@pipeline-builder/pipeline-data 0.0.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,61 @@
+# @pipeline-builder/pipeline-data
+
+📖 **[View documentation](https://mwashburn160.github.io/pipeline-builder/)**
+
+Database layer for [Pipeline Builder](https://mwashburn160.github.io/pipeline-builder/): Drizzle ORM schemas, connection management, query builders, and the generic `CrudService` base class with per-organization (and team) access control.
+
+> Internal workspace package — consumed by other packages via `workspace:*`.
+
+## Responsibilities
+
+- Defines the Drizzle ORM schema for every backend table (pipelines, plugins, messages, pipeline events, and the compliance suite).
+- Manages the PostgreSQL connection lifecycle with retry logic.
+- Provides the generic `CrudService` base class with built-in multi-tenant (org/team) access control and pagination.
+- Supplies filter-to-SQL query/condition builders and `AsyncLocalStorage`-backed tenant-context primitives for transactions.
+- Hosts the `ReportingService` used to ingest pipeline events and serve org-scoped reporting.
+
+## Key exports
+
+### Database
+| Export | Purpose |
+|---|---|
+| `db` | Shared Drizzle database instance |
+| `getConnection`, `closeConnection` | PostgreSQL connection lifecycle (with retry strategy) |
+| `schema` | All Drizzle table definitions and their `*Insert` / `*Update` types |
+| `runMigrations` (`MigrateOptions`) | Drizzle migration runner |
+| `tenantContext`, `runWithTenantContext`, `getTenantContext`, `withTenantTx` | Tenant-context primitives for scoped/RLS transactions |
+
+### Services
+| Export | Purpose |
+|---|---|
+| `CrudService<TEntity, TFilter, TInsert, TUpdate>` | Abstract base providing `find`, `findById`, `findPaginated`, `count`, `create`, `update`, `delete` (soft), `setDefault`, `updateMany` with multi-tenant access control |
+| `ReportingService` / `reportingService` | Aggregate-query base for pipeline-event ingestion and org-scoped reporting |
+
+### Query builders & filters
+| Export | Purpose |
+|---|---|
+| `AccessControlQueryBuilder` | Row-level, org-scoped condition builder enforcing tenant isolation and the three-rung `visibility` ladder |
+| `buildPipelineConditions`, `buildPluginConditions`, `buildMessageConditions`, and the compliance condition builders | Filter-to-SQL translators used by the services |
+| `PipelineFilter`, `PluginFilter`, `MessageFilter`, the compliance filter types | Typed filter interfaces |
+| `drizzleRows`, `drizzleCount` | Drizzle result type helpers |
+
+## Usage
+
+```typescript
+import { CrudService, db, schema } from '@pipeline-builder/pipeline-data';
+
+class PipelineService extends CrudService<Pipeline, PipelineFilter, PipelineInsert, PipelineUpdate> {
+  // implement buildConditions + a few column accessors; inherit the rest
+}
+```
+
+## Development
+
+```bash
+pnpm build   # projen build (compile + lint + test + package)
+pnpm test    # run the Jest test suite
+```
+
+## License
+
+Apache-2.0. See [LICENSE](./LICENSE).

package/drizzle.config.ts

@@ -0,0 +1,17 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import { defineConfig } from 'drizzle-kit';
+
+export default defineConfig({
+  schema: './src/database/drizzle-schema.ts',
+  out: './drizzle',
+  dialect: 'postgresql',
+  dbCredentials: {
+    host: process.env.DB_HOST || 'localhost',
+    port: parseInt(process.env.DB_PORT || '5432', 10),
+    user: process.env.DB_USER || 'postgres',
+    password: process.env.DB_PASSWORD || 'password',
+    database: process.env.DATABASE || 'pipeline_builder',
+  },
+});

