)&&void 0!==t?t:[]),s&&this.applySelect(r,d),this.applyOrders(r,d),this.applyPagination(r,d),(null!==(i=null==d?void 0:d.limit)&&void 0!==i?i:0)>Env.MODEL_LIMIT_MAX&&(d.limit=Env.MODEL_LIMIT_MAX),this.applySearch(r,d),s){const e=this.applyWhere(r,d);if(e)return null==r||r.error(e),{count:0,records:[]}}const[l,u]=yield Promise.all([this.model.count(Object.assign(Object.assign({},d),{distinct:!!d.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error).then(e=>null!=e?e:0),this.model.findAll(d).catch(this.error).then(e=>null!=e?e:[])]),c={count:l,records:n?yield n(u):u};return null==r||r.prepare(a.OK,c),c})}findOne(e){return De(this,void 0,void 0,function*(){var t,i,r;const{callback:n,ctx:s,id:d,options:u={},query:c=!0}=e,{primaryKeyAttribute:p}=this.model,v=null!==(t=null==s?void 0:s.getParam(p))&&void 0!==t?t:d;if(j(v))return null==s||s.error(new l),null;const g=$({},u);g.attributes=this.getAttributes(null!==(i=null==g?void 0:g.attributes)&&void 0!==i?i:[]),c&&this.applySelect(s,g);const h=yield this.model.findOne(Object.assign(Object.assign({},g),{where:{[ge.and]:Object.assign({[p]:v},null!==(r=null==g?void 0:g.where)&&void 0!==r?r:{})}})).catch(this.error);return h?(null==s||s.prepare(a.OK,n?yield n(h):h.toJSON()),h):(null==s||s.error(new o),null)})}getAttributes(e){return this.filterAttributes(this.attributes,e)}include(e,t){var i;const r=G(t),{ctx:n}=null!=t?t:{};r.attributes=this.filterAttributes(Object.keys(e.getAttributes()),null!==(i=r.attributes)&&void 0!==i?i:[]),this.applySearch(n,r);const o=this.applyWhere(n,r,t.name);return o?(null==n||n.error(o),null):(this.applySelect(n,r,t.name),Object.assign({model:e},r))}name(){return this.model.tableName}sync(){return De(this,void 0,void 0,function*(){if(!this.permissions.length)return;const e=this.name().toLowerCase(),t={description:"",active:!0};yield z(this.permissions,i=>De(this,void 0,void 0,function*(){const r=`${e}.${i}`,n=W(e.replace(/_/g," ")," ");yield wt.findOrCreate({where:{key:r},defaults:Object.assign({name:`${n} ${W(i," ")}`,key:r,tags:n},t)})}))})}update(e){return De(this,void 0,void 0,function*(){var t,i,r,n;const{ctx:s,body:d,id:a,options:u={}}=e,{primaryKeyAttribute:c}=this.model,p=null!==(t=null==s?void 0:s.getParam(c))&&void 0!==t?t:a;if(j(p))return null==s||s.error(new l),!1;const v=$({},u),g=$({},null!==(r=null===(i=null==s?void 0:s.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{},null!=d?d:{}),h=yield this.model.findOne(Object.assign(Object.assign({},v),{attributes:this.getAttributes([c,...Object.keys(g)]),where:{[ge.and]:Object.assign({[c]:p},null!==(n=null==v?void 0:v.where)&&void 0!==n?n:{})}})).catch(this.error);return h?(h.set(g),h.changed()?(null==s||s.success("OK"),yield h.save(Object.assign({},{ctx:s})).catch(this.error),!0):(null==s||s.success("Record not changed"),!1)):(null==s||s.error(new o),!1)})}}let Ut=class UserService extends Bt{constructor(){super(...arguments),this.hashOptions={algorithm:Env.PASSWORD_ALGORITHM,memoryCost:Env.PASSWORD_MEMORY_COST,parallelism:Env.PASSWORD_PARALLELISM,timeCost:Env.PASSWORD_TIME_COST}}createPassword(e,t,i){return De(this,void 0,void 0,function*(){yield jt.update({revoked_at:new Date},{where:{revoked_at:null,user_id:e}}).catch(this.error);const r=Oe(t+Env.PASSWORD_PEPPER,this.hashOptions);yield jt.create({hash:r,user_id:e},Object.assign({},{ctx:i})).catch(this.error)})}getGroups(e,t){return De(this,void 0,void 0,function*(){var i;return J((null!==(i=yield xt.findAll({attributes:["name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||Q(t)?{tenant_id:t}:{})}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name))})}getPermissions(e,t){return De(this,void 0,void 0,function*(){var i;return(null!==(i=yield wt.findAll({attributes:["name"],where:{active:!0},include:[{association:"groups_permissions",required:!0,include:[{association:"group",required:!0,attributes:["id","name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||Q(t)?{tenant_id:t}:{})}]}]}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name)})}getTenants(e){return De(this,void 0,void 0,function*(){var t;return(null!==(t=yield Mt.findAll({attributes:["id","name"],where:{status:Ke.ACTIVE},include:[{association:"users_tenants",required:!0,where:{user_id:e}}]}).catch(this.error))&&void 0!==t?t:[]).map(e=>({id:e.id,name:e.name}))})}};Ut=Me([fe()],Ut);class Application extends u{constructor(e,t){super(e,$({},{cross:!!Env.HTTP_CROSS&&("*"===Env.HTTP_CROSS||{origin:Env.HTTP_CROSS.split(",")}),hybrid:Env.API_HTTP_HYBRID,json:{strict:Env.API_BODYPARSER_STRICT,inflate:Env.API_BODYPARSER_INFLATE,limit:Env.API_BODYPARSER_LIMIT,type:Env.API_BODYPARSER_TYPE},notfound:Env.API_HTTP_NOTFOUND,path:Env.API_HTTP_PATH,port:Env.HTTP_PORT,public:Env.HTTP_PUBLIC,redirect:Env.API_HTTP_REDIRECT,session:{store:new SessionStore,name:Env.API_SESSION_NAME,secret:Env.API_SESSION_SECRET,cookie:{maxAge:Env.API_SESSION_LIFETIME},genid:H},tls:{ca:Env.HTTP_TLS_CA,cert:Env.HTTP_TLS_CRT,key:Env.HTTP_TLS_KEY}},null!=t?t:{})),this.encryptor=new M(Env.ENCRYPTION_SECRET)}error(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.error(e.message,t,Env.CONSOLE_ERROR)}log(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.info(e,t,!0)}listen(){const e=Object.create(null,{listen:{get:()=>super.listen}});return De(this,void 0,void 0,function*(){yield ke.sync(),yield this.migrations(ke),yield X(this.controllers,e=>De(this,void 0,void 0,function*(){D(e.sync)&&(yield e.sync(this))})),this.authService=new qt,this.userService=new Ut,yield e.listen.call(this),Env.API_WEBSOCKET_START&&this.server&&(this._webSocket=new re({server:this.server,verifyClient:(e,t)=>t(Env.API_WEBSOCKET_START)}),this._webSocket.on("connection",(e,t)=>De(this,void 0,void 0,function*(){t.url||(t.url=""),e.on("close",()=>{}),yield Z(2e3)})))})}migrations(e){return De(this,void 0,void 0,function*(){const t=[];yield X(Object.keys(e.models),i=>De(this,void 0,void 0,function*(){var r;const n=e.models[i],o=n.version();if(!o)return;const[s,d]=null!==(r=yield Ht.findOrCreate({where:{model:n.tableName},defaults:{model:n.tableName,version:""}}).catch(this.error))&&void 0!==r?r:[];s&&(d||s.version!=o)&&(s.version=o,yield s.save().catch(this.error),t.push(n))})),yield X(t,e=>De(this,void 0,void 0,function*(){return yield e.updateAttributes()}))})}websocket(){return this._webSocket}}let Vt=class BaseController extends ee{constructor(){super(...arguments),this.permissions=[]}name(){var e,t;return(null!==(t=null===(e=this.constructor)||void 0===e?void 0:e.name)&&void 0!==t?t:"api").replace(/(([a-z])([A-Z]))/g,"$2_$3")}session(e,t,i){return De(this,void 0,void 0,function*(){i.auth&&i.user&&(i.user_agent?i.user_agent!=t&&i.regenerate(V):(i.user_agent=t,i.save(V))),e.next()})}sync(){return De(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=W(e.replace(/_/g," ")," ");yield X(this.permissions,i=>De(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${W(i," ")}`,active:!0}})}))})}};Me([Re(0,c()),Re(1,p("user-agent")),Re(2,v()),je("design:type",Function),je("design:paramtypes",[n,String,Object]),je("design:returntype",Promise)],Vt.prototype,"session",null),Vt=Me([Ee(Loggable)],Vt);let Yt=class ModelController extends Vt{constructor(){super(...arguments),this.attributes=[],this.permissions=["create","read","update","delete"],this.search=[]}countAll(e){return De(this,void 0,void 0,function*(){return yield this.service.countAll(e)})}create(e){return De(this,void 0,void 0,function*(){return yield this.service.create(e)})}delete(e){return De(this,void 0,void 0,function*(){return yield this.service.delete(e)})}findAll(e){return De(this,void 0,void 0,function*(){return yield this.service.findAll(e)})}findOne(e){return De(this,void 0,void 0,function*(){return yield this.service.findOne(e)})}include(e,t){return this.service.include(e,t)}sync(){return De(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=W(e.replace(/_/g," ")," ");yield X(this.permissions,i=>De(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${W(i," ")}`,active:!0}})})),this.service=new ModelService(this.model,{attributes:this.attributes.length?this.attributes:void 0,search:this.search.length?this.search:void 0})})}update(e){return De(this,void 0,void 0,function*(){return yield this.service.update(e)})}name(){return this.model.tableName}};Yt=Me([g(Vt)],Yt);let $t=class AuditsController extends Yt{constructor(){super(...arguments),this.model=Nt,this.permissions=["read"]}all(e){return De(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{attributes:{exclude:["currently","previously"]}}})})}get(e){return De(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}};Me([h(),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],$t.prototype,"all",null),Me([h("/:id"),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],$t.prototype,"get",null),$t=Me([y("/audits"),g(Yt)],$t);let Gt=class AuthController extends Vt{constructor(){super(...arguments),this.authService=new qt}login(e,i,r,n,o,s){return De(this,void 0,void 0,function*(){var d;yield Z(Env.SLEEP_AUTH);const a=yield Dt.findOne({where:{[ge.or]:[{email:r},{username:r}]}}).catch(this.error);if(!a)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const l=yield jt.findOne({where:{revoked_at:null,user_id:a.id}}).catch(this.error);if(n+=Env.PASSWORD_PEPPER,!l||!(yield Ae(l.hash,n).catch(V)))return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const u=yield bt.findOne({where:{active:!0,user_id:a.id}}).catch(this.error);if(u)return e.error(new t("Activation Required")),s.emit("auth.activation",{ctx:e,register:u,user:a}),void this.emit("auth.activation",{ctx:e,register:u,user:a});if(a.status!=Be.ACTIVE)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e,user:a}),void this.emit("auth.failure",{ctx:e,user:a});const{auth:c,token:p}=null!==(d=yield this.authService.create(a).catch(t=>{e.error(t),s.emit("auth.failure",{ctx:e}),this.emit("auth.failure",{ctx:e})}))&&void 0!==d?d:{};c&&p&&(c.user_agent=i,c.ip_address=e.getIp(),yield c.save().catch(this.error),Env.API_TOKEN_COOKIE_SET&&e.setCookie(Env.API_TOKEN_COOKIE,p,{maxAge:o?Env.TOKEN_TTL:void 0}),e.json({token:p}),s.emit("auth.login",{ctx:e,auth:c,user:a}),this.emit("auth.login",{ctx:e,auth:c,user:a}))})}logout(e,i,r,n){return De(this,void 0,void 0,function*(){if(yield this.authService.destroy(i))return Env.API_TOKEN_COOKIE_SET&&e.clearCookie(Env.API_TOKEN_COOKIE),e.success("OK"),n.emit("auth.logout",{auth:i,ctx:e,user:r}),void this.emit("auth.logout",{auth:i,ctx:e,user:r});e.error(new t("Access Denied"))})}renew(e,t,i,r){return De(this,void 0,void 0,function*(){var n;const{auth:o,token:s}=null!==(n=yield this.authService.renew(i).catch(t=>{e.error(t)}))&&void 0!==n?n:{};o&&s&&(o.user_agent=t,yield o.save().catch(this.error),e.json({token:s}),r.emit("auth.renew",{auth:o,ctx:e}),this.emit("auth.renew",{auth:o,ctx:e}))})}user(e,t){return De(this,void 0,void 0,function*(){const{groups:i,permissions:r,tenants:n}=e.req;if(!i||!r||!n)return e.error(new s);e.json(Object.assign(Object.assign({},t.toJSON()),{groups:i,permissions:r,tenants:n}))})}};Me([m("/login"),E(e=>({username:e.string().min(3),password:e.string().min(5),remember:e.boolean().parse().default(!1)})),Re(0,c()),Re(1,p("user-agent")),Re(2,f("username")),Re(3,f("password")),Re(4,f("remember")),Re(5,_()),je("design:type",Function),je("design:paramtypes",[n,String,String,String,Boolean,Application]),je("design:returntype",Promise)],Gt.prototype,"login",null),Me([h("/logout"),We(),Re(0,c()),Re(1,Je()),Re(2,tt()),Re(3,_()),je("design:type",Function),je("design:paramtypes",[n,Pt,Dt,Application]),je("design:returntype",Promise)],Gt.prototype,"logout",null),Me([m("/renew"),E(e=>({token:e.string()})),Re(0,c()),Re(1,p("user-agent")),Re(2,f("token")),Re(3,_()),je("design:type",Function),je("design:paramtypes",[n,String,String,Application]),je("design:returntype",Promise)],Gt.prototype,"renew",null),Me([h(),h("/me"),We(),Re(0,c()),Re(1,tt()),je("design:type",Function),je("design:paramtypes",[n,Dt]),je("design:returntype",Promise)],Gt.prototype,"user",null),Gt=Me([y("/auth"),g(Vt)],Gt);let zt=class CrudController extends Yt{constructor(){super(...arguments),this._crud={}}CrudArgumentsCountAll(e){return{ctx:e}}CrudArgumentsCreate(e){return{ctx:e}}CrudArgumentsFindAll(e){return{ctx:e}}CrudArgumentsFindOne(e){return{ctx:e}}CrudArgumentsDelete(e){return{ctx:e}}CrudArgumentsUpdate(e){return{ctx:e}}CrudValidateCreate(){return this._crud}CrudValidateUpdate(){return this._crud}add(e){return De(this,void 0,void 0,function*(){yield this.create(this.CrudArgumentsCreate(e))})}all(e){return De(this,void 0,void 0,function*(){yield this.findAll(this.CrudArgumentsFindAll(e))})}rows(e){return De(this,void 0,void 0,function*(){yield this.countAll(this.CrudArgumentsCountAll(e))})}del(e){return De(this,void 0,void 0,function*(){yield this.delete(this.CrudArgumentsDelete(e))})}get(e){return De(this,void 0,void 0,function*(){yield this.findOne(this.CrudArgumentsFindOne(e))})}set(e){return De(this,void 0,void 0,function*(){yield this.update(this.CrudArgumentsUpdate(e))})}validate(e,t){var i,r;const n=q.object(t).parse().validate(null!==(r=null===(i=e.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{});if(n.error)return e.error(new d(n.message||n.error));e.req.body=n.value,e.next()}validateCreate(e){const t=this.CrudValidateCreate();if(t==this._crud)return e.error(new s);this.validate(e,t)}validateUpdate(e){const t=this.CrudValidateUpdate();if(t==this._crud)return e.error(new s);this.validate(e,t)}};Me([m(),We(),Ue(),S("validateCreate"),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],zt.prototype,"add",null),Me([h(),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],zt.prototype,"all",null),Me([h("/count"),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],zt.prototype,"rows",null),Me([O("/:id"),We(),Ve(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],zt.prototype,"del",null),Me([h("/:id"),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],zt.prototype,"get",null),Me([A("/:id"),We(),$e(),S("validateUpdate"),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],zt.prototype,"set",null),Me([Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",void 0)],zt.prototype,"validateCreate",null),Me([Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",void 0)],zt.prototype,"validateUpdate",null),zt=Me([g(Yt)],zt);let Wt=class FilesController extends Vt{constructor(){super(...arguments),this.directory=Env.HTTP_PUBLIC||"./",this.permissions=["delete","download","edit","list","read","rename","upload","write"]}files(e){return De(this,void 0,void 0,function*(){let{path:t}=e.req;t=t.replace(/(^\/path(\/)?)|([\\.]{1,2}\/)/g,"");const i=Ce(this.directory,t);if(!Te(i)||!be(i).isDirectory())return e.error(new o);let r;return r=Pe(i),r=r.map(e=>this.info(Ce(i,e))),r=r.filter(te),Object.assign(Object.assign({},this.info(i)),{files:r})})}info(e){if(!Te(e))return null;const t=be(e),i=e.split("/").pop();e=e.replace(this.directory,"/").replace(/^\/\//,"/");const r=t.isDirectory();return{name:i,path:e.replace(/^\/\//,"/"),size:t.size,extension:r?"":"."+e.split(".").pop(),created:t.birthtime,modified:t.mtime,directory:r,symlink:t.isSymbolicLink()}}name(){return"files"}sync(){return De(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=W(e.replace(/_/g," ")," ");yield X(this.permissions,i=>De(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield wt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${W(i," ")}`,active:!0}})}))})}};Me([h("/path"),h("/path/*path"),We(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],Wt.prototype,"files",null),Wt=Me([y("/files"),g(Vt)],Wt);let Jt=class ForgotController extends Vt{check(e,t){return De(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i||!i.user)return e.error(new o);i.secret=ie(),yield i.save(),e.json({token:i.secret})})}forgot(e,t,i){return De(this,void 0,void 0,function*(){yield Z(Env.SLEEP_FORGOT);const r=t,n=yield Dt.findOne({where:{[ge.or]:[{email:r},{username:t}]}}).catch(this.error);if(!n)return e.error(new o);const s=ie(),d=Date.now()+6e4*Env.TOKEN_TTL_FORGOT,a=yield Lt.create({token:s,timestamp:d,active:!0,user_id:n.id});e.success("OK"),i.emit("forgot.send",{ctx:e,forgot:a,user:n}),this.emit("forgot.send",{ctx:e,forgot:a,user:n})})}reset(e,t,i,r){return De(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i)return e.error(new o);i.active=!1,yield i.save().catch(this.error),yield i.user.save().catch(this.error),e.success("OK"),r.emit("forgot.reset",{ctx:e,user:i.user}),this.emit("forgot.reset",{ctx:e,user:i.user})})}find(e){return De(this,void 0,void 0,function*(){return yield Lt.findOne({where:{token:e,active:!0},include:[{association:"users",required:!0}]}).catch(this.error)})}};Me([h("/check"),E(e=>({token:e.string()})),Re(0,c()),Re(1,f("token")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],Jt.prototype,"check",null),Me([m(),E(e=>({username:e.string().min(4)})),Re(0,c()),Re(1,f("username")),Re(2,_()),je("design:type",Function),je("design:paramtypes",[n,String,Application]),je("design:returntype",Promise)],Jt.prototype,"forgot",null),Me([m("/reset"),E(e=>({token:e.string(),password:e.string().min(5)})),Re(0,c()),Re(1,f("token")),Re(2,f("password")),Re(3,_()),je("design:type",Function),je("design:paramtypes",[n,String,String,Application]),je("design:returntype",Promise)],Jt.prototype,"reset",null),Jt=Me([y("/forgot"),g(Vt)],Jt);let Qt=class GroupsController extends zt{constructor(){super(...arguments),this.model=xt,this.schemaCreate={name:q.string(),description:q.string().default(""),type:q.enum(Object.values(Fe)).default(Fe.SYSTEM),active:q.boolean().parse(),metadata:q.object().parse().default({})},this.schemaUpdate={description:q.string().optional(),type:q.enum(Object.values(Fe)).optional(),active:q.boolean().parse().optional(),metadata:q.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}sync(){const e=Object.create(null,{sync:{get:()=>super.sync}});return De(this,void 0,void 0,function*(){yield e.sync.call(this),this.userModelService=new ModelService(Dt)})}users(e,t){return De(this,void 0,void 0,function*(){(yield this.checkGroup(e,t))&&(yield this.userModelService.findAll({ctx:e,options:{include:[{association:"users_groups",required:!0,attributes:[],where:{group_id:t}}]}}))})}checkGroup(e,t){return De(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield xt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new o),!1)})}};Me([h("/:id/users"),We(),Ye("users"),Re(0,c()),Re(1,T("id")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],Qt.prototype,"users",null),Qt=Me([y("/groups"),g(zt)],Qt);let Xt=class GroupsPermissionsController extends Yt{constructor(){super(...arguments),this.model=wt,this.permissions=[]}add(e,t,i){return De(this,void 0,void 0,function*(){(yield this.checkGroup(e,t))&&(yield this.addPermissions(e,t,i),e.success("OK"))})}all(e,t){return De(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{include:[{association:"groups_permissions",required:!0,attributes:[],where:{group_id:t}}]}})})}del(e,t,i){return De(this,void 0,void 0,function*(){(yield this.checkGroup(e,t))&&(yield It.destroy(Object.assign({where:{group_id:t,permission_id:{[ge.in]:J(i)}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK"))})}set(e,t,i){return De(this,void 0,void 0,function*(){if(!(yield this.checkGroup(e,t)))return;const r=yield this.addPermissions(e,t,i);yield It.destroy(Object.assign({where:{group_id:t,permission_id:{[ge.notIn]:r}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}addPermissions(e,t,i){return De(this,void 0,void 0,function*(){const r=[];return yield X(J(i),i=>De(this,void 0,void 0,function*(){var n;if(!(yield wt.count({where:{id:i}})))return;const[o]=null!==(n=yield It.findOrCreate(Object.assign({where:{group_id:t,permission_id:i},defaults:{group_id:t,permission_id:i}},{ctx:e})).catch(this.error))&&void 0!==n?n:[];o&&r.push(i)})),r})}checkGroup(e,t){return De(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield xt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new o),!1)})}};Me([m("/:id/permissions"),We(),$e("groups"),E(e=>({permissions:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("permissions")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],Xt.prototype,"add",null),Me([h("/:id/permissions"),We(),Ye("groups"),Re(0,c()),Re(1,T("id")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],Xt.prototype,"all",null),Me([O("/:id/permissions"),We(),$e("groups"),E(e=>({permissions:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("permissions")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],Xt.prototype,"del",null),Me([A("/:id/permissions"),We(),$e("groups"),E(e=>({permissions:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("permissions")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],Xt.prototype,"set",null),Xt=Me([y("/groups"),g(Yt)],Xt);let Zt=class HealthController{ping(e){return De(this,void 0,void 0,function*(){e.json({status:"ok",timestamp:Date.now(),uptime:process.uptime()})})}};Me([b("/"),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],Zt.prototype,"ping",null),Zt=Me([y("/health")],Zt);let ei=class LogsController extends Yt{constructor(){super(...arguments),this.model=Ft,this.permissions=["read"]}all(e){return De(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}};Me([h(),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],ei.prototype,"all",null),ei=Me([y("/logs"),g(Yt)],ei);let ti=class McpController extends Vt{constructor(){super(...arguments),this.tools=new McpToolRegistry,this.toolsRegistered=!1,this.handler=new McpHttpHandler({sessions:new McpSessionStore(Env.MCP_SESSION_TTL),tools:this.tools,logger:{toolCall:e=>De(this,void 0,void 0,function*(){yield Log.info(JSON.stringify(e),"mcp")})}})}sync(e){const t=Object.create(null,{sync:{get:()=>super.sync}});return De(this,void 0,void 0,function*(){yield t.sync.call(this),this.toolsRegistered||(this.toolsRegistered=!0,e&&(e.instance.use((e,t,i,r)=>{if(!this.isMcpEndpoint(t))return r(e);const n=this.jsonParseErrorResponse(e);if(!n)return r(e);i.status(n.status).json(n.body)}),e.instance.use((e,t,i)=>{if(!this.isMcpEndpoint(e)||!["GET","HEAD"].includes(e.method))return i();t.setHeader("Allow",vt),t.status(405).end()}),this.discoverMcpTools(e.controllers).forEach(e=>this.tools.register(e))))})}get(e){return De(this,void 0,void 0,function*(){this.setHeader(e),e.send(405)})}options(e){return De(this,void 0,void 0,function*(){this.setHeader(e),e.send(204)})}post(e){return De(this,void 0,void 0,function*(){this.respond(e,yield this.handler.post(e))})}delete(e){return De(this,void 0,void 0,function*(){this.respond(e,this.handler.delete(e))})}getMcpToolMetadata(e){const t=me(yt,e,[]);return t.length||"function"==typeof e?t:me(yt,Object.getPrototypeOf(e),[])}discoverMcpTools(e){const t=[];for(const i of e)for(const e of this.getMcpToolMetadata(i))t.push(this.createMcpToolFromMetadata(i,e));return t}createMcpToolFromMetadata(e,t){const i=e[t.propertyKey];if(!D(i))throw new Error(`MCP tool "${t.name}" handler was not found`);return mt(t),Object.assign(Object.assign(Object.assign({name:t.name,title:t.title,description:t.description},void 0!==t.input?{input:t.input}:{}),void 0!==t.output?{output:t.output}:{}),{run:(t,r)=>i.call(e,t,r)})}isJsonParseError(e){if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode}isMcpEndpoint(e){const t=(e.originalUrl||e.url).split("?")[0].replace(/\/+$/g,"")||"/";return t===`${(Env.API_HTTP_PATH||"/").replace(/\/+$/g,"")||""}/mcp`.replace(/\/+/g,"/")||"/mcp"===t}jsonParseErrorResponse(e){if(this.isJsonParseError(e))return{status:400,body:ot(null,new McpParseError("Parse error",{message:e.message}))}}respond(e,t){var i;for(const[r,n]of Object.entries(null!==(i=t.headers)&&void 0!==i?i:{}))e.res.setHeader(r,n);void 0!==t.body?e.res.status(t.status).json(t.body):e.res.status(t.status).end()}setHeader(e,t){Object.entries(Object.assign({Allow:vt,"Access-Control-Allow-Methods":vt,"Access-Control-Allow-Headers":`Content-Type, Accept, ${ct}, ${ut}`},null!=t?t:{})).forEach(([t,i])=>{e.res.setHeader(t,i)})}};Me([h(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],ti.prototype,"get",null),Me([P(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],ti.prototype,"options",null),Me([m(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],ti.prototype,"post",null),Me([O(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],ti.prototype,"delete",null),ti=Me([y("/mcp"),g(Vt)],ti);let ii=class PermissionsController extends zt{constructor(){super(...arguments),this.model=wt,this.schemaCreate={name:q.string(),description:q.string().default(""),active:q.boolean().parse(),metadata:q.object().parse().default({})},this.schemaUpdate={description:q.string().optional(),active:q.boolean().parse().optional(),metadata:q.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}sync(){const e=Object.create(null,{sync:{get:()=>super.sync}});return De(this,void 0,void 0,function*(){yield e.sync.call(this),this.groupModelService=new ModelService(xt)})}groups(e,t){return De(this,void 0,void 0,function*(){(yield this.checkPermission(e,t))&&(yield this.groupModelService.findAll({ctx:e,options:{include:[{association:"groups_permissions",required:!0,attributes:[],where:{permission_id:t}}]}}))})}checkPermission(e,t){return De(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield wt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new o),!1)})}};Me([h("/:id/groups"),We(),Ye("groups"),Re(0,c()),Re(1,T("id")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],ii.prototype,"groups",null),ii=Me([y("/permissions"),g(zt)],ii);let ri=class RegisterController extends Vt{register(e,t,i){return De(this,void 0,void 0,function*(){yield Z(Env.SLEEP_REGISTRY);const{name:r,date:n,email:o,username:d,password:a,confirm:l}=t,u=d||o,c=R(a);if(yield Dt.count({where:{[ge.or]:[{email:o},{username:u}]}}).catch(this.error))return e.error("INVALID EMAIL OR USERNAME");if(c!=R(l))return e.error("INVALID PASSWORD");const p=yield Dt.create({name:r,email:o,username:u,password:c,avatar:"",date:n,description:"",status:Be.PENDING}).catch(this.error);if(!p)return e.error(new s);const v=yield bt.create({token:yield this.getId(),active:!0,user_id:p.id}).catch(this.error);if(!v)return yield p.destroy().catch(this.error),e.error(new s);e.success("OK"),i.emit("register.user",{ctx:e,register:v,user:p}),this.emit("register.user",{ctx:e,register:v,user:p})})}confirm(e,t,i){return De(this,void 0,void 0,function*(){const r=yield bt.findOne({where:{token:t,active:!0},include:[{association:"users",required:!0}]}).catch(this.error);if(!r)return e.error(new o);r.active=!1,yield r.save().catch(this.error),r.user.status=Be.ACTIVE,yield r.user.save().catch(this.error),e.success("OK"),i.emit("register.confirm",{ctx:e,register:r,user:r.user}),this.emit("register.confirm",{ctx:e,register:r,user:r.user})})}send(e,t,i){return De(this,void 0,void 0,function*(){const r=t,n=yield bt.findOne({where:{active:!0},include:[{model:Dt,required:!0,where:{[ge.or]:[{email:r},{username:t}]}}]}).catch(this.error);if(!n)return e.error(new o);e.success("OK"),i.emit("register.send",{ctx:e,register:n,user:n.user}),this.emit("register.send",{ctx:e,register:n,user:n.user})})}getId(){return De(this,void 0,void 0,function*(){const e=H();return(yield bt.count({where:{token:e}}))?this.getId():e})}};Me([m(),E(e=>({name:e.string(),date:e.date(),email:e.string().email(),username:e.string().min(4).default(e.ref("email")),password:e.string().min(5),confirm:e.string().min(5)})),Re(0,c()),Re(1,f()),Re(2,_()),je("design:type",Function),je("design:paramtypes",[n,Object,Application]),je("design:returntype",Promise)],ri.prototype,"register",null),Me([m("/confirm"),E(e=>({token:e.string()})),Re(0,c()),Re(1,f("token")),Re(2,_()),je("design:type",Function),je("design:paramtypes",[n,String,Application]),je("design:returntype",Promise)],ri.prototype,"confirm",null),Me([m("/send"),E(e=>({username:e.string().min(4)})),Re(0,c()),Re(1,f("username")),Re(2,_()),je("design:type",Function),je("design:paramtypes",[n,String,Application]),je("design:returntype",Promise)],ri.prototype,"send",null),ri=Me([y("/register"),g(Vt)],ri);let ni=class SetupController extends Vt{constructor(){super(...arguments),this.userService=new Ut}setup(e){return De(this,void 0,void 0,function*(){var t;if(yield Dt.count())return e.error(new o("Endpoint Not Found"));const i=yield Dt.create({name:"Admin",username:"admin",email:"admin@localhost.com",notes:"",status:Be.ACTIVE},Object.assign({},{ctx:e})).catch(this.error);if(!i)return e.error(new s);yield this.userService.createPassword(i.id,"admin",e);const r=yield xt.create({name:"root",description:"Root",active:!0},Object.assign({},{ctx:e}));yield Rt.create({user_id:i.id,group_id:r.id},Object.assign({},{ctx:e})),yield xt.create({name:"admin",description:"Admin",active:!0},Object.assign({},{ctx:e})),yield xt.create({name:"user",description:"User",active:!0},Object.assign({},{ctx:e}));const n=null!==(t=yield wt.findAll({where:{active:!0}}).catch(this.error))&&void 0!==t?t:[];yield X(n,t=>De(this,void 0,void 0,function*(){yield It.create({group_id:r.id,permission_id:t.id},Object.assign({},{ctx:e}))})),e.success("OK")})}};Me([h(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],ni.prototype,"setup",null),ni=Me([y("/setup"),g(Vt)],ni);let oi=class TenantsController extends zt{constructor(){super(...arguments),this.model=Mt,this.schemaCreate={name:q.string(),description:q.string().default(""),status:q.enum(Object.values(Ke)).default(Ke.ACTIVE),metadata:q.object().parse().default({})},this.schemaUpdate={name:q.string().optional(),description:q.string().optional(),status:q.enum(Object.values(Ke)).optional(),metadata:q.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}sync(){const e=Object.create(null,{sync:{get:()=>super.sync}});return De(this,void 0,void 0,function*(){yield e.sync.call(this),this.userModelService=new ModelService(Dt)})}users(e,t){return De(this,void 0,void 0,function*(){(yield this.checkTenant(e,t))&&(yield this.userModelService.findAll({ctx:e,options:{include:[{association:"users_tenants",required:!0,attributes:[],where:{tenant_id:t}}]}}))})}checkTenant(e,t){return De(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Mt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new o),!1)})}};Me([h("/:id/users"),We(),Ye("users"),Re(0,c()),Re(1,T("id")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],oi.prototype,"users",null),oi=Me([y("/tenants"),g(zt)],oi);let si=class TestController extends Vt{json(e){return De(this,void 0,void 0,function*(){e.json({ok:!0,message:"hello",timestamp:Date.now()})})}sum(e,t){return De(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t+i}})}multiply(e,t){return De(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t*i}})}average(e,t){return De(this,void 0,void 0,function*(){const t=e.values;return{value:t.reduce((e,t)=>e+t,0)/t.length,count:t.length}})}validationString(e,t){return De(this,void 0,void 0,function*(){const t=e.text;return{length:t.length,normalized:t.trim()}})}validationNumber(e,t){return De(this,void 0,void 0,function*(){return{doubled:2*e.value}})}validationBoolean(e,t){return De(this,void 0,void 0,function*(){return{active:e.active}})}validationArray(e,t){return De(this,void 0,void 0,function*(){return{count:e.tags.length}})}validationObject(e,t){return De(this,void 0,void 0,function*(){const t=e.profile;return{summary:{name:t.name,adult:t.age>=18}}})}validationEnum(e,t){return De(this,void 0,void 0,function*(){return{status:e.status}})}validationDate(e,t){return De(this,void 0,void 0,function*(){const t=e.date;return{iso:t.toISOString(),timestamp:t.getTime()}})}validationOptional(e,t){return De(this,void 0,void 0,function*(){const t=e.nickname;return Object.assign({name:e.name,hasNickname:Boolean(t)},t?{nickname:t}:{})})}validationDefaults(e,t){return De(this,void 0,void 0,function*(){return{name:e.name,limit:e.limit}})}validationParse(e,t){return De(this,void 0,void 0,function*(){return{active:e.active,amount:e.amount}})}validationNested(e,t){return De(this,void 0,void 0,function*(){const t=e.payload;return{userId:t.user.id,scoreCount:t.scores.length}})}};Me([h(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],si.prototype,"json",null),Me([Et({name:"sum",title:"Somar numeros",description:"Soma dois numeros.",input:{a:q.number().description("valor a"),b:q.number().description("valor b")},output:{value:q.number().description("resultado da soma de a + b")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"sum",null),Me([Et({name:"multiply",title:"Multiplicar numeros",description:"Multiplica dois numeros.",input:{a:q.number().description("valor a"),b:q.number().description("valor b")},output:{value:q.number().description("resultado da multiplicação de a * b")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"multiply",null),Me([Et({name:"average",title:"Calcular media",description:"Calcula a media de uma lista de numeros.",input:{values:q.array(q.number().description("numero usado no calculo da media")).min(1).max(10).description("lista de numeros para calcular a media")},output:{value:q.number().description("media calculada"),count:q.number().description("quantidade de numeros usados")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"average",null),Me([Et({name:"validation.string",title:"Validacao de string",description:"Exemplo de validacao de texto com tamanho minimo e maximo.",input:{text:q.string().min(5).max(50).description("Texto entre 5 e 50 caracteres.")},output:{length:q.number().description("Quantidade de caracteres do texto."),normalized:q.string().description("Texto normalizado sem espacos nas pontas.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationString",null),Me([Et({name:"validation.number",title:"Validacao de number",description:"Exemplo de validacao numerica com minimo e maximo.",input:{value:q.number().min(0).max(100).description("Numero entre 0 e 100.")},output:{doubled:q.number().description("Numero multiplicado por dois.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationNumber",null),Me([Et({name:"validation.boolean",title:"Validacao de boolean",description:"Exemplo de validacao de booleano sem parse implicito.",input:{active:q.boolean().description("Indica se o registro esta ativo.")},output:{active:q.boolean().description("Booleano validado.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationBoolean",null),Me([Et({name:"validation.array",title:"Validacao de array",description:"Exemplo de validacao de array com limites e item tipado.",input:{tags:q.array(q.string().min(2).max(20).description("Tag entre 2 e 20 caracteres.")).min(1).max(5).description("Lista de tags entre 1 e 5 itens.")},output:{count:q.number().description("Quantidade de tags recebidas.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationArray",null),Me([Et({name:"validation.object",title:"Validacao de object",description:"Exemplo de validacao de objeto simples.",input:{profile:q.object({name:q.string().min(2).max(60).description("Nome do perfil."),age:q.number().min(0).max(120).description("Idade do perfil."),nickname:q.string().empty().max(30).description("Apelido opcional do perfil.")}).description("Objeto de perfil.")},output:{summary:q.object({name:q.string().description("Nome validado."),adult:q.boolean().description("Indica se a idade e maior ou igual a 18.")}).description("Resumo do perfil.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationObject",null),Me([Et({name:"validation.enum",title:"Validacao de enum",description:"Exemplo de validacao de lista fechada de valores.",input:{status:q.enum(["draft","active","archived"]).description("Status permitido.")},output:{status:q.string().description("Status validado.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationEnum",null),Me([Et({name:"validation.date",title:"Validacao de date",description:"Exemplo de validacao e parse de data.",input:{date:q.date().parse().description("Data em formato aceito pelo Date.")},output:{iso:q.string().description("Data em ISO string."),timestamp:q.number().description("Data em timestamp Unix em milissegundos.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationDate",null),Me([Et({name:"validation.optional",title:"Validacao de campo opcional",description:"Exemplo de campo opcional aceitando ausencia.",input:{name:q.string().min(2).description("Nome obrigatorio."),nickname:q.string().empty().max(30).description("Apelido opcional.")},output:{name:q.string().description("Nome validado."),hasNickname:q.boolean().description("Indica se apelido foi enviado."),nickname:q.string().empty().description("Apelido validado quando enviado.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationOptional",null),Me([Et({name:"validation.defaults",title:"Validacao de valores padrao",description:"Exemplo de campos opcionais com valores padrao.",input:{name:q.string().default("guest").description("Nome opcional com valor padrao."),limit:q.number().parse().default(10).min(1).max(100).description("Limite opcional com valor padrao.")},output:{name:q.string().description("Nome final."),limit:q.number().description("Limite final.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationDefaults",null),Me([Et({name:"validation.parse",title:"Validacao com parse",description:"Exemplo de parse de boolean e number antes da validacao final.",input:{active:q.boolean().parse().default(!1).description("Booleano aceitando valores parseaveis."),amount:q.number().parse().min(1).max(1e3).description("Numero aceitando string numerica.")},output:{active:q.boolean().description("Booleano parseado."),amount:q.number().description("Numero parseado.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationParse",null),Me([Et({name:"validation.nested",title:"Validacao de objeto aninhado",description:"Exemplo de objeto aninhado com array interno.",input:{payload:q.object({user:q.object({id:q.string().min(3).max(30).description("Identificador do usuario."),email:q.string().email().description("Email do usuario.")}).description("Usuario do payload."),scores:q.array(q.number().min(0).max(100).description("Pontuacao individual.")).min(1).max(3).description("Pontuacoes do usuario.")}).description("Payload aninhado.")},output:{userId:q.string().description("Identificador validado."),scoreCount:q.number().description("Quantidade de pontuacoes.")}}),je("design:type",Function),je("design:paramtypes",[Object,Object]),je("design:returntype",Promise)],si.prototype,"validationNested",null),si=Me([y("/test"),g(Vt)],si);let di=class UsersController extends Yt{constructor(){super(),this.model=Dt,this.path=Env.HTTP_PUBLIC+"/avatar",Env.HTTP_PUBLIC&&Te(Env.HTTP_PUBLIC)&&!Te(this.path)&&we(this.path)}avatar(e,t){return De(this,void 0,void 0,function*(){var i;const r=e.getFiles();if(r.file&&r.file.length){const{filename:n,path:o}=null!==(i=r.file[0])&&void 0!==i?i:{};if(n){const i=yield Dt.findOne({where:{id:t.id}}).catch(this.error);if(!i)return Ie(o).isFile()&&xe(o),e.error(new s);const r=this.path+"/"+i.metadata.avatar_url;if(Te(r)&&Ie(r).isFile()&&xe(r),i.changed("metadata",!0),i.metadata.avatar_url=n,yield i.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK")}}e.success("Record not Changed")})}token_new(){return De(this,void 0,void 0,function*(){var e;const t=H();return(null!==(e=yield this.model.count({where:{token:t}}).catch(this.error))&&void 0!==e?e:0)?this.token_new():t})}add(e){return De(this,void 0,void 0,function*(){yield this.create({ctx:e})})}all(e){return De(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}rows(e){return De(this,void 0,void 0,function*(){yield this.countAll({ctx:e})})}del(e,t,i){return De(this,void 0,void 0,function*(){if(i.id==t)return e.error(new o);yield this.delete({ctx:e})})}get(e){return De(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}set(e){return De(this,void 0,void 0,function*(){yield this.update({ctx:e})})}};Me([m("/avatar"),We(),w({file:{count:1,path:`${Env.HTTP_PUBLIC}/avatar`,types:["image/bmp","image/jpeg","image/png"],size:32}}),Re(0,c()),Re(1,tt()),je("design:type",Function),je("design:paramtypes",[n,Dt]),je("design:returntype",Promise)],di.prototype,"avatar",null),Me([m(),We(),Ue(),E(e=>({name:e.string(),email:e.string().email(),username:e.string().min(3),notes:e.string().default(""),status:e.enum(Object.values(Be)).default(Be.ACTIVE),metadata:e.object().parse().default({})})),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],di.prototype,"add",null),Me([h(),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],di.prototype,"all",null),Me([h("/count"),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],di.prototype,"rows",null),Me([O("/:id"),We(),Ve(),Re(0,c()),Re(1,T("id")),Re(2,tt()),je("design:type",Function),je("design:paramtypes",[n,String,Dt]),je("design:returntype",Promise)],di.prototype,"del",null),Me([h("/:id"),We(),Ye(),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],di.prototype,"get",null),Me([A("/:id"),We(),$e(),E(e=>({name:e.string().optional(),email:e.string().email().optional(),username:e.string().min(3).optional(),notes:e.string().optional(),status:e.enum(Object.values(Be)).optional(),metadata:e.object().parse().optional()})),Re(0,c()),je("design:type",Function),je("design:paramtypes",[n]),je("design:returntype",Promise)],di.prototype,"set",null),di=Me([y("/users"),g(Yt),je("design:paramtypes",[])],di);let ai=class UsersGroupsController extends Yt{constructor(){super(...arguments),this.model=xt,this.permissions=[]}add(e,t,i){return De(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.addGroups(e,t,i),e.success("OK"))})}all(e,t){return De(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.findAll({ctx:e,options:{include:[{association:"users_groups",required:!0,attributes:[],where:{user_id:t}}]}}))})}del(e,t,i){return De(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield Rt.destroy(Object.assign({where:{user_id:t,group_id:{[ge.in]:J(i)}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK"))})}set(e,t,i){return De(this,void 0,void 0,function*(){if(!(yield this.checkUser(e,t)))return;const r=yield this.addGroups(e,t,i);yield Rt.destroy(Object.assign({where:{user_id:t,group_id:{[ge.notIn]:r}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}addGroups(e,t,i){return De(this,void 0,void 0,function*(){const r=[];return yield X(J(i),i=>De(this,void 0,void 0,function*(){var n;if(!(yield xt.count({where:{id:i}})))return;const[o]=null!==(n=yield Rt.findOrCreate(Object.assign({where:{user_id:t,group_id:i},defaults:{user_id:t,group_id:i}},{ctx:e})).catch(this.error))&&void 0!==n?n:[];o&&r.push(i)})),r})}checkUser(e,t){return De(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Dt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new o),!1)})}};Me([m("/:id/groups"),We(),$e("users"),E(e=>({groups:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("groups")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],ai.prototype,"add",null),Me([h("/:id/groups"),We(),Ye("users"),Re(0,c()),Re(1,T("id")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],ai.prototype,"all",null),Me([O("/:id/groups"),We(),$e("users"),E(e=>({groups:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("groups")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],ai.prototype,"del",null),Me([A("/:id/groups"),We(),$e("users"),E(e=>({groups:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("groups")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],ai.prototype,"set",null),ai=Me([y("/users"),g(Yt)],ai);let li=class UsersTenantsController extends Yt{constructor(){super(...arguments),this.model=Mt,this.permissions=[]}add(e,t,i){return De(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.addTenants(e,t,i),e.success("OK"))})}all(e,t){return De(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.findAll({ctx:e,options:{include:[{association:"users_tenants",required:!0,attributes:[],where:{user_id:t}}]}}))})}del(e,t,i){return De(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield Ct.destroy(Object.assign({where:{user_id:t,tenant_id:{[ge.in]:J(i)}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK"))})}set(e,t,i){return De(this,void 0,void 0,function*(){if(!(yield this.checkUser(e,t)))return;const r=yield this.addTenants(e,t,i);yield Ct.destroy(Object.assign({where:{user_id:t,tenant_id:{[ge.notIn]:r}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}addTenants(e,t,i){return De(this,void 0,void 0,function*(){const r=[];return yield X(J(i),i=>De(this,void 0,void 0,function*(){var n;if(!(yield Mt.count({where:{id:i}})))return;const[o]=null!==(n=yield Ct.findOrCreate(Object.assign({where:{user_id:t,tenant_id:i},defaults:{user_id:t,tenant_id:i}},{ctx:e})).catch(this.error))&&void 0!==n?n:[];o&&r.push(i)})),r})}checkUser(e,t){return De(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Dt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new o),!1)})}};Me([m("/:id/tenants"),We(),$e("users"),E(e=>({tenants:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("tenants")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],li.prototype,"add",null),Me([h("/:id/tenants"),We(),Ye("users"),Re(0,c()),Re(1,T("id")),je("design:type",Function),je("design:paramtypes",[n,String]),je("design:returntype",Promise)],li.prototype,"all",null),Me([O("/:id/tenants"),We(),$e("users"),E(e=>({tenants:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("tenants")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],li.prototype,"del",null),Me([A("/:id/tenants"),We(),$e("users"),E(e=>({tenants:e.array(e.string().uuid())})),Re(0,c()),Re(1,T("id")),Re(2,f("tenants")),je("design:type",Function),je("design:paramtypes",[n,String,Array]),je("design:returntype",Promise)],li.prototype,"set",null),li=Me([y("/users"),g(Yt)],li);export{Application,Tt as Audit,Nt as AuditModel,Le as AuditTypes,$t as AuditsController,Gt as AuthController,qt as AuthService,Vt as BaseController,Ue as CanCreate,Ve as CanDelete,Ye as CanRead,$e as CanUpdate,Config,kt as ConfigModel,zt as CrudController,Env,Wt as FilesController,Jt as ForgotController,Lt as ForgotModel,xt as GroupModel,It as GroupPermissionModel,Fe as GroupTypes,Qt as GroupsController,Xt as GroupsPermissionsController,Ge as HasGroups,ze as HasPermissions,Zt as HealthController,We as IsAuthenticated,Log,He as LogLevels,Ft as LogModel,Loggable,ei as LogsController,lt as MCP_DEFAULT_PROTOCOL_VERSION,vt as MCP_HTTP_ALLOW,pt as MCP_HTTP_ALLOWED_METHODS,ut as MCP_PROTOCOL_VERSION_HEADER,ct as MCP_SESSION_ID_HEADER,at as MCP_SUPPORTED_PROTOCOL_VERSIONS,yt as MCP_TOOL_METADATA,ti as McpController,McpError,it as McpErrorCode,McpHttpHandler,McpInternalError,McpInvalidParamsError,McpInvalidRequestError,McpInvalidSessionError,McpMethodNotFoundError,McpParseError,McpServerError,McpSessionStore,Et as McpTool,McpToolNotFoundError,McpToolRegistry,Ht as MigrationModel,Yt as ModelController,ModelService,wt as PermissionModel,ii as PermissionsController,ri as RegisterController,bt as RegisterModel,Je as ReqAuth,Qe as ReqGroup,Xe as ReqGroups,Ze as ReqPermission,et as ReqPermissions,tt as ReqUser,Bt as Service,Kt as SessionModel,SessionStore,ni as SetupController,Mt as TenantModel,Ke as TenantStatus,oi as TenantsController,si as TestController,Pt as UserAuthModel,Rt as UserGroupModel,Dt as UserModel,jt as UserPasswordModel,Ut as UserService,Be as UserStatus,Ct as UserTenantModel,di as UsersController,ai as UsersGroupsController,li as UsersTenantsController,mt as assertValidMcpToolDefinition,qe as canFactory,gt as isJsonParseError,rt as isJsonRpcId,ht as jsonParseErrorResponse,ot as jsonRpcError,st as jsonRpcErrorFromCode,nt as jsonRpcResult,dt as parseJsonRpcRequest,ke as sequelize};
+import{Use as e,UnauthorizedError as t,parameterFactory as i,ResponseError as r,Context as n,InternalServerError as s,ValidationError as o,StatusCodes as d,BadRequestError as a,NotFoundError as l,Application as u,Extends as c,Get as p,Ctx as v,Controller as h,Post as g,ValidateBody as y,Body as m,App as E,Middleware as f,Delete as S,Put as _,Params as O,All as A,Options as T,Upload as b}from"@andrewcaires/express";import{isUndefined as w,isFunction as P,includesArray as I,isPlainObject as x,isString as C,isNumber as j,uuidv7 as R,isArray as M,isValidationShape as D,Validation as N,getConstructor as k,noop as H,uniqueArray as F,isNull as L,uniqueID as q,createApiKey as K,clamp as B,merge as U,clone as V,forEachAsync as $,upperCamelCase as z,forEachSeries as G,sleep as Y,EventEmitter as W,isDef as J}from"@andrewcaires/utils.js";import{WebSocketServer as X}from"ws";import{Env as Q,Log as Z,LogColor as ee,Encryptor as te,sha256 as ie}from"@andrewcaires/node";import{Sequelize as re,Hooks as ne,Column as se,Association as oe,Database as de,ModelName as ae,Version as le,Model as ue,Index as ce,DefaultValue as pe,Op as ve,Where as he}from"@andrewcaires/sequelize";import{config as ge}from"dotenv";import{metadata as ye,Trait as me,Singleton as Ee}from"@andrewcaires/decorator";import{Store as fe}from"express-session";import Se from"jsonwebtoken";import{createHmac as _e,timingSafeEqual as Oe}from"node:crypto";import{hashSync as Ae,verify as Te}from"@node-rs/argon2";import{existsSync as be,statSync as we,readdirSync as Pe,mkdirSync as Ie,lstatSync as xe,rmSync as Ce}from"node:fs";import{join as je}from"node:path";function Re(e,t,i,r){var n,s=arguments.length,o=s<3?t:null===r?r=Object.getOwnPropertyDescriptor(t,i):r;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(e,t,i,r);else for(var d=e.length-1;d>=0;d--)(n=e[d])&&(o=(s<3?n(o):s>3?n(t,i,o):n(t,i))||o);return s>3&&o&&Object.defineProperty(t,i,o),o}function Me(e,t){return function(i,r){t(i,r,e)}}function De(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function Ne(e,t,i,r){return new(i||(i=Promise))(function(n,s){function o(e){try{a(r.next(e))}catch(e){s(e)}}function d(e){try{a(r.throw(e))}catch(e){s(e)}}function a(e){var t;e.done?n(e.value):(t=e.value,t instanceof i?t:new i(function(e){e(t)})).then(o,d)}a((r=r.apply(e,t||[])).next())})}var ke;"function"==typeof SuppressedError&&SuppressedError,ge({quiet:!0});class Env extends Q{}ke=Env,Env.AUDIT_IGNORE=ke.getString("AUDIT_IGNORE","hash,password").split(","),Env.BASE_NAME=ke.getString("BASE_NAME",""),Env.CONSOLE_ERROR=ke.getBool("CONSOLE_ERROR",!1),Env.DATABASE_URI=ke.getString("DATABASE_URI","",!0),Env.DATABASE_LOG=ke.getBool("DATABASE_LOG",!1),Env.DATABASE_AUDIT=ke.getBool("DATABASE_AUDIT",!0),Env.DATABASE_PREFIX=ke.getString("DATABASE_PREFIX",""),Env.DATABASE_TIMEZONE=ke.getString("DATABASE_TIMEZONE","+00:00"),Env.ENCRYPTION_SECRET=ke.getString("ENCRYPTION_SECRET",""),Env.HTTP_CROSS=ke.getString("HTTP_CROSS",""),Env.HTTP_HYBRID=ke.getBool("HTTP_HYBRID",!1),Env.HTTP_NOTFOUND=ke.getString("HTTP_NOTFOUND",""),Env.HTTP_PATH=ke.getString("HTTP_PATH","/api"),Env.HTTP_PORT=ke.getInt("HTTP_PORT",ke.getInt("PORT",3e3)),Env.HTTP_PUBLIC=ke.getString("HTTP_PUBLIC",""),Env.HTTP_REDIRECT=ke.getString("HTTP_REDIRECT",""),Env.HTTP_TLS_CA=ke.getFile("HTTP_TLS_CA"),Env.HTTP_TLS_CRT=ke.getFile("HTTP_TLS_CRT"),Env.HTTP_TLS_KEY=ke.getFile("HTTP_TLS_KEY"),Env.MODEL_LIMIT=ke.getInt("MODEL_LIMIT",10),Env.MODEL_LIMIT_MAX=ke.getInt("MODEL_LIMIT_MAX",100),Env.MCP_SESSION_TTL=ke.getMs("MCP_SESSION_TTL","30m"),Env.PASSWORD_ALGORITHM=ke.getInt("PASSWORD_ALGORITHM",2),Env.PASSWORD_MEMORY_COST=ke.getInt("PASSWORD_MEMORY_COST",4096),Env.PASSWORD_PARALLELISM=ke.getInt("PASSWORD_PARALLELISM",1),Env.PASSWORD_PEPPER=ke.getString("PASSWORD_PEPPER",""),Env.PASSWORD_TIME_COST=ke.getInt("PASSWORD_TIME_COST",3),Env.SLEEP_AUTH=ke.getMs("SLEEP_AUTH","2s"),Env.SLEEP_FORGOT=ke.getMs("SLEEP_FORGOT","5s"),Env.SLEEP_REGISTRY=ke.getMs("SLEEP_REGISTRY","5s"),Env.TENANT_HEADER=ke.getString("TENANT_HEADER","X-Tenant-ID").toLowerCase(),Env.TOKEN_COOKIE=ke.getString("TOKEN_COOKIE",ke.getString("TOKEN_HEADER","Authorization")).toLowerCase(),Env.TOKEN_COOKIE_SET=ke.getBool("TOKEN_COOKIE_SET",!0),Env.TOKEN_HEADER=ke.getString("TOKEN_HEADER","authorization"),Env.TOKEN_PEPPER=ke.getString("TOKEN_PEPPER",""),Env.TOKEN_PREFIX=ke.getString("TOKEN_PREFIX","api"),Env.TOKEN_SECRET=ke.getString("TOKEN_SECRET",""),Env.TOKEN_TTL=ke.getMs("TOKEN_TTL","1d"),Env.TOKEN_TTL_FORGOT=ke.getMs("TOKEN_TTL_FORGOT","1d"),Env.TOKEN_TTL_RENEW=ke.getMs("TOKEN_TTL_RENEW","1d"),Env.TOKEN_TYPE=ke.getString("TOKEN_TYPE","bearer"),Env.API_BODYPARSER_STRICT=ke.getBool("API_BODYPARSER_STRICT",!0),Env.API_BODYPARSER_INFLATE=ke.getBool("API_BODYPARSER_INFLATE",!0),Env.API_BODYPARSER_LIMIT=ke.getString("API_BODYPARSER_LIMIT","10mb"),Env.API_BODYPARSER_TYPE=ke.getString("API_BODYPARSER_TYPE","json"),Env.API_SESSION_NAME=ke.getString("API_SESSION_NAME","session.id"),Env.API_SESSION_LIFETIME=ke.getMs("API_SESSION_LIFETIME","1d"),Env.API_SESSION_SECRET=ke.getString("API_SESSION_SECRET","yoursecret"),Env.API_USER_HISTORY=ke.getBool("API_USER_HISTORY",!0),Env.API_WEBSOCKET_START=ke.getBool("API_WEBSOCKET_START",!1);const He=new re({uri:Env.DATABASE_URI,logging:!!Env.DATABASE_LOG&&(e=>Z.console(ee.Magenta,"sql",e)),prefix:Env.DATABASE_PREFIX,timezone:Env.DATABASE_TIMEZONE});var Fe,Le,qe,Ke,Be;!function(e){e.CREATE="CREATE",e.DELETE="DELETE",e.UPDATE="UPDATE"}(Fe||(Fe={})),function(e){e.SYSTEM="system",e.TENANT="tenant"}(Le||(Le={})),function(e){e.INFO="info",e.WARN="warn",e.ERROR="error"}(qe||(qe={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.SUSPENDED="suspended",e.DISABLED="disabled",e.ARCHIVED="archived"}(Ke||(Ke={})),function(e){e.ACTIVE="active",e.PENDING="pending",e.DISABLED="disabled",e.LOCKED="locked",e.ARCHIVED="archived"}(Be||(Be={}));const Ue=i=>r=>(n,s,o)=>{e(e=>Ne(void 0,void 0,void 0,function*(){var n;w(r)&&(r=P(e.controller.name)?e.controller.name():null===(n=e.controller.constructor)||void 0===n?void 0:n.name);const{permissions:s=[]}=e.req;if(s.includes(`${r}.${i}`))return e.next();e.error(new t("Access Denied"))}))(n,s,o)},Ve=Ue("create"),$e=Ue("delete"),ze=Ue("read"),Ge=Ue("update"),Ye=(...i)=>(r,n,s)=>{e(e=>Ne(void 0,void 0,void 0,function*(){const{groups:r=[]}=e.req;if(I(i,r))return e.next();e.error(new t("Access Denied"))}))(r,n,s)},We=(...i)=>(r,n,s)=>{e(e=>Ne(void 0,void 0,void 0,function*(){const{permissions:r=[]}=e.req;if(I(i,r))return e.next();e.error(new t("Access Denied"))}))(r,n,s)},Je=i=>(r,n,s)=>{e(e=>Ne(void 0,void 0,void 0,function*(){var r;const n=P(e.controller.name)?e.controller.name():null===(r=e.controller.constructor)||void 0===r?void 0:r.name,{permissions:s=[]}=e.req;if(s.includes(`${n}.${i}`))return e.next();e.error(new t("Access Denied"))}))(r,n,s)},Xe=()=>(t,i,r)=>{e(e=>Ne(void 0,void 0,void 0,function*(){yield(e=>Ne(void 0,void 0,void 0,function*(){var t;if(e.req.access&&e.req.user)return e.next();const{authService:i}=e.app,{access:r,user:n}=null!==(t=yield i.apiAuth(e).catch(t=>{e.error(t)}))&&void 0!==t?t:{};r&&n&&e.next()}))(e)}))(t,i,r)},Qe=i(({ctx:e})=>{var t;return null===(t=e.req)||void 0===t?void 0:t.access}),Ze=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.groups)&&void 0!==r?r:[]).includes(t)}),et=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.groups)&&void 0!==i?i:[]}),tt=i(({ctx:e,key:t})=>{var i,r;return(null!==(r=null===(i=e.req)||void 0===i?void 0:i.permissions)&&void 0!==r?r:[]).includes(t)}),it=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.permissions)&&void 0!==i?i:[]}),rt=i(({ctx:e})=>{var t;return null!==(t=e.getHeader(Env.TENANT_HEADER))&&void 0!==t?t:null}),nt=i(({ctx:e})=>{var t,i;return null!==(i=null===(t=e.req)||void 0===t?void 0:t.tenants)&&void 0!==i?i:[]}),st=i(({ctx:e,key:t})=>{var i;return t&&e.req.user&&t in e.req.user?e.req.user[t]:null===(i=e.req)||void 0===i?void 0:i.user}),ot={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,ServerError:-32e3,InvalidSession:-32001};class McpError extends r{constructor(e,t=ot.ServerError,i=200,r){super(e,i),this.code=t,this.data=r,this.name=this.constructor.name}}class McpParseError extends McpError{constructor(e="Parse error",t){super(e,ot.ParseError,400,t)}}class McpInvalidRequestError extends McpError{constructor(e="Invalid Request",t){super(e,ot.InvalidRequest,400,t)}}class McpMethodNotFoundError extends McpError{constructor(e){super(`Method not found: ${e}`,ot.MethodNotFound,200)}}class McpInvalidParamsError extends McpError{constructor(e="Invalid params",t){super(e,ot.InvalidParams,200,t)}}class McpInternalError extends McpError{constructor(e="Internal error",t){super(e,ot.InternalError,200,t)}}class McpServerError extends McpError{constructor(e="Server error",t){super(e,ot.ServerError,500,t)}}class McpInvalidSessionError extends McpError{constructor(e="Invalid MCP session",t=404){super(e,ot.InvalidSession,t)}}class McpToolNotFoundError extends McpError{constructor(e){super("Tool not found",ot.InvalidParams,200,{toolName:e})}}const dt=e=>C(e)||j(e),at=(e,t)=>({jsonrpc:"2.0",id:e,result:t}),lt=(e,t)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t.code,message:t.message},void 0!==t.data?{data:t.data}:{})}),ut=(e,t,i,r)=>({jsonrpc:"2.0",id:e,error:Object.assign({code:t,message:i},void 0!==r?{data:r}:{})}),ct=e=>{if(!x(e))throw new McpInvalidRequestError("Invalid Request");if("2.0"!==e.jsonrpc)throw new McpInvalidRequestError("Invalid JSON-RPC version");if(!C(e.method))throw new McpInvalidRequestError("Invalid method");if(void 0!==e.id&&!dt(e.id))throw new McpInvalidRequestError("Invalid id");return e},pt=["2025-11-25","2025-06-18"],vt=pt[0],ht="MCP-Protocol-Version",gt="MCP-Session-Id",yt=["POST","DELETE","OPTIONS"],mt=yt.join(", "),Et=["Content-Type","Accept",gt,ht],ft=e=>{if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode},St=e=>{if(ft(e))return{status:400,body:lt(null,new McpParseError("Parse error",{message:e.message}))}};class McpHttpHandler{constructor(e){var t,i;this.sessions=e.sessions,this.tools=e.tools,this.logger=e.logger,this.serverName=null!==(t=e.serverName)&&void 0!==t?t:"andrewcaires-api-mcp",this.serverVersion=null!==(i=e.serverVersion)&&void 0!==i?i:"1.0.0",this.allowedHeaders=this.normalizeAllowedHeaders(e.allowedHeaders).join(", ")}post(e){return Ne(this,void 0,void 0,function*(){var t;let i=null;try{const r=ct(this.getBody(e));if(i=null!==(t=r.id)&&void 0!==t?t:null,"initialize"===r.method)return this.withTransportHeaders(this.initialize(r.id,r.params,e));if("notifications/initialized"===r.method)return this.withTransportHeaders(this.initialized(r.id,r.params,e));if("ping"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withSession(r.id,e,e=>({status:200,body:at(e,{})})));if("tools/list"===r.method)return this.validateObjectParams(r.params),this.withTransportHeaders(this.withInitializedSession(r.id,e,e=>({status:200,body:at(e,{tools:this.tools.list()})})));if("tools/call"===r.method)return this.withTransportHeaders(yield this.callTool(r.id,r.params,e));if(void 0===r.id)return this.withTransportHeaders({status:202});throw new McpMethodNotFoundError(r.method)}catch(e){return this.withTransportHeaders(this.errorResponse(i,e))}})}delete(e){const t=this.getHeader(e,gt);if(!t)return this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError(`${gt} header is required`,400)));return this.sessions.get(t)?(this.sessions.delete(t),this.withTransportHeaders({status:204})):this.withTransportHeaders(this.errorResponse(null,new McpInvalidSessionError))}get(){return this.withTransportHeaders({status:405})}options(){return this.withTransportHeaders({status:204})}initialize(e,t,i){const r=this.requireRequestId({jsonrpc:"2.0",id:e,method:"initialize",params:t}),n=this.negotiateProtocolVersion(t),s=this.sessions.create(n);return Object.assign(s,this.getAuthContext(i)),{status:200,headers:{[gt]:s.sessionId,[ht]:s.protocolVersion},body:at(r,{protocolVersion:s.protocolVersion,capabilities:{tools:{listChanged:!1}},serverInfo:{name:this.serverName,version:this.serverVersion}})}}initialized(e,t,i){if(void 0!==e)throw new McpInvalidRequestError("notifications/initialized must not include id");this.validateObjectParams(t);const r=this.requireSession(i);return this.sessions.markInitialized(r.sessionId),{status:202}}callTool(e,t,i){return Ne(this,void 0,void 0,function*(){return this.withInitializedSession(e,i,(e,i)=>Ne(this,void 0,void 0,function*(){var r;const n=this.parseToolCallParams(t),s=Date.now();let o,d=!1;try{const t=yield this.tools.call(n.name,n.arguments,i);return d=!t.isError,o=t.isError?"Tool execution failed":void 0,{status:200,body:at(e,t)}}catch(e){if(e instanceof McpError)throw o=e.message,e;throw o="Internal error",e}finally{null===(r=this.logger)||void 0===r||r.toolCall(Object.assign({sessionId:i.sessionId,toolName:n.name,durationMs:Date.now()-s,success:d},o?{error:o}:{}))}}))})}requireRequestId(e){if(!dt(e.id))throw new McpInvalidRequestError("Request id is required");return e.id}withSession(e,t,i){const r=this.requireRequestId({jsonrpc:"2.0",id:e,method:"session"}),n=this.requireSession(t),s=this.getHeader(t,ht);if(s&&s!==n.protocolVersion)throw new McpInvalidRequestError(`${ht} does not match the initialized session`);return i(r,n)}withInitializedSession(e,t,i){return this.withSession(e,t,(e,t)=>{if(!t.initialized)throw new McpInvalidRequestError("Session not initialized");return i(e,t)})}requireSession(e){const t=this.getHeader(e,gt);if(!t)throw new McpInvalidSessionError(`${gt} header is required`,400);return this.sessions.require(t)}negotiateProtocolVersion(e){if(!x(e)||!C(e.protocolVersion))throw new McpInvalidParamsError("params.protocolVersion is required");return pt.includes(e.protocolVersion)?e.protocolVersion:vt}parseToolCallParams(e){if(!x(e)||!C(e.name))throw new McpInvalidParamsError("params.name is required");return{name:e.name,arguments:e.arguments}}validateObjectParams(e){if(void 0!==e&&!x(e))throw new McpInvalidParamsError("params must be an object")}withTransportHeaders(e){var t;return Object.assign(Object.assign({},e),{headers:Object.assign({Allow:mt,"Access-Control-Allow-Methods":mt,"Access-Control-Allow-Headers":this.allowedHeaders},null!==(t=e.headers)&&void 0!==t?t:{})})}errorResponse(e,t){if(t instanceof McpError)return{status:t.status,body:lt(e,t)};const i=new McpServerError;return{status:i.status,body:lt(e,i)}}getBody(e){return"function"==typeof e.getBody?e.getBody():e.body}getHeader(e,t){var i,r,n;const s=null!==(i=e.req)&&void 0!==i?i:e.request,o=this.getHeaderFromRequest(s,t);if(o)return o;const d=this.getHeaderFromRecord(e.headers,t);if(d)return d;if("function"==typeof e.getHeaders){const i=this.getHeaderFromRecord(e.getHeaders(),t);if(i)return i}return"function"==typeof e.getHeader&&null!==(n=null!==(r=e.getHeader(t))&&void 0!==r?r:e.getHeader(t.toLowerCase()))&&void 0!==n?n:""}getHeaderFromRequest(e,t){if(!e||"object"!=typeof e)return"";const i=e;if("function"==typeof i.get){const e=this.normalizeHeaderValue(i.get(t));if(e)return e}if("function"==typeof i.header){const e=this.normalizeHeaderValue(i.header(t));if(e)return e}return this.getHeaderFromRecord(i.headers,t)}getHeaderFromRecord(e,t){if(!e)return"";const i=t.toLowerCase(),r=Object.keys(e).find(e=>e.toLowerCase()===i),n=r?e[r]:void 0;return this.normalizeHeaderValue(n)}normalizeHeaderValue(e){var t,i,r;return Array.isArray(e)?null!==(i=null===(t=e[0])||void 0===t?void 0:t.toString())&&void 0!==i?i:"":null!==(r=null==e?void 0:e.toString())&&void 0!==r?r:""}normalizeAllowedHeaders(e=[]){const t=["Content-Type","Accept",...e.map(e=>e.toLowerCase()),gt,ht];return t.filter((e,i)=>Boolean(e)&&t.findIndex(t=>t.toLowerCase()===e.toLowerCase())===i)}getAuthContext(e){var t,i,r;const n=null!==(i=null!==(t=e.req)&&void 0!==t?t:e.context)&&void 0!==i?i:{},s=n.user,o="string"==typeof n.userId?n.userId:null===(r=null==s?void 0:s.id)||void 0===r?void 0:r.toString();return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},n.access?{access:n.access}:{}),n.groups?{groups:n.groups}:{}),n.permissions?{permissions:n.permissions}:{}),n.tenants?{tenants:n.tenants}:{}),n.user?{user:n.user}:{}),o?{userId:o}:{})}}class McpSessionStore{constructor(e=18e5,t=()=>Date.now()){this.sessions=new Map,this.ttl=e,this.now=t}create(e){this.cleanup();const t=this.now(),i={sessionId:R(),createdAt:t,expiresAt:t+this.ttl,protocolVersion:e,initialized:!1};return this.sessions.set(i.sessionId,i),i}get(e){this.cleanup();const t=this.sessions.get(e);if(t){if(!this.isExpired(t))return t;this.sessions.delete(e)}}require(e){const t=this.get(e);if(!t)throw new McpInvalidSessionError;return t}markInitialized(e){const t=this.require(e);return t.initialized=!0,t}delete(e){return this.cleanup(),this.sessions.delete(e)}cleanup(){const e=this.now();for(const[t,i]of this.sessions)i.expiresAt<=e&&this.sessions.delete(t)}size(){return this.cleanup(),this.sessions.size}isExpired(e){return e.expiresAt<=this.now()}}const _t=Symbol.for("@andrewcaires/api:mcp:tool"),Ot=e=>{if(!C(e.name)||!e.name.trim())throw new Error("MCP tool name is required");if(!C(e.title)||!e.title.trim())throw new Error(`MCP tool "${e.name}" title is required`);if(!C(e.description)||!e.description.trim())throw new Error(`MCP tool "${e.name}" description is required`);if(w(e.input))throw new Error(`MCP tool "${e.name}" input must be declared`)},At=e=>{const t=ye(_t,e,[]);return t.length||"function"==typeof e?t:ye(_t,Object.getPrototypeOf(e),[])},Tt=e=>{const t=[];for(const i of e)for(const e of At(i))t.push(bt(i,e));return t},bt=(e,t)=>{const i=e[t.propertyKey];if(!P(i))throw new Error(`MCP tool "${t.name}" handler was not found`);return Ot(t),Object.assign(Object.assign(Object.assign({name:t.name,title:t.title,description:t.description},void 0!==t.input?{input:t.input}:{}),void 0!==t.output?{output:t.output}:{}),{run:(t,r)=>i.call(e,t,r)})};class McpToolRegistry{constructor(e=[]){this.tools=new Map,e.forEach(e=>this.register(e))}register(e){var t,i;if(Ot(e),this.tools.has(e.name))throw new Error(`Duplicate MCP tool name: ${e.name}`);const r=this.normalizeMcpValidation(null!==(t=e.input)&&void 0!==t?t:{},"object"),n=e.output?this.normalizeMcpValidation(null!==(i=e.output)&&void 0!==i?i:{},"any"):void 0;this.tools.set(e.name,{inputSchema:this.normalizeSchema(r.schema),inputValidation:r.validation,outputSchema:(null==n?void 0:n.schema)?this.normalizeSchema(n.schema):void 0,outputValidation:null==n?void 0:n.validation,tool:e})}list(){return Array.from(this.tools.values()).map(({tool:e})=>{var t,i,r,n;return Object.assign({name:e.name,title:e.title,description:e.description,inputSchema:null!==(i=null===(t=this.tools.get(e.name))||void 0===t?void 0:t.inputSchema)&&void 0!==i?i:{}},(null===(r=this.tools.get(e.name))||void 0===r?void 0:r.outputSchema)?{outputSchema:null===(n=this.tools.get(e.name))||void 0===n?void 0:n.outputSchema}:{})})}call(e,t,i){return Ne(this,void 0,void 0,function*(){var r;const n=this.tools.get(e);if(!n)throw new McpToolNotFoundError(e);const s=null!=t?t:{};if(!x(s))return this.toolInputValidationError(["arguments must be an object"]);const o=Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({session:i},i.access?{access:i.access}:{}),i.groups?{groups:i.groups}:{}),i.permissions?{permissions:i.permissions}:{}),i.tenants?{tenants:i.tenants}:{}),i.user?{user:i.user}:{}),i.userId?{userId:i.userId}:{});let d=s;const a=this.validateAdditionalProperties(n.inputSchema,s);if(a.length)return this.toolInputValidationError(a);if(n.inputValidation){const e=n.inputValidation.validate(s,o);if(e.error)return this.toolInputValidationError([e.error]);d=null!==(r=e.value)&&void 0!==r?r:{}}try{const e=yield n.tool.run(d,o);if(!n.outputValidation&&this.isCallToolResult(e))return e;let t=e;if(n.outputValidation){const i=n.outputValidation.validate(e,o);if(i.error)return this.outputValidationError();t=i.value}return{content:[{type:"text",text:JSON.stringify(t)}],structuredContent:t}}catch(e){return{isError:!0,content:[{type:"text",text:"Tool execution failed."}]}}})}isCallToolResult(e){return x(e)&&M(e.content)}normalizeMcpValidation(e,t="object"){if(D(e)){const t=N.object(e).parse();return{schema:t.toSchema(),validation:t}}const i="object"===t?N.object({}).parse():N.any();return{schema:i.toSchema(),validation:i}}normalizeSchema(e){if(M(e))return e.map(e=>this.normalizeSchema(e));if(!x(e))return e;const t=Object.fromEntries(Object.entries(e).map(([e,t])=>[e,this.normalizeSchema(t)]));if(M(t.type)){const e=t.type.filter(e=>"null"!==e);t.type=1===e.length?e[0]:e}return t}outputValidationError(){return{isError:!0,content:[{type:"text",text:"Tool output validation failed."}]}}toolInputValidationError(e){return{isError:!0,content:[{type:"text",text:"Invalid tool arguments."}],structuredContent:{errors:e}}}validateAdditionalProperties(e,t){if("object"!==e.type||!1!==e.additionalProperties||!x(e.properties))return[];const i=Object.keys(e.properties);return Object.keys(t).filter(e=>!i.includes(e)).map(e=>`additional property "${e}" is not allowed`)}}const wt=e=>(Ot(e),(t,i)=>{Pt(i)?i.addInitializer(function(){It(this.constructor,i.name,e)}):It(t,i,e)}),Pt=e=>"object"==typeof e&&null!==e&&"kind"in e&&"method"===e.kind&&"name"in e&&"addInitializer"in e,It=(e,t,i)=>{const r=ye(_t,e,[]),n=Object.assign(Object.assign({},i),{propertyKey:t});r.some(e=>e.propertyKey===n.propertyKey&&e.name===n.name)||r.push(n)},xt=(e,t,i)=>{var r,s,o,d,a,l,u,c,p,v,h;const g=i.ctx instanceof n?i.ctx:null,y=null!==(r=null==g?void 0:g.id)&&void 0!==r?r:null,m=null!==(a=null!==(d=null===(o=null===(s=null==g?void 0:g.req)||void 0===s?void 0:s.user)||void 0===o?void 0:o.id)&&void 0!==d?d:i.user_id)&&void 0!==a?a:null,E={type:e,model:null!==(l=null==t?void 0:t.getTableName())&&void 0!==l?l:null,source:null!==(u=Env.BASE_NAME)&&void 0!==u?u:"",request_id:y,user_id:m};return g?Object.assign(Object.assign({},E),{full_url:null!==(c=g.getUrl())&&void 0!==c?c:"",ip_address:null!==(p=g.getIp())&&void 0!==p?p:"",user_agent:null!==(h=null===(v=g.req)||void 0===v?void 0:v.headers["user-agent"])&&void 0!==h?h:""}):E},Ct=e=>{const t=k(e),i=t.primaryKeyAttribute;return{model:t,record_id:i?e.getDataValue(i):null}},jt={afterCreate:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ct(e),n=Object.entries(e.toJSON()),s=Object.fromEntries(n.filter(([e])=>!Env.AUDIT_IGNORE.includes(e)));yield Ut.create(Object.assign(Object.assign({},xt(Fe.CREATE,i,t)),{record:r,currently:s})).catch(Z.catch)}),afterUpdate:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ct(e),n={},s={},o=e.changed();o&&o.length&&o.filter(e=>!Env.AUDIT_IGNORE.includes(e)).forEach(t=>{n[t]=e.getDataValue(t),s[t]=e.previous(t)}),yield Ut.create(Object.assign(Object.assign({},xt(Fe.UPDATE,i,t)),{record:r,currently:n,previously:s})).catch(Z.catch)}),afterDestroy:(e,t)=>Ne(void 0,void 0,void 0,function*(){const{model:i,record_id:r}=Ct(e),n=Object.entries(e.toJSON()),s=Object.fromEntries(n.filter(([e])=>!Env.AUDIT_IGNORE.includes(e)));yield Ut.create(Object.assign(Object.assign({},xt(Fe.DELETE,i,t)),{record:r,currently:s})).catch(Z.catch)})},Rt=e=>(w(e)&&(e=Env.DATABASE_AUDIT),ne(e?jt:{}));let Mt=class RegisterModel extends ue{};Re([se.Id(7),De("design:type",String)],Mt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Mt.prototype,"hash",void 0),Re([se.FullDate(),De("design:type",Number)],Mt.prototype,"expired_at",void 0),Re([se.Boolean(),De("design:type",Boolean)],Mt.prototype,"active",void 0),Re([se.CreatedAt(),De("design:type",Date)],Mt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Mt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Mt.prototype,"deleted_at",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],Mt.prototype,"user_id",void 0),Mt=Re([de(He),ae("register"),le("5.3.6")],Mt);let Dt=class UserAuthModel extends ue{};Re([se.Id(7),De("design:type",String)],Dt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Dt.prototype,"hash",void 0),Re([se.String(),De("design:type",String)],Dt.prototype,"ip_address",void 0),Re([se.String(),De("design:type",String)],Dt.prototype,"user_agent",void 0),Re([se.FullDate(),De("design:type",Object)],Dt.prototype,"revoked_at",void 0),Re([se.CreatedAt(),De("design:type",Date)],Dt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Dt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Dt.prototype,"deleted_at",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],Dt.prototype,"user_id",void 0),Dt=Re([de(He),ae("users_auth"),le("5.3.6")],Dt);let Nt=class PermissionModel extends ue{};Re([se.Id(7),De("design:type",String)],Nt.prototype,"id",void 0),Re([se.String(),ce(),De("design:type",String)],Nt.prototype,"name",void 0),Re([se.Text(),De("design:type",String)],Nt.prototype,"description",void 0),Re([se.Boolean(),De("design:type",Boolean)],Nt.prototype,"active",void 0),Re([se.Json(),pe(()=>({})),De("design:type",Object)],Nt.prototype,"metadata",void 0),Re([se.CreatedAt(),De("design:type",Date)],Nt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Nt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Nt.prototype,"deleted_at",void 0),Re([oe.HasMany(()=>kt),De("design:type",Array)],Nt.prototype,"groups_permissions",void 0),Nt=Re([de(He),ae("permission"),Rt(),le("5.3.6")],Nt);let kt=class GroupPermissionModel extends ue{};Re([se.Id(7),De("design:type",String)],kt.prototype,"id",void 0),Re([se.CreatedAt(),De("design:type",Date)],kt.prototype,"created_at",void 0),Re([oe.BelongsTo(()=>Ht),De("design:type",String)],kt.prototype,"group_id",void 0),Re([oe.BelongsTo(()=>Nt),De("design:type",String)],kt.prototype,"permission_id",void 0),kt=Re([de(He),ae("groups_permissions"),Rt(),le("5.3.6")],kt);let Ht=class GroupModel extends ue{};Re([se.Id(7),De("design:type",String)],Ht.prototype,"id",void 0),Re([se.String(),ce(),De("design:type",String)],Ht.prototype,"name",void 0),Re([se.Text(),De("design:type",String)],Ht.prototype,"description",void 0),Re([se.Enum(Le),pe(Le.SYSTEM),De("design:type",String)],Ht.prototype,"type",void 0),Re([se.Boolean(),De("design:type",Boolean)],Ht.prototype,"active",void 0),Re([se.Json(),pe(()=>({})),De("design:type",Object)],Ht.prototype,"metadata",void 0),Re([se.CreatedAt(),De("design:type",Date)],Ht.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Ht.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Ht.prototype,"deleted_at",void 0),Re([oe.HasMany(()=>qt),De("design:type",Array)],Ht.prototype,"users_groups",void 0),Re([oe.HasMany(()=>kt),De("design:type",Array)],Ht.prototype,"groups_permissions",void 0),Ht=Re([de(He),ae("group"),Rt(),le("5.3.6")],Ht);let Ft=class UserTenantModel extends ue{};Re([se.Id(7),De("design:type",String)],Ft.prototype,"id",void 0),Re([se.CreatedAt(),De("design:type",Date)],Ft.prototype,"created_at",void 0),Re([oe.BelongsTo(()=>Lt),De("design:type",String)],Ft.prototype,"tenant_id",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],Ft.prototype,"user_id",void 0),Ft=Re([de(He),ae("users_tenants"),Rt(),le("5.3.6")],Ft);let Lt=class TenantModel extends ue{};Re([se.Id(7),De("design:type",String)],Lt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Lt.prototype,"name",void 0),Re([se.Text(),De("design:type",String)],Lt.prototype,"description",void 0),Re([se.Enum(Ke),pe(Ke.ACTIVE),De("design:type",String)],Lt.prototype,"status",void 0),Re([se.Json(),pe(()=>({})),De("design:type",Object)],Lt.prototype,"metadata",void 0),Re([se.CreatedAt(),De("design:type",Date)],Lt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Lt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Lt.prototype,"deleted_at",void 0),Re([oe.HasMany(()=>Ft),De("design:type",Array)],Lt.prototype,"users_tenants",void 0),Lt=Re([de(He),ae("tenant"),Rt(),le("5.3.6")],Lt);let qt=class UserGroupModel extends ue{};Re([se.Id(7),De("design:type",String)],qt.prototype,"id",void 0),Re([se.CreatedAt(),De("design:type",Date)],qt.prototype,"created_at",void 0),Re([oe.BelongsTo(()=>Ht),De("design:type",String)],qt.prototype,"group_id",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],qt.prototype,"user_id",void 0),Re([oe.BelongsTo(()=>Lt),De("design:type",String)],qt.prototype,"tenant_id",void 0),qt=Re([de(He),ae("users_groups"),Rt(),le("5.3.6")],qt);let Kt=class UserPasswordModel extends ue{};Re([se.Id(7),De("design:type",String)],Kt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Kt.prototype,"hash",void 0),Re([se.FullDate(),De("design:type",Object)],Kt.prototype,"revoked_at",void 0),Re([se.CreatedAt(),De("design:type",Date)],Kt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Kt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Kt.prototype,"deleted_at",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],Kt.prototype,"user_id",void 0),Kt=Re([de(He),ae("users_password"),Rt(),le("5.3.6")],Kt);let Bt=class UserModel extends ue{};Re([se.Id(7),De("design:type",String)],Bt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Bt.prototype,"name",void 0),Re([se.String(),De("design:type",String)],Bt.prototype,"username",void 0),Re([se.String(),De("design:type",String)],Bt.prototype,"email",void 0),Re([se.Text(),De("design:type",String)],Bt.prototype,"notes",void 0),Re([se.Enum(Be),pe(Be.ACTIVE),De("design:type",String)],Bt.prototype,"status",void 0),Re([se.Json(),pe(()=>({})),De("design:type",Object)],Bt.prototype,"metadata",void 0),Re([se.CreatedAt(),De("design:type",Date)],Bt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Bt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Bt.prototype,"deleted_at",void 0),Re([oe.HasMany(()=>Ut),De("design:type",Array)],Bt.prototype,"audits",void 0),Re([oe.HasMany(()=>Dt),De("design:type",Array)],Bt.prototype,"users_auths",void 0),Re([oe.HasMany(()=>Mt),De("design:type",Array)],Bt.prototype,"registers",void 0),Re([oe.HasMany(()=>qt),De("design:type",Array)],Bt.prototype,"users_groups",void 0),Re([oe.HasMany(()=>Kt),De("design:type",Array)],Bt.prototype,"users_passwords",void 0),Re([oe.HasMany(()=>Ft),De("design:type",Array)],Bt.prototype,"users_tenants",void 0),Bt=Re([de(He),ae("user"),Rt(),le("5.3.6")],Bt);let Ut=class AuditModel extends ue{};Re([se.Id(7),De("design:type",String)],Ut.prototype,"id",void 0),Re([se.Enum(Fe),De("design:type",String)],Ut.prototype,"type",void 0),Re([se.String(),De("design:type",String)],Ut.prototype,"model",void 0),Re([se.String(),De("design:type",String)],Ut.prototype,"record",void 0),Re([se.Json(),De("design:type",Object)],Ut.prototype,"currently",void 0),Re([se.Json(),De("design:type",Object)],Ut.prototype,"previously",void 0),Re([se.String(36),De("design:type",String)],Ut.prototype,"request_id",void 0),Re([se.Text(),De("design:type",String)],Ut.prototype,"full_url",void 0),Re([se.String(),De("design:type",String)],Ut.prototype,"ip_address",void 0),Re([se.Text(),De("design:type",String)],Ut.prototype,"user_agent",void 0),Re([se.String(),De("design:type",String)],Ut.prototype,"source",void 0),Re([se.FullDate(),De("design:type",Object)],Ut.prototype,"reverted_at",void 0),Re([se.CreatedAt(),De("design:type",Date)],Ut.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Ut.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Ut.prototype,"deleted_at",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],Ut.prototype,"user_id",void 0),Ut=Re([de(He),ae("audit"),le("5.3.6")],Ut);let Vt=class ConfigModel extends ue{};Re([se.Id(7),De("design:type",String)],Vt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Vt.prototype,"key",void 0),Re([se.Text(),De("design:type",String)],Vt.prototype,"value",void 0),Re([se.CreatedAt(),De("design:type",Date)],Vt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Vt.prototype,"updated_at",void 0),Vt=Re([de(He),ae("configs"),le("5.3.6")],Vt);let $t=class ForgotModel extends ue{};Re([se.Id(7),De("design:type",String)],$t.prototype,"id",void 0),Re([se.String(),De("design:type",String)],$t.prototype,"secret",void 0),Re([se.FullDate(),De("design:type",Number)],$t.prototype,"expired_at",void 0),Re([se.Boolean(),De("design:type",Boolean)],$t.prototype,"active",void 0),Re([se.CreatedAt(),De("design:type",Date)],$t.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],$t.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],$t.prototype,"deleted_at",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],$t.prototype,"user_id",void 0),$t=Re([de(He),ae("forgot"),le("5.3.6")],$t);let zt=class LogModel extends ue{};Re([se.Id(7),De("design:type",String)],zt.prototype,"id",void 0),Re([se.Enum(qe),pe(qe.INFO),De("design:type",String)],zt.prototype,"level",void 0),Re([se.Text(),De("design:type",String)],zt.prototype,"message",void 0),Re([se.String(),De("design:type",String)],zt.prototype,"source",void 0),Re([se.CreatedAt(),De("design:type",Date)],zt.prototype,"created_at",void 0),zt=Re([de(He),ae("log"),le("5.3.6")],zt);let Gt=class MigrationModel extends ue{};Re([se.Id(7),De("design:type",String)],Gt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Gt.prototype,"model",void 0),Re([se.String(),De("design:type",String)],Gt.prototype,"version",void 0),Re([se.CreatedAt(),De("design:type",Date)],Gt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Gt.prototype,"updated_at",void 0),Gt=Re([de(He),ae("migration"),le("5.3.6")],Gt);let Yt=class SecretModel extends ue{};Re([se.Id(7),De("design:type",String)],Yt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Yt.prototype,"key",void 0),Re([se.Text(),De("design:type",String)],Yt.prototype,"hash",void 0),Re([se.CreatedAt(),De("design:type",Date)],Yt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Yt.prototype,"updated_at",void 0),Yt=Re([de(He),ae("secret"),le("5.3.6")],Yt);let Wt=class SessionModel extends ue{};Re([se.Id(7),De("design:type",String)],Wt.prototype,"id",void 0),Re([se.Json(),De("design:type",Object)],Wt.prototype,"data",void 0),Re([se.FullDate(),De("design:type",Date)],Wt.prototype,"expired_at",void 0),Re([se.CreatedAt(),De("design:type",Date)],Wt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Wt.prototype,"updated_at",void 0),Wt=Re([de(He),ae("session"),le("5.3.6")],Wt);let Jt=class UserKeyModel extends ue{};Re([se.Id(7),De("design:type",String)],Jt.prototype,"id",void 0),Re([se.String(),De("design:type",String)],Jt.prototype,"name",void 0),Re([se.String(),De("design:type",String)],Jt.prototype,"prefix",void 0),Re([se.Text(),De("design:type",String)],Jt.prototype,"hash",void 0),Re([se.FullDate(),De("design:type",Object)],Jt.prototype,"last_used_at",void 0),Re([se.FullDate(),De("design:type",Object)],Jt.prototype,"expires_at",void 0),Re([se.FullDate(),De("design:type",Object)],Jt.prototype,"revoked_at",void 0),Re([se.CreatedAt(),De("design:type",Date)],Jt.prototype,"created_at",void 0),Re([se.UpdatedAt(),De("design:type",Date)],Jt.prototype,"updated_at",void 0),Re([se.DeletedAt(),De("design:type",Object)],Jt.prototype,"deleted_at",void 0),Re([oe.BelongsTo(()=>Bt),De("design:type",String)],Jt.prototype,"user_id",void 0),Jt=Re([de(He),ae("users_key"),Rt(),le("5.3.6")],Jt);class Log{static error(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("error",e,t,i)})}static info(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("info",e,t,i)})}static warn(e,t,i){return Ne(this,void 0,void 0,function*(){yield this.writeRaw("warn",e,t,i)})}static writeRaw(e,t,i,r){return Ne(this,void 0,void 0,function*(){var n;r&&Z.console(null!==(n=this.colors[e])&&void 0!==n?n:ee.White,e,t),He&&(yield zt.create({level:e,message:t,source:null!=i?i:""}).catch(Z.catch))})}}Log.colors={error:ee.Red,info:ee.Cyan,warn:ee.Yellow};class Loggable{get log(){return e=>Loggable.logInfo(this,e)}static get log(){return e=>this.logInfo(this,e)}get error(){return e=>Loggable.logError(this,e)}static get error(){return e=>this.logError(this,e)}static logError(e,t){var i,r;Log.error(null!==(r=null!==(i=null==t?void 0:t.message)&&void 0!==i?i:t)&&void 0!==r?r:"",this.source(e),Env.CONSOLE_ERROR)}static logInfo(e,t){Log.info(null!=t?t:"",this.source(e),Env.CONSOLE_ERROR)}static source(e){var t,i,r;const n=null!==(r=null!==(i=null===(t=null==e?void 0:e.constructor)||void 0===t?void 0:t.name)&&void 0!==i?i:null==e?void 0:e.name)&&void 0!==r?r:"null";return Env.BASE_NAME?`${Env.BASE_NAME}.${n}`:n}}class Config extends Loggable{static all(e){return Ne(this,void 0,void 0,function*(){var t;const i=null!==(t=yield Vt.findAll({attributes:["key","value"],where:(null==e?void 0:e.length)?{key:{[ve.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[];return Object.fromEntries(i.map(e=>[e.key,e.value]))})}static del(e){return Ne(this,void 0,void 0,function*(){return((yield Vt.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return Ne(this,arguments,void 0,function*(e,t=""){const[i]=(yield Vt.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];return i?i.value:t})}static set(e,t){return Ne(this,void 0,void 0,function*(){const[i,r]=(yield Vt.findOrCreate({where:{key:e},defaults:{key:e,value:t}}).catch(this.error))||[];i&&!r&&(yield i.update({value:t}).catch(this.error))})}}class Secret extends Loggable{static all(e){return Ne(this,void 0,void 0,function*(){var t;return(null!==(t=yield Yt.findAll({attributes:["key"],where:(null==e?void 0:e.length)?{key:{[ve.in]:e}}:{}}).catch(this.error))&&void 0!==t?t:[]).map(e=>e.key)})}static del(e){return Ne(this,void 0,void 0,function*(){return((yield Yt.destroy({where:{key:e}}).catch(this.error))||0)>0})}static get(e){return Ne(this,arguments,void 0,function*(e,t=""){var i;this.init();const r=this.encryptor.encrypt(t),[n]=(yield Yt.findOrCreate({where:{key:e},defaults:{key:e,value:r}}).catch(this.error))||[];return n&&null!==(i=this.encryptor.decrypt(n.hash))&&void 0!==i?i:t})}static set(e,t){return Ne(this,void 0,void 0,function*(){this.init();const i=this.encryptor.encrypt(t),[r,n]=(yield Yt.findOrCreate({where:{key:e},defaults:{key:e,hash:i}}).catch(this.error))||[];r&&!n&&(yield r.update({hash:i}).catch(this.error))})}static init(){this.encryptor||(this.encryptor=new te(Env.ENCRYPTION_SECRET))}}class SessionStore extends fe{constructor(){super(),this.all=e=>Ne(this,void 0,void 0,function*(){e=e||H;const t=yield Wt.findAll({attributes:["id","expired_at"],where:{expired_at:{[ve.gte]:new Date}}}).catch(t=>(e(t),null));t&&e(null,t.map(e=>e.id)),e()}),this.clear=e=>Ne(this,void 0,void 0,function*(){yield Wt.destroy().catch(Z.catch),e&&e()}),this.destroy=(e,t)=>Ne(this,void 0,void 0,function*(){yield Wt.destroy({where:{id:e}}).catch(Z.catch),t&&t()}),this.expired=()=>Ne(this,void 0,void 0,function*(){yield Wt.destroy({where:{expired_at:{[ve.lt]:new Date}}}).catch(Z.catch)}),this.get=(e,t)=>Ne(this,void 0,void 0,function*(){t=t||H;const i=yield Wt.findOne({where:{id:e,expired_at:{[ve.gte]:new Date}}}).catch(e=>(t(e),null));if(i){if(i.data.cookie){if(new Date(i.data.cookie.expires).getTime()<=Date.now())return yield i.destroy().catch(Z.catch),void t(null)}t(null,i.data)}else t(null)}),this.length=e=>Ne(this,void 0,void 0,function*(){e&&e(null,(yield Wt.count().catch(Z.catch))||0)}),this.set=(e,t,i)=>Ne(this,void 0,void 0,function*(){i=i||H;const r=new Date;r.setTime(r.getTime()+Env.API_SESSION_LIFETIME);const[n,s]=(yield Wt.findOrCreate({where:{id:e},defaults:{id:e,data:t,expired_at:r}}).catch(Z.catch))||[];n?(s||(n.data=t,n.expired_at=r,yield n.save().catch(Z.catch)),i()):i()}),setInterval(this.expired,6e4)}}let Xt=class Service{};Xt=Re([me(Loggable)],Xt);let Qt=class UserService extends Xt{constructor(){super(...arguments),this.hashOptions={algorithm:Env.PASSWORD_ALGORITHM,memoryCost:Env.PASSWORD_MEMORY_COST,parallelism:Env.PASSWORD_PARALLELISM,timeCost:Env.PASSWORD_TIME_COST}}createPassword(e,t,i){return Ne(this,void 0,void 0,function*(){yield Kt.update({revoked_at:new Date},{where:{revoked_at:null,user_id:e}}).catch(this.error);const r=Ae(t+Env.PASSWORD_PEPPER,this.hashOptions);yield Kt.create({hash:r,user_id:e},Object.assign({},{ctx:i})).catch(this.error)})}getGroups(e,t){return Ne(this,void 0,void 0,function*(){var i;return F((null!==(i=yield Ht.findAll({attributes:["name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||L(t)?{tenant_id:t}:{})}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name))})}getPermissions(e,t){return Ne(this,void 0,void 0,function*(){var i;return(null!==(i=yield Nt.findAll({attributes:["name"],where:{active:!0},include:[{association:"groups_permissions",required:!0,include:[{association:"group",required:!0,attributes:["id","name"],where:{active:!0},include:[{association:"users_groups",required:!0,where:Object.assign({user_id:e},t||L(t)?{tenant_id:t}:{})}]}]}]}).catch(this.error))&&void 0!==i?i:[]).map(e=>e.name)})}getTenants(e){return Ne(this,void 0,void 0,function*(){var t;return(null!==(t=yield Lt.findAll({attributes:["id","name"],where:{status:Ke.ACTIVE},include:[{association:"users_tenants",required:!0,where:{user_id:e}}]}).catch(this.error))&&void 0!==t?t:[]).map(e=>({id:e.id,name:e.name}))})}};Qt=Re([Ee()],Qt);let Zt=class AuthService extends Xt{constructor(){super(),this.options={algorithm:"HS256",expiresIn:`${Env.TOKEN_TTL}ms`},this.userAttributes={exclude:["username","notes","deleted_at"]},this.userService=new Qt}createApiKey(e,t,i,r){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_PEPPER)throw new s("Authentication service unavailable");const n=`sk_${Env.TOKEN_PREFIX}_${q(6)}`,o=`${n}.${K()}`,d=_e("sha256",Env.TOKEN_PEPPER).update(o).digest("hex");if(!(yield Jt.create({name:t,prefix:n,hash:d,expires_at:i,user_id:r.id},Object.assign({},{ctx:e})).catch(this.error)))throw new s("API key could not be created");return o})}createApiToken(e,t){return Ne(this,void 0,void 0,function*(){var i;if(!Env.TOKEN_SECRET)throw new s("Authentication service unavailable");const{id:r}=t,n=K(),o=yield Dt.create({hash:n,user_id:r},Object.assign({},{ctx:e})).catch(this.error);if(!o)throw new s;const d=Se.sign({id:r,hash:n},Env.TOKEN_SECRET,this.options);if(o.user_agent=null!==(i=e.getHeader("user-agent"))&&void 0!==i?i:"",o.ip_address=e.getIp(),!(yield o.save().catch(this.error)))throw new s("Authentication service unavailable");return{token:d}})}renewApiToken(e){return Ne(this,void 0,void 0,function*(){const{id:i,hash:r}=yield this.verifyJwt(e,Env.TOKEN_TTL_RENEW/1e3);if(!i||!r)throw new t("Invalid API token");const n=yield Dt.findOne({where:{hash:r},include:[{association:"user",required:!0,attributes:this.userAttributes,where:{id:i,status:Be.ACTIVE}}]}).catch(this.error);if(!n||!n.user)throw new t("Invalid API token");if(n.revoked_at)throw new t("API token revoked");if(n.hash=K(),!(yield n.save().catch(this.error)))throw new s("Authentication service unavailable");return{token:Se.sign({id:i,hash:n.hash},Env.TOKEN_SECRET,this.options)}})}apiAuth(e){return Ne(this,void 0,void 0,function*(){var i,r;const n=e.getHeader(Env.TOKEN_HEADER);let s=e.getCookie(Env.TOKEN_COOKIE);s=`${Env.TOKEN_TYPE} ${s}`;const[o,d]=null!==(r=null===(i=n||s)||void 0===i?void 0:i.split(" "))&&void 0!==r?r:["",""];if(!d||o.toLowerCase()!=Env.TOKEN_TYPE)throw new t("Invalid token type");const a=/^sk_([\w]+)_([\w]{6})\./.test(d),{access:l,user:u}=yield a?this.apiKeyAuth(d):this.apiTokenAuth(d),c=e.getHeader("user-agent");if(l instanceof Dt&&l.user_agent&&l.user_agent!=c)throw new t("Invalid API token");return e.req.access=l,yield this.attachAuthContext(e,u),{access:l,user:u}})}apiKeyAuth(e){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_PEPPER)throw new s("Authentication service unavailable");if(!e)throw new t("API key missing");const[i]=e.split(".");if(!i)throw new t("Invalid API key");const r=yield Jt.findOne({where:{prefix:i},include:[{association:"user",required:!0,attributes:this.userAttributes,where:{status:Be.ACTIVE}}]});if(!r||!r.user)throw new t("Invalid API key");if(r.revoked_at)throw new t("API key revoked");if(r.expires_at&&r.expires_at<new Date)throw new t("API key expired");const n=_e("sha256",Env.TOKEN_PEPPER).update(e).digest("hex");if(!this.safeEqual(n,r.hash))throw new t("Invalid API key");return yield r.update({last_used_at:new Date}).catch(this.error),{access:r,user:r.user}})}apiTokenAuth(e){return Ne(this,void 0,void 0,function*(){const{id:i,hash:r}=yield this.verifyJwt(e);if(!i||!r)throw new t("Invalid API token");const n=yield Dt.findOne({attributes:{exclude:["hash"]},where:{hash:r},include:[{association:"user",required:!0,attributes:this.userAttributes,where:{id:i,status:Be.ACTIVE}}]}).catch(this.error);if(!n||!n.user)throw new t("Invalid API token");if(n.revoked_at)throw new t("API token revoked");return{access:n,user:n.user}})}attachAuthContext(e,i){return Ne(this,void 0,void 0,function*(){e.req.user=i;const r=e.getHeader(Env.TENANT_HEADER),n=yield this.userService.getTenants(i.id);if(r&&!n.find(e=>e.id==r))throw new t("Tenant not found or access denied");const[s,o]=yield Promise.all([this.userService.getGroups(i.id,r),this.userService.getPermissions(i.id,r)]);e.req.groups=s,e.req.permissions=o,e.req.tenants=n})}safeEqual(e,t){const i=Buffer.from(e,"hex"),r=Buffer.from(t,"hex");return i.length===r.length&&Oe(i,r)}verifyJwt(e,i){return Ne(this,void 0,void 0,function*(){if(!Env.TOKEN_SECRET)throw new s("Authentication service unavailable");if(!e||e.split(".").length<3)throw new t("Invalid token");try{return Se.verify(e,Env.TOKEN_SECRET,{algorithms:["HS256"],clockTolerance:i})}catch(e){throw new t("Invalid token")}})}};Zt=Re([Ee(),De("design:paramtypes",[])],Zt);class ModelService extends Xt{constructor(e,t){var i,r;super(),this.attributes=[],this.permissions=[],this.search=[],this.model=e,(null==t?void 0:t.permissions)&&(this.permissions=t.permissions);const n=Object.keys(e.getAttributes());this.attributes=this.filterAttributes(n,null!==(i=null==t?void 0:t.attributes)&&void 0!==i?i:[]),this.search=this.filterAttributes(n,null!==(r=null==t?void 0:t.search)&&void 0!==r?r:this.attributes)}applySelect(e,t,i){if(!t)return;const r=null==e?void 0:e.getQuery(i?`${i}_select`:"select"),n=t.attributes,s=e=>n.includes(e);t.attributes=[],C(r)&&r.length&&t.attributes.push(...r.split(/\s*,\s*/g).filter(s)),t.attributes.length||(t.attributes=n)}applyOrders(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("asc"),r=null==e?void 0:e.getQuery("desc"),n=[],s=t.attributes,o=e=>s.includes(e);C(i)&&i.length&&n.push(...i.split(/\s*,\s*/g).filter(o).map(e=>[e,"ASC"])),C(r)&&r.length&&n.push(...r.split(/\s*,\s*/g).filter(o).map(e=>[e,"DESC"])),n.length&&(t.order=n)}applyPagination(e,t){if(!t)return;const i=null==e?void 0:e.getQuery("limit"),r=null==e?void 0:e.getQuery("offset");w(t.limit)&&(t.limit=Env.MODEL_LIMIT,C(i)&&(t.limit=parseInt(i)||0),t.limit=B(t.limit,-1,Env.MODEL_LIMIT_MAX)),t.limit<0&&(t.limit=void 0),C(r)&&(t.offset=parseInt(r)||0,t.offset<0&&(t.offset=void 0))}applySearch(e,t){var i;if(!t)return;const r=null==e?void 0:e.getQuery("search");r&&C(r)&&(t.where=Object.assign(Object.assign({},null!==(i=t.where)&&void 0!==i?i:{}),{[ve.or]:this.search.map(e=>({[e]:{[ve.substring]:r}}))}))}applyWhere(e,t,i){var r,n;if(!t)return null;const s=null==e?void 0:e.getQuery(i?`${i}_where`:"where");if(!C(s))return null;const d=t.attributes,a=he.parse(d,s);return w(a.error)?(t.where=Object.assign(Object.assign({},null!==(r=t.where)&&void 0!==r?r:{}),null!==(n=a.value)&&void 0!==n?n:{}),null):new o(a.error.join(", "))}countAll(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,options:n={}}=e,s=U({},n);s.attributes=this.getAttributes(null!==(t=null==s?void 0:s.attributes)&&void 0!==t?t:[]),this.applySearch(r,s);const o=this.applyWhere(r,s);if(o)return null==r||r.error(o),0;this.applySelect(r,s);const a=null!==(i=yield this.model.count(Object.assign(Object.assign({},s),{distinct:!!s.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error))&&void 0!==i?i:0;return null==r||r.prepare(d.OK,{count:a}),a})}create(e){return Ne(this,void 0,void 0,function*(){var t,i;const{body:r={},ctx:n,options:o={}}=e,a=U({},o),l=yield this.model.create(Object.assign({},U({},null!==(i=null===(t=null==n?void 0:n.req)||void 0===t?void 0:t.body)&&void 0!==i?i:{},r)),Object.assign(Object.assign({},a),{ctx:n})).catch(this.error);if(!l)return null==n||n.error(new s),null;const{primaryKeyAttribute:u}=this.model;return null==n||n.prepare(d.OK,{[u]:l.getDataValue(u)}),l})}delete(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,id:n,options:s={}}=e,{primaryKeyAttribute:o}=this.model,d=null!==(t=null==r?void 0:r.getParam(o))&&void 0!==t?t:n;if(w(d))return null==r||r.error(new a),0;const u=U({},s),c=yield this.model.destroy(Object.assign(Object.assign(Object.assign({},u),{where:{[ve.and]:Object.assign({[o]:d},null!==(i=null==u?void 0:u.where)&&void 0!==i?i:{})},individualHooks:!0}),{ctx:r})).catch(this.error);return c?(null==r||r.success("OK"),c):(null==r||r.error(new l),0)})}filterAttributes(e,t){if(M(t))return t.length?t.filter(t=>C(t)&&e.includes(t)):e;const{exclude:i,include:r}=t,n=w(r)?e:r.filter(t=>C(t)&&e.includes(t)),s=null!=i?i:[];return s.length?n.filter(e=>!s.includes(e)):n}findAll(e){return Ne(this,void 0,void 0,function*(){var t,i;const{ctx:r,callback:n,options:s={},query:o=!0}=e,a=U({},s);if(a.attributes=this.getAttributes(null!==(t=null==a?void 0:a.attributes)&&void 0!==t?t:[]),o&&this.applySelect(r,a),this.applyOrders(r,a),this.applyPagination(r,a),(null!==(i=null==a?void 0:a.limit)&&void 0!==i?i:0)>Env.MODEL_LIMIT_MAX&&(a.limit=Env.MODEL_LIMIT_MAX),this.applySearch(r,a),o){const e=this.applyWhere(r,a);if(e)return null==r||r.error(e),{count:0,records:[]}}const[l,u]=yield Promise.all([this.model.count(Object.assign(Object.assign({},a),{distinct:!!a.include,col:this.attributes.length?this.attributes[0]:void 0})).catch(this.error).then(e=>null!=e?e:0),this.model.findAll(a).catch(this.error).then(e=>null!=e?e:[])]),c={count:l,records:n?yield n(u):u};return null==r||r.prepare(d.OK,c),c})}findOne(e){return Ne(this,void 0,void 0,function*(){var t,i,r;const{callback:n,ctx:s,id:o,options:u={},query:c=!0}=e,{primaryKeyAttribute:p}=this.model,v=null!==(t=null==s?void 0:s.getParam(p))&&void 0!==t?t:o;if(w(v))return null==s||s.error(new a),null;const h=U({},u);h.attributes=this.getAttributes(null!==(i=null==h?void 0:h.attributes)&&void 0!==i?i:[]),c&&this.applySelect(s,h);const g=yield this.model.findOne(Object.assign(Object.assign({},h),{where:{[ve.and]:Object.assign({[p]:v},null!==(r=null==h?void 0:h.where)&&void 0!==r?r:{})}})).catch(this.error);return g?(null==s||s.prepare(d.OK,n?yield n(g):g.toJSON()),g):(null==s||s.error(new l),null)})}getAttributes(e){return this.filterAttributes(this.attributes,e)}include(e,t){var i;const r=V(t),{ctx:n}=null!=t?t:{};r.attributes=this.filterAttributes(Object.keys(e.getAttributes()),null!==(i=r.attributes)&&void 0!==i?i:[]),this.applySearch(n,r);const s=this.applyWhere(n,r,t.name);return s?(null==n||n.error(s),null):(this.applySelect(n,r,t.name),Object.assign({model:e},r))}name(){return this.model.tableName}sync(){return Ne(this,void 0,void 0,function*(){if(!this.permissions.length)return;const e=this.name().toLowerCase(),t={description:"",active:!0};yield $(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`,n=z(e.replace(/_/g," ")," ");yield Nt.findOrCreate({where:{key:r},defaults:Object.assign({name:`${n} ${z(i," ")}`,key:r,tags:n},t)})}))})}update(e){return Ne(this,void 0,void 0,function*(){var t,i,r,n;const{ctx:s,body:o,id:d,options:u={}}=e,{primaryKeyAttribute:c}=this.model,p=null!==(t=null==s?void 0:s.getParam(c))&&void 0!==t?t:d;if(w(p))return null==s||s.error(new a),!1;const v=U({},u),h=U({},null!==(r=null===(i=null==s?void 0:s.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{},null!=o?o:{}),g=yield this.model.findOne(Object.assign(Object.assign({},v),{attributes:this.getAttributes([c,...Object.keys(h)]),where:{[ve.and]:Object.assign({[c]:p},null!==(n=null==v?void 0:v.where)&&void 0!==n?n:{})}})).catch(this.error);return g?(g.set(h),g.changed()?(null==s||s.success("OK"),yield g.save(Object.assign({},{ctx:s})).catch(this.error),!0):(null==s||s.success("Record not changed"),!1)):(null==s||s.error(new l),!1)})}}class Application extends u{constructor(e,t){super(e,U({},{cross:!!Env.HTTP_CROSS&&("*"===Env.HTTP_CROSS||{origin:Env.HTTP_CROSS.split(",")}),hybrid:Env.HTTP_HYBRID,json:{strict:Env.API_BODYPARSER_STRICT,inflate:Env.API_BODYPARSER_INFLATE,limit:Env.API_BODYPARSER_LIMIT,type:Env.API_BODYPARSER_TYPE},notfound:Env.HTTP_NOTFOUND,path:Env.HTTP_PATH,port:Env.HTTP_PORT,public:Env.HTTP_PUBLIC,redirect:Env.HTTP_REDIRECT,session:{store:new SessionStore,name:Env.API_SESSION_NAME,secret:Env.API_SESSION_SECRET,cookie:{maxAge:Env.API_SESSION_LIFETIME},genid:R},tls:{ca:Env.HTTP_TLS_CA,cert:Env.HTTP_TLS_CRT,key:Env.HTTP_TLS_KEY}},null!=t?t:{}))}error(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.error(e.message,t,Env.CONSOLE_ERROR)}log(e,t){Env.BASE_NAME&&(t=t?`${Env.BASE_NAME}.${t}`:Env.BASE_NAME),Log.info(e,t,!0)}listen(){const e=Object.create(null,{listen:{get:()=>super.listen}});return Ne(this,void 0,void 0,function*(){yield He.sync(),yield this.migrations(He),yield G(this.controllers,e=>Ne(this,void 0,void 0,function*(){P(e.sync)&&(yield e.sync(this))})),this.authService=new Zt,this.userService=new Qt,yield e.listen.call(this),Env.API_WEBSOCKET_START&&this.server&&(this._webSocket=new X({server:this.server,verifyClient:(e,t)=>t(Env.API_WEBSOCKET_START)}),this._webSocket.on("connection",(e,t)=>Ne(this,void 0,void 0,function*(){t.url||(t.url=""),e.on("close",()=>{}),yield Y(2e3)})))})}migrations(e){return Ne(this,void 0,void 0,function*(){const t=[];yield G(Object.keys(e.models),i=>Ne(this,void 0,void 0,function*(){var r;const n=e.models[i],s=n.version();if(!s)return;const[o,d]=null!==(r=yield Gt.findOrCreate({where:{model:n.tableName},defaults:{model:n.tableName,version:""}}).catch(this.error))&&void 0!==r?r:[];o&&(d||o.version!=s)&&(o.version=s,yield o.save().catch(this.error),t.push(n))})),yield G(t,e=>Ne(this,void 0,void 0,function*(){return yield e.updateAttributes()}))})}websocket(){return this._webSocket}}let ei=class BaseController extends W{constructor(){super(...arguments),this.permissions=[]}name(){var e,t;return(null!==(t=null===(e=this.constructor)||void 0===e?void 0:e.name)&&void 0!==t?t:"api").replace(/(([a-z])([A-Z]))/g,"$2_$3")}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=z(e.replace(/_/g," ")," ");yield G(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield Nt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${z(i," ")}`,active:!0}})}))})}};ei=Re([me(Loggable)],ei);let ti=class ModelController extends ei{constructor(){super(...arguments),this.attributes=[],this.permissions=["create","read","update","delete"],this.search=[]}countAll(e){return Ne(this,void 0,void 0,function*(){return yield this.service.countAll(e)})}create(e){return Ne(this,void 0,void 0,function*(){return yield this.service.create(e)})}delete(e){return Ne(this,void 0,void 0,function*(){return yield this.service.delete(e)})}findAll(e){return Ne(this,void 0,void 0,function*(){return yield this.service.findAll(e)})}findOne(e){return Ne(this,void 0,void 0,function*(){return yield this.service.findOne(e)})}include(e,t){return this.service.include(e,t)}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=z(e.replace(/_/g," ")," ");yield G(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield Nt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${z(i," ")}`,active:!0}})})),this.service=new ModelService(this.model,{attributes:this.attributes.length?this.attributes:void 0,search:this.search.length?this.search:void 0})})}update(e){return Ne(this,void 0,void 0,function*(){return yield this.service.update(e)})}name(){return this.model.tableName}};ti=Re([c(ei)],ti);let ii=class AuditsController extends ti{constructor(){super(...arguments),this.model=Ut,this.permissions=["read"]}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{attributes:{exclude:["currently","previously"]}}})})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}};Re([p(),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"all",null),Re([p("/:id"),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ii.prototype,"get",null),ii=Re([h("/audits"),c(ti)],ii);let ri=class AuthController extends ei{constructor(){super(...arguments),this.authService=new Zt}login(e,i,r,n,s){return Ne(this,void 0,void 0,function*(){var o,d;yield Y(Env.SLEEP_AUTH);const a=yield Kt.findOne({where:{revoked_at:null},include:[{association:"user",required:!0,where:{status:{[ve.in]:[Be.ACTIVE,Be.PENDING]},[ve.or]:[{email:i},{username:i}]},include:[{association:"registers",required:!1,where:{active:!0}}]}]}).catch(this.error);if(r+=Env.PASSWORD_PEPPER,!a||!a.user||null===(o=yield Te(a.hash,r).catch(H))||void 0===o||!o)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});if(a.user.registers.length)return e.error(new t("Activation Required")),s.emit("auth.activation",{ctx:e}),void this.emit("auth.activation",{ctx:e});if(a.user.status!==Be.ACTIVE)return e.error(new t("Invalid credentials")),s.emit("auth.failure",{ctx:e}),void this.emit("auth.failure",{ctx:e});const{token:l}=null!==(d=yield this.authService.createApiToken(e,a.user).catch(t=>{e.error(t),s.emit("auth.failure",{ctx:e}),this.emit("auth.failure",{ctx:e})}))&&void 0!==d?d:{};l&&(Env.TOKEN_COOKIE_SET&&e.setCookie(Env.TOKEN_COOKIE,l,{httpOnly:!0,secure:Env.isProduction(),sameSite:"lax",maxAge:n?Env.TOKEN_TTL:void 0}),e.json({token:l}),s.emit("auth.login",{ctx:e}),this.emit("auth.login",{ctx:e}))})}logout(e,i,r){return Ne(this,void 0,void 0,function*(){if(i instanceof Jt)return e.error(new t("Access Denied"));if(i.revoked_at=new Date,!(yield i.save().catch(this.error)))throw new s("Authentication service unavailable");Env.TOKEN_COOKIE_SET&&e.clearCookie(Env.TOKEN_COOKIE),e.success("OK"),r.emit("auth.logout",{ctx:e}),this.emit("auth.logout",{ctx:e})})}user(e){return Ne(this,void 0,void 0,function*(){const{groups:t,permissions:i,tenants:r,user:n}=e.req;if(!(t&&i&&r&&n))return e.error(new s);e.json(Object.assign(Object.assign({},n.toJSON()),{groups:t,permissions:i,tenants:r}))})}renew(e,t,i){return Ne(this,void 0,void 0,function*(){var r;const{token:n}=null!==(r=yield this.authService.renewApiToken(t).catch(t=>{e.error(t)}))&&void 0!==r?r:{};n&&(e.json({token:n}),i.emit("auth.renew",{ctx:e}),this.emit("auth.renew",{ctx:e}))})}};Re([g("/login"),y(e=>({username:e.string().min(3),password:e.string().min(5),remember:e.boolean().parse().default(!1)})),Me(0,v()),Me(1,m("username")),Me(2,m("password")),Me(3,m("remember")),Me(4,E()),De("design:type",Function),De("design:paramtypes",[n,String,String,Boolean,Application]),De("design:returntype",Promise)],ri.prototype,"login",null),Re([p("/logout"),Xe(),Me(0,v()),Me(1,Qe()),Me(2,E()),De("design:type",Function),De("design:paramtypes",[n,Object,Application]),De("design:returntype",Promise)],ri.prototype,"logout",null),Re([p("/me"),Xe(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ri.prototype,"user",null),Re([g("/renew"),y(e=>({token:e.string()})),Me(0,v()),Me(1,m("token")),Me(2,E()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],ri.prototype,"renew",null),ri=Re([h("/auth"),c(ei)],ri);let ni=class CrudController extends ti{constructor(){super(...arguments),this._crud={}}CrudArgumentsCountAll(e){return{ctx:e}}CrudArgumentsCreate(e){return{ctx:e}}CrudArgumentsFindAll(e){return{ctx:e}}CrudArgumentsFindOne(e){return{ctx:e}}CrudArgumentsDelete(e){return{ctx:e}}CrudArgumentsUpdate(e){return{ctx:e}}CrudValidateCreate(){return this._crud}CrudValidateUpdate(){return this._crud}add(e){return Ne(this,void 0,void 0,function*(){yield this.create(this.CrudArgumentsCreate(e))})}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll(this.CrudArgumentsFindAll(e))})}rows(e){return Ne(this,void 0,void 0,function*(){yield this.countAll(this.CrudArgumentsCountAll(e))})}del(e){return Ne(this,void 0,void 0,function*(){yield this.delete(this.CrudArgumentsDelete(e))})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne(this.CrudArgumentsFindOne(e))})}set(e){return Ne(this,void 0,void 0,function*(){yield this.update(this.CrudArgumentsUpdate(e))})}validate(e,t){var i,r;const n=N.object(t).parse().validate(null!==(r=null===(i=e.req)||void 0===i?void 0:i.body)&&void 0!==r?r:{});if(n.error)return e.error(new o(n.message||n.error));e.req.body=n.value,e.next()}validateCreate(e){const t=this.CrudValidateCreate();if(t==this._crud)return e.error(new s);this.validate(e,t)}validateUpdate(e){const t=this.CrudValidateUpdate();if(t==this._crud)return e.error(new s);this.validate(e,t)}};Re([g(),Xe(),Ve(),f("validateCreate"),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ni.prototype,"add",null),Re([p(),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ni.prototype,"all",null),Re([p("/count"),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ni.prototype,"rows",null),Re([S("/:id"),Xe(),$e(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ni.prototype,"del",null),Re([p("/:id"),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ni.prototype,"get",null),Re([_("/:id"),Xe(),Ge(),f("validateUpdate"),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ni.prototype,"set",null),Re([Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",void 0)],ni.prototype,"validateCreate",null),Re([Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",void 0)],ni.prototype,"validateUpdate",null),ni=Re([c(ti)],ni);let si=class FilesController extends ei{constructor(){super(...arguments),this.directory=Env.HTTP_PUBLIC||"./",this.permissions=["delete","download","edit","list","read","rename","upload","write"]}files(e){return Ne(this,void 0,void 0,function*(){let{path:t}=e.req;t=t.replace(/(^\/path(\/)?)|([\\.]{1,2}\/)/g,"");const i=je(this.directory,t);if(!be(i)||!we(i).isDirectory())return e.error(new l);let r;return r=Pe(i),r=r.map(e=>this.info(je(i,e))),r=r.filter(J),Object.assign(Object.assign({},this.info(i)),{files:r})})}info(e){if(!be(e))return null;const t=we(e),i=e.split("/").pop();e=e.replace(this.directory,"/").replace(/^\/\//,"/");const r=t.isDirectory();return{name:i,path:e.replace(/^\/\//,"/"),size:t.size,extension:r?"":"."+e.split(".").pop(),created:t.birthtime,modified:t.mtime,directory:r,symlink:t.isSymbolicLink()}}name(){return"files"}sync(){return Ne(this,void 0,void 0,function*(){const e=this.name().toLowerCase(),t=z(e.replace(/_/g," ")," ");yield G(this.permissions,i=>Ne(this,void 0,void 0,function*(){const r=`${e}.${i}`;yield Nt.findOrCreate({where:{name:r},defaults:{name:r,description:`${t} ${z(i," ")}`,active:!0}})}))})}};Re([p("/path"),p("/path/*path"),Xe(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],si.prototype,"files",null),si=Re([h("/files"),c(ei)],si);let oi=class ForgotController extends ei{check(e,t){return Ne(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i||!i.user)return e.error(new l);i.secret=q(),yield i.save(),e.json({token:i.secret})})}forgot(e,t,i){return Ne(this,void 0,void 0,function*(){yield Y(Env.SLEEP_FORGOT);const r=t,n=yield Bt.findOne({where:{[ve.or]:[{email:r},{username:t}]}}).catch(this.error);if(!n)return e.error(new l);const s=q(),o=Date.now()+6e4*Env.TOKEN_TTL_FORGOT,d=yield $t.create({token:s,timestamp:o,active:!0,user_id:n.id});e.success("OK"),i.emit("forgot.send",{ctx:e,forgot:d,user:n}),this.emit("forgot.send",{ctx:e,forgot:d,user:n})})}reset(e,t,i,r){return Ne(this,void 0,void 0,function*(){const i=yield this.find(t);if(!i)return e.error(new l);i.active=!1,yield i.save().catch(this.error),yield i.user.save().catch(this.error),e.success("OK"),r.emit("forgot.reset",{ctx:e,user:i.user}),this.emit("forgot.reset",{ctx:e,user:i.user})})}find(e){return Ne(this,void 0,void 0,function*(){return yield $t.findOne({where:{token:e,active:!0},include:[{association:"users",required:!0}]}).catch(this.error)})}};Re([p("/check"),y(e=>({token:e.string()})),Me(0,v()),Me(1,m("token")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],oi.prototype,"check",null),Re([g(),y(e=>({username:e.string().min(4)})),Me(0,v()),Me(1,m("username")),Me(2,E()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],oi.prototype,"forgot",null),Re([g("/reset"),y(e=>({token:e.string(),password:e.string().min(5)})),Me(0,v()),Me(1,m("token")),Me(2,m("password")),Me(3,E()),De("design:type",Function),De("design:paramtypes",[n,String,String,Application]),De("design:returntype",Promise)],oi.prototype,"reset",null),oi=Re([h("/forgot"),c(ei)],oi);let di=class GroupsController extends ni{constructor(){super(...arguments),this.model=Ht,this.schemaCreate={name:N.string(),description:N.string().default(""),type:N.enum(Object.values(Le)).default(Le.SYSTEM),active:N.boolean().parse(),metadata:N.object().parse().default({})},this.schemaUpdate={description:N.string().optional(),type:N.enum(Object.values(Le)).optional(),active:N.boolean().parse().optional(),metadata:N.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}sync(){const e=Object.create(null,{sync:{get:()=>super.sync}});return Ne(this,void 0,void 0,function*(){yield e.sync.call(this),this.userModelService=new ModelService(Bt)})}users(e,t){return Ne(this,void 0,void 0,function*(){(yield this.checkGroup(e,t))&&(yield this.userModelService.findAll({ctx:e,options:{include:[{association:"users_groups",required:!0,attributes:[],where:{group_id:t}}]}}))})}checkGroup(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Ht.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([p("/:id/users"),Xe(),ze("users"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],di.prototype,"users",null),di=Re([h("/groups"),c(ni)],di);let ai=class GroupsPermissionsController extends ti{constructor(){super(...arguments),this.model=Nt,this.permissions=[]}add(e,t,i){return Ne(this,void 0,void 0,function*(){(yield this.checkGroup(e,t))&&(yield this.addPermissions(e,t,i),e.success("OK"))})}all(e,t){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{include:[{association:"groups_permissions",required:!0,attributes:[],where:{group_id:t}}]}})})}del(e,t,i){return Ne(this,void 0,void 0,function*(){(yield this.checkGroup(e,t))&&(yield kt.destroy(Object.assign({where:{group_id:t,permission_id:{[ve.in]:F(i)}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK"))})}set(e,t,i){return Ne(this,void 0,void 0,function*(){if(!(yield this.checkGroup(e,t)))return;const r=yield this.addPermissions(e,t,i);yield kt.destroy(Object.assign({where:{group_id:t,permission_id:{[ve.notIn]:r}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}addPermissions(e,t,i){return Ne(this,void 0,void 0,function*(){const r=[];return yield G(F(i),i=>Ne(this,void 0,void 0,function*(){var n;if(!(yield Nt.count({where:{id:i}})))return;const[s]=null!==(n=yield kt.findOrCreate(Object.assign({where:{group_id:t,permission_id:i},defaults:{group_id:t,permission_id:i}},{ctx:e})).catch(this.error))&&void 0!==n?n:[];s&&r.push(i)})),r})}checkGroup(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Ht.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([g("/:id/permissions"),Xe(),Ve(),Ge("groups"),y(e=>({permissions:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("permissions")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],ai.prototype,"add",null),Re([p("/:id/permissions"),Xe(),ze(),Ge("groups"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],ai.prototype,"all",null),Re([S("/:id/permissions"),Xe(),$e(),Ge("groups"),y(e=>({permissions:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("permissions")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],ai.prototype,"del",null),Re([_("/:id/permissions"),Xe(),Ge(),Ge("groups"),y(e=>({permissions:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("permissions")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],ai.prototype,"set",null),ai=Re([h("/groups"),c(ti)],ai);let li=class HealthController{ping(e){return Ne(this,void 0,void 0,function*(){e.json({status:"ok",timestamp:Date.now(),uptime:process.uptime()})})}};Re([A("/"),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],li.prototype,"ping",null),li=Re([h("/health")],li);let ui=class LogsController extends ti{constructor(){super(...arguments),this.model=zt,this.permissions=["read"]}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}};Re([p(),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ui.prototype,"all",null),ui=Re([h("/logs"),c(ti)],ui);let ci=class McpController extends ei{constructor(){super(...arguments),this.tools=new McpToolRegistry,this.toolsRegistered=!1,this.handler=new McpHttpHandler({sessions:new McpSessionStore(Env.MCP_SESSION_TTL),tools:this.tools,allowedHeaders:[Env.TOKEN_HEADER],logger:{toolCall:e=>Ne(this,void 0,void 0,function*(){yield Log.info(JSON.stringify(e),"mcp")})}})}sync(e){const t=Object.create(null,{sync:{get:()=>super.sync}});return Ne(this,void 0,void 0,function*(){yield t.sync.call(this),this.toolsRegistered||(this.toolsRegistered=!0,e&&(e.instance.use((e,t,i,r)=>{if(!this.isMcpEndpoint(t))return r(e);const n=this.jsonParseErrorResponse(e);if(!n)return r(e);this.setResponseHeaders(i),i.status(n.status).json(n.body)}),e.instance.use((e,t,i)=>{if(!this.isMcpEndpoint(e)||!["GET","HEAD"].includes(e.method))return i();t.setHeader("Allow",mt),this.setResponseHeaders(t),t.status(405).end()}),Tt(e.controllers).forEach(e=>this.tools.register(e))))})}get(e){return Ne(this,void 0,void 0,function*(){this.respond(e,this.handler.get())})}options(e){return Ne(this,void 0,void 0,function*(){this.respond(e,this.handler.options())})}post(e){return Ne(this,void 0,void 0,function*(){this.respond(e,yield this.handler.post(e))})}delete(e){return Ne(this,void 0,void 0,function*(){this.respond(e,this.handler.delete(e))})}isJsonParseError(e){if(!(e instanceof SyntaxError))return!1;const t=e;return"entity.parse.failed"===t.type||400===t.status||400===t.statusCode}isMcpEndpoint(e){const t=(e.originalUrl||e.url).split("?")[0].replace(/\/+$/g,"")||"/";return t===`${(Env.HTTP_PATH||"/").replace(/\/+$/g,"")||""}/mcp`.replace(/\/+/g,"/")||"/mcp"===t}jsonParseErrorResponse(e){if(this.isJsonParseError(e))return{status:400,body:lt(null,new McpParseError("Parse error",{message:e.message}))}}respond(e,t){var i;for(const[r,n]of Object.entries(null!==(i=t.headers)&&void 0!==i?i:{}))e.res.setHeader(r,n);void 0!==t.body?e.res.status(t.status).json(t.body):e.res.status(t.status).end()}setResponseHeaders(e,t){Object.entries(Object.assign({Allow:mt,"Access-Control-Allow-Methods":mt,"Access-Control-Allow-Headers":`Content-Type, Accept, ${Env.TOKEN_HEADER}, ${gt}, ${ht}`},null!=t?t:{})).forEach(([t,i])=>{e.setHeader(t,i)})}};Re([p(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ci.prototype,"get",null),Re([T(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ci.prototype,"options",null),Re([g(),Xe(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ci.prototype,"post",null),Re([S(),Xe(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],ci.prototype,"delete",null),ci=Re([h("/mcp"),c(ei)],ci);let pi=class PermissionsController extends ni{constructor(){super(...arguments),this.model=Nt,this.schemaCreate={name:N.string(),description:N.string().default(""),active:N.boolean().parse(),metadata:N.object().parse().default({})},this.schemaUpdate={description:N.string().optional(),active:N.boolean().parse().optional(),metadata:N.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}sync(){const e=Object.create(null,{sync:{get:()=>super.sync}});return Ne(this,void 0,void 0,function*(){yield e.sync.call(this),this.groupModelService=new ModelService(Ht)})}groups(e,t){return Ne(this,void 0,void 0,function*(){(yield this.checkPermission(e,t))&&(yield this.groupModelService.findAll({ctx:e,options:{include:[{association:"groups_permissions",required:!0,attributes:[],where:{permission_id:t}}]}}))})}checkPermission(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Nt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([p("/:id/groups"),Xe(),ze("groups"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],pi.prototype,"groups",null),pi=Re([h("/permissions"),c(ni)],pi);let vi=class RegisterController extends ei{register(e,t,i){return Ne(this,void 0,void 0,function*(){yield Y(Env.SLEEP_REGISTRY);const{name:r,date:n,email:o,username:d,password:a,confirm:l}=t,u=d||o,c=ie(a);if(yield Bt.count({where:{[ve.or]:[{email:o},{username:u}]}}).catch(this.error))return e.error("INVALID EMAIL OR USERNAME");if(c!=ie(l))return e.error("INVALID PASSWORD");const p=yield Bt.create({name:r,email:o,username:u,password:c,avatar:"",date:n,description:"",status:Be.PENDING}).catch(this.error);if(!p)return e.error(new s);const v=yield Mt.create({token:yield this.getId(),active:!0,user_id:p.id}).catch(this.error);if(!v)return yield p.destroy().catch(this.error),e.error(new s);e.success("OK"),i.emit("register.user",{ctx:e,register:v,user:p}),this.emit("register.user",{ctx:e,register:v,user:p})})}confirm(e,t,i){return Ne(this,void 0,void 0,function*(){const r=yield Mt.findOne({where:{token:t,active:!0},include:[{association:"users",required:!0}]}).catch(this.error);if(!r)return e.error(new l);r.active=!1,yield r.save().catch(this.error),r.user.status=Be.ACTIVE,yield r.user.save().catch(this.error),e.success("OK"),i.emit("register.confirm",{ctx:e,register:r,user:r.user}),this.emit("register.confirm",{ctx:e,register:r,user:r.user})})}send(e,t,i){return Ne(this,void 0,void 0,function*(){const r=t,n=yield Mt.findOne({where:{active:!0},include:[{model:Bt,required:!0,where:{[ve.or]:[{email:r},{username:t}]}}]}).catch(this.error);if(!n)return e.error(new l);e.success("OK"),i.emit("register.send",{ctx:e,register:n,user:n.user}),this.emit("register.send",{ctx:e,register:n,user:n.user})})}getId(){return Ne(this,void 0,void 0,function*(){const e=R();return(yield Mt.count({where:{token:e}}))?this.getId():e})}};Re([g(),y(e=>({name:e.string(),date:e.date(),email:e.string().email(),username:e.string().min(4).default(e.ref("email")),password:e.string().min(5),confirm:e.string().min(5)})),Me(0,v()),Me(1,m()),Me(2,E()),De("design:type",Function),De("design:paramtypes",[n,Object,Application]),De("design:returntype",Promise)],vi.prototype,"register",null),Re([g("/confirm"),y(e=>({token:e.string()})),Me(0,v()),Me(1,m("token")),Me(2,E()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],vi.prototype,"confirm",null),Re([g("/send"),y(e=>({username:e.string().min(4)})),Me(0,v()),Me(1,m("username")),Me(2,E()),De("design:type",Function),De("design:paramtypes",[n,String,Application]),De("design:returntype",Promise)],vi.prototype,"send",null),vi=Re([h("/register"),c(ei)],vi);let hi=class SetupController extends ei{constructor(){super(...arguments),this.userService=new Qt}setup(e){return Ne(this,void 0,void 0,function*(){var t;if(yield Bt.count())return e.error(new l("Endpoint Not Found"));const i=yield Bt.create({name:"Admin",username:"admin",email:"admin@localhost.com",notes:"",status:Be.ACTIVE},Object.assign({},{ctx:e})).catch(this.error);if(!i)return e.error(new s);yield this.userService.createPassword(i.id,"admin",e);const r=yield Ht.create({name:"root",description:"Root",active:!0},Object.assign({},{ctx:e}));yield qt.create({user_id:i.id,group_id:r.id},Object.assign({},{ctx:e})),yield Ht.create({name:"admin",description:"Admin",active:!0},Object.assign({},{ctx:e})),yield Ht.create({name:"user",description:"User",active:!0},Object.assign({},{ctx:e}));const n=null!==(t=yield Nt.findAll({where:{active:!0}}).catch(this.error))&&void 0!==t?t:[];yield G(n,t=>Ne(this,void 0,void 0,function*(){yield kt.create({group_id:r.id,permission_id:t.id},Object.assign({},{ctx:e}))})),e.success("OK")})}};Re([p(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],hi.prototype,"setup",null),hi=Re([h("/setup"),c(ei)],hi);let gi=class TenantsController extends ni{constructor(){super(...arguments),this.model=Lt,this.schemaCreate={name:N.string(),description:N.string().default(""),status:N.enum(Object.values(Ke)).default(Ke.ACTIVE),metadata:N.object().parse().default({})},this.schemaUpdate={name:N.string().optional(),description:N.string().optional(),status:N.enum(Object.values(Ke)).optional(),metadata:N.object().parse().optional()}}CrudValidateCreate(){return this.schemaCreate}CrudValidateUpdate(){return this.schemaUpdate}sync(){const e=Object.create(null,{sync:{get:()=>super.sync}});return Ne(this,void 0,void 0,function*(){yield e.sync.call(this),this.userModelService=new ModelService(Bt)})}users(e,t){return Ne(this,void 0,void 0,function*(){(yield this.checkTenant(e,t))&&(yield this.userModelService.findAll({ctx:e,options:{include:[{association:"users_tenants",required:!0,attributes:[],where:{tenant_id:t}}]}}))})}checkTenant(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Lt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([p("/:id/users"),Xe(),ze("users"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],gi.prototype,"users",null),gi=Re([h("/tenants"),c(ni)],gi);let yi=class TestController extends ei{json(e){return Ne(this,void 0,void 0,function*(){e.json({ok:!0,message:"hello",timestamp:Date.now()})})}sum(e,t){return Ne(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t+i}})}multiply(e,t){return Ne(this,void 0,void 0,function*(){const{a:t,b:i}=e;return{value:t*i}})}average(e,t){return Ne(this,void 0,void 0,function*(){const t=e.values;return{value:t.reduce((e,t)=>e+t,0)/t.length,count:t.length}})}validationString(e,t){return Ne(this,void 0,void 0,function*(){const t=e.text;return{length:t.length,normalized:t.trim()}})}validationNumber(e,t){return Ne(this,void 0,void 0,function*(){return{doubled:2*e.value}})}validationBoolean(e,t){return Ne(this,void 0,void 0,function*(){return{active:e.active}})}validationArray(e,t){return Ne(this,void 0,void 0,function*(){return{count:e.tags.length}})}validationObject(e,t){return Ne(this,void 0,void 0,function*(){const t=e.profile;return{summary:{name:t.name,adult:t.age>=18}}})}validationEnum(e,t){return Ne(this,void 0,void 0,function*(){return{status:e.status}})}validationDate(e,t){return Ne(this,void 0,void 0,function*(){const t=e.date;return{iso:t.toISOString(),timestamp:t.getTime()}})}validationOptional(e,t){return Ne(this,void 0,void 0,function*(){const t=e.nickname;return Object.assign({name:e.name,hasNickname:Boolean(t)},t?{nickname:t}:{})})}validationDefaults(e,t){return Ne(this,void 0,void 0,function*(){return{name:e.name,limit:e.limit}})}validationParse(e,t){return Ne(this,void 0,void 0,function*(){return{active:e.active,amount:e.amount}})}validationNested(e,t){return Ne(this,void 0,void 0,function*(){const t=e.payload;return{userId:t.user.id,scoreCount:t.scores.length}})}};Re([p(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],yi.prototype,"json",null),Re([wt({name:"sum",title:"Somar numeros",description:"Soma dois numeros.",input:{a:N.number().description("valor a"),b:N.number().description("valor b")},output:{value:N.number().description("resultado da soma de a + b")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"sum",null),Re([wt({name:"multiply",title:"Multiplicar numeros",description:"Multiplica dois numeros.",input:{a:N.number().description("valor a"),b:N.number().description("valor b")},output:{value:N.number().description("resultado da multiplicação de a * b")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"multiply",null),Re([wt({name:"average",title:"Calcular media",description:"Calcula a media de uma lista de numeros.",input:{values:N.array(N.number().description("numero usado no calculo da media")).min(1).max(10).description("lista de numeros para calcular a media")},output:{value:N.number().description("media calculada"),count:N.number().description("quantidade de numeros usados")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"average",null),Re([wt({name:"validation.string",title:"Validacao de string",description:"Exemplo de validacao de texto com tamanho minimo e maximo.",input:{text:N.string().min(5).max(50).description("Texto entre 5 e 50 caracteres.")},output:{length:N.number().description("Quantidade de caracteres do texto."),normalized:N.string().description("Texto normalizado sem espacos nas pontas.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationString",null),Re([wt({name:"validation.number",title:"Validacao de number",description:"Exemplo de validacao numerica com minimo e maximo.",input:{value:N.number().min(0).max(100).description("Numero entre 0 e 100.")},output:{doubled:N.number().description("Numero multiplicado por dois.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationNumber",null),Re([wt({name:"validation.boolean",title:"Validacao de boolean",description:"Exemplo de validacao de booleano sem parse implicito.",input:{active:N.boolean().description("Indica se o registro esta ativo.")},output:{active:N.boolean().description("Booleano validado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationBoolean",null),Re([wt({name:"validation.array",title:"Validacao de array",description:"Exemplo de validacao de array com limites e item tipado.",input:{tags:N.array(N.string().min(2).max(20).description("Tag entre 2 e 20 caracteres.")).min(1).max(5).description("Lista de tags entre 1 e 5 itens.")},output:{count:N.number().description("Quantidade de tags recebidas.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationArray",null),Re([wt({name:"validation.object",title:"Validacao de object",description:"Exemplo de validacao de objeto simples.",input:{profile:N.object({name:N.string().min(2).max(60).description("Nome do perfil."),age:N.number().min(0).max(120).description("Idade do perfil."),nickname:N.string().empty().max(30).description("Apelido opcional do perfil.")}).description("Objeto de perfil.")},output:{summary:N.object({name:N.string().description("Nome validado."),adult:N.boolean().description("Indica se a idade e maior ou igual a 18.")}).description("Resumo do perfil.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationObject",null),Re([wt({name:"validation.enum",title:"Validacao de enum",description:"Exemplo de validacao de lista fechada de valores.",input:{status:N.enum(["draft","active","archived"]).description("Status permitido.")},output:{status:N.string().description("Status validado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationEnum",null),Re([wt({name:"validation.date",title:"Validacao de date",description:"Exemplo de validacao e parse de data.",input:{date:N.date().parse().description("Data em formato aceito pelo Date.")},output:{iso:N.string().description("Data em ISO string."),timestamp:N.number().description("Data em timestamp Unix em milissegundos.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationDate",null),Re([wt({name:"validation.optional",title:"Validacao de campo opcional",description:"Exemplo de campo opcional aceitando ausencia.",input:{name:N.string().min(2).description("Nome obrigatorio."),nickname:N.string().empty().max(30).description("Apelido opcional.")},output:{name:N.string().description("Nome validado."),hasNickname:N.boolean().description("Indica se apelido foi enviado."),nickname:N.string().empty().description("Apelido validado quando enviado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationOptional",null),Re([wt({name:"validation.defaults",title:"Validacao de valores padrao",description:"Exemplo de campos opcionais com valores padrao.",input:{name:N.string().default("guest").description("Nome opcional com valor padrao."),limit:N.number().parse().default(10).min(1).max(100).description("Limite opcional com valor padrao.")},output:{name:N.string().description("Nome final."),limit:N.number().description("Limite final.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationDefaults",null),Re([wt({name:"validation.parse",title:"Validacao com parse",description:"Exemplo de parse de boolean e number antes da validacao final.",input:{active:N.boolean().parse().default(!1).description("Booleano aceitando valores parseaveis."),amount:N.number().parse().min(1).max(1e3).description("Numero aceitando string numerica.")},output:{active:N.boolean().description("Booleano parseado."),amount:N.number().description("Numero parseado.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationParse",null),Re([wt({name:"validation.nested",title:"Validacao de objeto aninhado",description:"Exemplo de objeto aninhado com array interno.",input:{payload:N.object({user:N.object({id:N.string().min(3).max(30).description("Identificador do usuario."),email:N.string().email().description("Email do usuario.")}).description("Usuario do payload."),scores:N.array(N.number().min(0).max(100).description("Pontuacao individual.")).min(1).max(3).description("Pontuacoes do usuario.")}).description("Payload aninhado.")},output:{userId:N.string().description("Identificador validado."),scoreCount:N.number().description("Quantidade de pontuacoes.")}}),De("design:type",Function),De("design:paramtypes",[Object,Object]),De("design:returntype",Promise)],yi.prototype,"validationNested",null),yi=Re([h("/test"),c(ei)],yi);let mi=class UsersController extends ti{constructor(){super(),this.model=Bt,this.permissions=["avatar","create","read","update","delete"],this.path=Env.HTTP_PUBLIC+"/avatar",Env.HTTP_PUBLIC&&be(Env.HTTP_PUBLIC)&&!be(this.path)&&Ie(this.path)}avatar(e,t){return Ne(this,void 0,void 0,function*(){var i;const r=e.getFiles();if(r.file&&r.file.length){const{filename:n,path:o}=null!==(i=r.file[0])&&void 0!==i?i:{};if(n){const i=yield Bt.findOne({where:{id:t.id}}).catch(this.error);if(!i)return xe(o).isFile()&&Ce(o),e.error(new s);const r=this.path+"/"+i.metadata.avatar_url;if(be(r)&&xe(r).isFile()&&Ce(r),i.changed("metadata",!0),i.metadata.avatar_url=n,yield i.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK")}}e.success("Record not Changed")})}avatar_del(e,t){return Ne(this,void 0,void 0,function*(){const i=this.path+"/"+t.metadata.avatar_url;if(be(i)&&xe(i).isFile()&&Ce(i),t.changed("metadata",!0),t.metadata.avatar_url=null,yield t.save(Object.assign({},{ctx:e})).catch(this.error))return e.success("OK");e.success("Record not Changed")})}add(e){return Ne(this,void 0,void 0,function*(){yield this.create({ctx:e})})}all(e){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e})})}rows(e){return Ne(this,void 0,void 0,function*(){yield this.countAll({ctx:e})})}del(e,t,i){return Ne(this,void 0,void 0,function*(){if(i.id==t)return e.error(new l);yield this.delete({ctx:e})})}get(e){return Ne(this,void 0,void 0,function*(){yield this.findOne({ctx:e})})}set(e){return Ne(this,void 0,void 0,function*(){yield this.update({ctx:e})})}};Re([g("/avatar"),Xe(),Je("avatar"),b({file:{count:1,path:`${Env.HTTP_PUBLIC}/avatar`,types:["image/bmp","image/jpeg","image/png"],size:32}}),Me(0,v()),Me(1,st()),De("design:type",Function),De("design:paramtypes",[n,Bt]),De("design:returntype",Promise)],mi.prototype,"avatar",null),Re([S("/avatar"),Xe(),Je("avatar"),Me(0,v()),Me(1,st()),De("design:type",Function),De("design:paramtypes",[n,Bt]),De("design:returntype",Promise)],mi.prototype,"avatar_del",null),Re([g(),Xe(),Ve(),y(e=>({name:e.string(),email:e.string().email(),username:e.string().min(3),notes:e.string().default(""),status:e.enum(Object.values(Be)).default(Be.ACTIVE),metadata:e.object().parse().default({})})),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],mi.prototype,"add",null),Re([p(),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],mi.prototype,"all",null),Re([p("/count"),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],mi.prototype,"rows",null),Re([S("/:id"),Xe(),$e(),Me(0,v()),Me(1,O("id")),Me(2,st()),De("design:type",Function),De("design:paramtypes",[n,String,Bt]),De("design:returntype",Promise)],mi.prototype,"del",null),Re([p("/:id"),Xe(),ze(),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],mi.prototype,"get",null),Re([_("/:id"),Xe(),Ge(),y(e=>({name:e.string().optional(),email:e.string().email().optional(),username:e.string().min(3).optional(),notes:e.string().optional(),status:e.enum(Object.values(Be)).optional(),metadata:e.object().parse().optional()})),Me(0,v()),De("design:type",Function),De("design:paramtypes",[n]),De("design:returntype",Promise)],mi.prototype,"set",null),mi=Re([h("/users"),c(ti),De("design:paramtypes",[])],mi);let Ei=class UsersGroupsController extends ti{constructor(){super(...arguments),this.model=Ht,this.permissions=[]}add(e,t,i){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.addGroups(e,t,i),e.success("OK"))})}all(e,t){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.findAll({ctx:e,options:{include:[{association:"users_groups",required:!0,attributes:[],where:{user_id:t}}]}}))})}del(e,t,i){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield qt.destroy(Object.assign({where:{user_id:t,group_id:{[ve.in]:F(i)}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK"))})}set(e,t,i){return Ne(this,void 0,void 0,function*(){if(!(yield this.checkUser(e,t)))return;const r=yield this.addGroups(e,t,i);yield qt.destroy(Object.assign({where:{user_id:t,group_id:{[ve.notIn]:r}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}addGroups(e,t,i){return Ne(this,void 0,void 0,function*(){const r=[];return yield G(F(i),i=>Ne(this,void 0,void 0,function*(){var n;if(!(yield Ht.count({where:{id:i}})))return;const[s]=null!==(n=yield qt.findOrCreate(Object.assign({where:{user_id:t,group_id:i},defaults:{user_id:t,group_id:i}},{ctx:e})).catch(this.error))&&void 0!==n?n:[];s&&r.push(i)})),r})}checkUser(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Bt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([g("/:id/groups"),Xe(),Ve(),Ge("users"),y(e=>({groups:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("groups")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Ei.prototype,"add",null),Re([p("/:id/groups"),Xe(),ze(),Ge("users"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],Ei.prototype,"all",null),Re([S("/:id/groups"),Xe(),$e(),Ge("users"),y(e=>({groups:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("groups")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Ei.prototype,"del",null),Re([_("/:id/groups"),Xe(),Ge(),Ge("users"),y(e=>({groups:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("groups")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Ei.prototype,"set",null),Ei=Re([h("/users"),c(ti)],Ei);let fi=class UsersKeysController extends ti{constructor(){super(...arguments),this.model=Jt,this.permissions=["create","read"]}add(e,t,i,r){return Ne(this,void 0,void 0,function*(){e.json({token:yield r.authService.createApiKey(e,i.name,i.expires_at,t)})})}add_admin(e,t,i,r){return Ne(this,void 0,void 0,function*(){const n=yield Bt.findOne({where:{id:t}}).catch(this.error);if(!n)return e.error(new l);e.json({token:yield r.authService.createApiKey(e,i.name,i.expires_at,n)})})}all(e,t){return Ne(this,void 0,void 0,function*(){yield this.findAll({ctx:e,options:{attributes:{exclude:["hash"]},include:[{association:"user",required:!0,attributes:[],where:{id:t.id}}]}})})}all_admin(e,t){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.findAll({ctx:e,options:{attributes:{exclude:["hash"]},include:[{association:"user",required:!0,attributes:[],where:{id:t}}]}}))})}checkUser(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Bt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([g("/keys"),Xe(),Ve(),y(e=>({name:e.string(),expires_at:e.date()})),Me(0,v()),Me(1,st()),Me(2,m()),Me(3,E()),De("design:type",Function),De("design:paramtypes",[n,Bt,Object,Application]),De("design:returntype",Promise)],fi.prototype,"add",null),Re([g("/:id/keys"),Xe(),Ve(),Ge("users"),y(e=>({name:e.string(),expires_at:e.date()})),Me(0,v()),Me(1,O("id")),Me(2,m()),Me(3,E()),De("design:type",Function),De("design:paramtypes",[n,String,Object,Application]),De("design:returntype",Promise)],fi.prototype,"add_admin",null),Re([p("/keys"),Xe(),ze(),Me(0,v()),Me(1,st()),De("design:type",Function),De("design:paramtypes",[n,Bt]),De("design:returntype",Promise)],fi.prototype,"all",null),Re([p("/:id/keys"),Xe(),ze(),Ge("users"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],fi.prototype,"all_admin",null),fi=Re([h("/users"),c(ti)],fi);let Si=class UsersTenantsController extends ti{constructor(){super(...arguments),this.model=Lt,this.permissions=[]}add(e,t,i){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.addTenants(e,t,i),e.success("OK"))})}all(e,t){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield this.findAll({ctx:e,options:{include:[{association:"users_tenants",required:!0,attributes:[],where:{user_id:t}}]}}))})}del(e,t,i){return Ne(this,void 0,void 0,function*(){(yield this.checkUser(e,t))&&(yield Ft.destroy(Object.assign({where:{user_id:t,tenant_id:{[ve.in]:F(i)}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK"))})}set(e,t,i){return Ne(this,void 0,void 0,function*(){if(!(yield this.checkUser(e,t)))return;const r=yield this.addTenants(e,t,i);yield Ft.destroy(Object.assign({where:{user_id:t,tenant_id:{[ve.notIn]:r}},individualHooks:!0},{ctx:e})).catch(this.error),e.success("OK")})}addTenants(e,t,i){return Ne(this,void 0,void 0,function*(){const r=[];return yield G(F(i),i=>Ne(this,void 0,void 0,function*(){var n;if(!(yield Lt.count({where:{id:i}})))return;const[s]=null!==(n=yield Ft.findOrCreate(Object.assign({where:{user_id:t,tenant_id:i},defaults:{user_id:t,tenant_id:i}},{ctx:e})).catch(this.error))&&void 0!==n?n:[];s&&r.push(i)})),r})}checkUser(e,t){return Ne(this,void 0,void 0,function*(){var i;return!!(null!==(i=yield Bt.count({where:{id:t}}).catch(this.error))&&void 0!==i?i:0)||(e.error(new l),!1)})}};Re([g("/:id/tenants"),Xe(),Ve(),Ge("users"),y(e=>({tenants:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("tenants")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Si.prototype,"add",null),Re([p("/:id/tenants"),Xe(),ze(),Ge("users"),Me(0,v()),Me(1,O("id")),De("design:type",Function),De("design:paramtypes",[n,String]),De("design:returntype",Promise)],Si.prototype,"all",null),Re([S("/:id/tenants"),Xe(),$e(),Ge("users"),y(e=>({tenants:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("tenants")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Si.prototype,"del",null),Re([_("/:id/tenants"),Xe(),Ge(),Ge("users"),y(e=>({tenants:e.array(e.string().uuid())})),Me(0,v()),Me(1,O("id")),Me(2,m("tenants")),De("design:type",Function),De("design:paramtypes",[n,String,Array]),De("design:returntype",Promise)],Si.prototype,"set",null),Si=Re([h("/users"),c(ti)],Si);export{Application,Rt as Audit,Ut as AuditModel,Fe as AuditTypes,ii as AuditsController,ri as AuthController,Zt as AuthService,ei as BaseController,Ve as CanCreate,$e as CanDelete,ze as CanRead,Ge as CanUpdate,Config,Vt as ConfigModel,ni as CrudController,Env,si as FilesController,oi as ForgotController,$t as ForgotModel,Ht as GroupModel,kt as GroupPermissionModel,Le as GroupTypes,di as GroupsController,ai as GroupsPermissionsController,Ye as HasGroups,We as HasPermissions,Je as HasScope,li as HealthController,Xe as IsAuthenticated,Log,qe as LogLevels,zt as LogModel,Loggable,ui as LogsController,vt as MCP_DEFAULT_PROTOCOL_VERSION,mt as MCP_HTTP_ALLOW,yt as MCP_HTTP_ALLOWED_METHODS,Et as MCP_HTTP_DEFAULT_ALLOWED_HEADERS,ht as MCP_PROTOCOL_VERSION_HEADER,gt as MCP_SESSION_ID_HEADER,pt as MCP_SUPPORTED_PROTOCOL_VERSIONS,_t as MCP_TOOL_METADATA,ci as McpController,McpError,ot as McpErrorCode,McpHttpHandler,McpInternalError,McpInvalidParamsError,McpInvalidRequestError,McpInvalidSessionError,McpMethodNotFoundError,McpParseError,McpServerError,McpSessionStore,wt as McpTool,McpToolNotFoundError,McpToolRegistry,Gt as MigrationModel,ti as ModelController,ModelService,Nt as PermissionModel,pi as PermissionsController,vi as RegisterController,Mt as RegisterModel,Qe as ReqAccess,Ze as ReqGroup,et as ReqGroups,tt as ReqPermission,it as ReqPermissions,rt as ReqTenant,nt as ReqTenants,st as ReqUser,Secret,Yt as SecretModel,Xt as Service,Wt as SessionModel,SessionStore,hi as SetupController,Lt as TenantModel,Ke as TenantStatus,gi as TenantsController,yi as TestController,Dt as UserAuthModel,qt as UserGroupModel,Jt as UserKeyModel,Bt as UserModel,Kt as UserPasswordModel,Qt as UserService,Be as UserStatus,Ft as UserTenantModel,mi as UsersController,Ei as UsersGroupsController,fi as UsersKeysController,Si as UsersTenantsController,Ot as assertValidMcpToolDefinition,Ue as canFactory,Tt as discoverMcpTools,At as getMcpToolMetadata,ft as isJsonParseError,dt as isJsonRpcId,St as jsonParseErrorResponse,lt as jsonRpcError,ut as jsonRpcErrorFromCode,at as jsonRpcResult,ct as parseJsonRpcRequest,He as sequelize};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrewcaires/api",
-  "version": "5.3.5",
+  "version": "5.3.6",
   "description": "Simple api for small applications using express, jsonwebtoken, sequelize and websocket",
   "type": "module",
   "main": "./dist/index.cjs.js",
@@ -52,7 +52,7 @@
     "@andrewcaires/express": "^2.4.1",
     "@andrewcaires/node": "^1.5.0",
     "@andrewcaires/sequelize": "^3.2.2",
-    "@andrewcaires/utils.js": "^0.5.6",
+    "@andrewcaires/utils.js": "^0.5.7",
     "@node-rs/argon2": "^2.0.2",
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",