package/lib/api/access-control-builder.d.ts

@@ -0,0 +1,148 @@
+import { SQL } from 'drizzle-orm';
+import type { AnyColumn } from 'drizzle-orm/column';
+/**
+ * Escape SQL LIKE wildcard characters to prevent wildcard injection.
+ * Replaces `%` → `\\%`, `_` → `\\_`, and `\\` → `\\\\`.
+ */
+export declare function escapeLikeWildcards(str: string): string;
+/**
+ * Build a condition that checks if a JSONB text array column contains a keyword (case-insensitive).
+ * Used for keywords/tags filtering on pipelines, plugins, and compliance rules.
+ */
+export declare function buildJsonbKeywordCondition(column: AnyColumn, keyword: string): SQL;
+/**
+ * Parse boolean filter value from string or boolean
+ */
+export declare function parseBooleanFilter(value: unknown): boolean;
+/**
+ * Normalize string filter value to lowercase
+ */
+export declare function normalizeStringFilter(value: unknown): string;
+/**
+ * Build an ID predicate with UUID prefix matching.
+ *
+ * - Full UUID → exact match
+ * - Partial UUID → prefix match via `LIKE` (a list-search affordance)
+ * - Absent → `null` (no predicate)
+ *
+ * Standalone so entities that DON'T use {@link AccessControlQueryBuilder}'s
+ * access control (e.g. pipeline templates, which carry their own three-rung
+ * visibility ladder) still share one id-matching implementation.
+ */
+export declare function buildIdCondition(idColumn: AnyColumn, id: unknown): SQL | null;
+/**
+ * Build the `isDefault` / `isActive` predicates shared by every catalog entity.
+ * `isActive` defaults to true so soft-deleted rows stay out of normal reads.
+ * Standalone for the same reason as {@link buildIdCondition}.
+ */
+export declare function buildBooleanConditions(columns: {
+    isDefault: AnyColumn;
+    isActive: AnyColumn;
+}, filter: {
+    isDefault?: unknown;
+    isActive?: unknown;
+}): SQL[];
+/**
+ * Schema table interface for access control queries. Every catalog entity
+ * carries the same five columns, which is what lets ONE predicate serve
+ * pipelines, plugins and templates alike.
+ */
+export interface AccessControlSchema {
+    id: AnyColumn;
+    orgId: AnyColumn;
+    /** Three-rung sharing ladder — see api-core's `Visibility`. */
+    visibility: AnyColumn;
+    /** Author. Owns the `private` rung. */
+    createdBy: AnyColumn;
+    isDefault: AnyColumn;
+    isActive: AnyColumn;
+}
+/**
+ * Base filter interface with common access control fields.
+ *
+ * `viewerUserId` / `viewerIsSuperAdmin` are SERVER-SET (stamped from the request's
+ * tenant context by `withViewerContext`), never client-supplied — see
+ * `viewer-context.ts` for why the tenant context is the channel.
+ */
+export interface BaseAccessFilter {
+    id?: string | string[];
+    visibility?: string;
+    isDefault?: boolean | string;
+    isActive?: boolean | string;
+    viewerUserId?: string;
+    viewerIsSuperAdmin?: boolean;
+}
+/**
+ * Generic access control query builder for multi-tenant entities.
+ *
+ * Consolidates duplicate access control logic shared across pipeline and plugin queries.
+ * Handles:
+ * - Multi-tenant access control (public/private/org-and-public)
+ * - UUID prefix matching for ID filters
+ * - Boolean field normalization
+ *
+ * @typeParam TSchema - Schema table type with access control fields
+ * @typeParam TFilter - Filter type extending BaseAccessFilter
+ */
+export declare class AccessControlQueryBuilder<TSchema extends AccessControlSchema, TFilter extends BaseAccessFilter> {
+    private schema;
+    constructor(schema: TSchema);
+    /**
+     * Build the caller's visible slice of a catalog, from the three-rung
+     * `visibility` ladder shared by every catalog entity.
+     *
+     * Effective read set for a caller in org `O` as user `V` whose parent org is `P`:
+     *
+     *   (org_id = O AND (visibility <> 'private' OR created_by = V))
+     *   OR (visibility = 'public' AND (org_id = 'system' OR org_id = P))
+     *
+     * i.e. your own org's shared rungs plus your own drafts, widened by the system
+     * org's public catalog (the standing "system-org content is visible from every
+     * org" rule) and — for a team — its parent's public rows. The `public`-only
+     * restriction applies solely to those OTHER orgs' rows; within your own org you
+     * always see everything you are entitled to, or a freshly-created private row
+     * would vanish from its own author's listing.
+     *
+     * An explicit `visibility` filter NARROWS within that set, never widens it —
+     * so `?visibility=public` still surfaces the system-org catalog.
+     *
+     * Fails CLOSED on both axes: no `orgId` (anonymous) ⇒ system-org public only;
+     * no `viewerUserId` ⇒ the private rung matches nothing rather than everything.
+     * `viewerIsSuperAdmin` lifts the private rung only — a platform operator
+     * administers the whole catalog.
+     *
+     * @param filter - Filter criteria
+     * @param orgId - User's organization ID (optional)
+     * @param parentOrgId - Parent org ID when the caller is a team (optional)
+     * @returns Array of SQL conditions for access control
+     */
+    protected buildAccessControl(filter: Partial<TFilter>, orgId?: string, parentOrgId?: string): SQL[];
+    /**
+     * Build ID filter with UUID prefix matching support
+     *
+     * - Full UUID: Exact match
+     * - Partial UUID: Prefix match using SQL LIKE
+     *
+     * @param id - ID filter value (full or partial UUID)
+     * @returns SQL condition or null if no ID filter
+     */
+    protected buildIdFilter(id: unknown): SQL | null;
+    /**
+     * Build boolean field conditions (isDefault, isActive)
+     *
+     * @param filter - Filter criteria
+     * @returns Array of SQL conditions for boolean fields
+     */
+    protected buildBooleanFilters(filter: Partial<TFilter>): SQL[];
+    /**
+     * Build all common conditions (access control + ID + booleans)
+     *
+     * This combines all the generic filters that apply to any access-controlled entity.
+     * Subclasses should call this and add entity-specific conditions.
+     *
+     * @param filter - Filter criteria
+     * @param orgId - User's organization ID (optional — falls back to system-public-only)
+     * @returns Array of SQL conditions
+     */
+    buildCommonConditions(filter: Partial<TFilter>, orgId?: string, parentOrgId?: string): SQL[];
+}

package/lib/api/access-control-builder.js

@@ -0,0 +1,199 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { SYSTEM_ORG_ID } from '@pipeline-builder/api-core';
+import { and, eq, ne, or, sql, SQL } from 'drizzle-orm';
+const FULL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Escape SQL LIKE wildcard characters to prevent wildcard injection.
+ * Replaces `%` → `\\%`, `_` → `\\_`, and `\\` → `\\\\`.
+ */
+export function escapeLikeWildcards(str) {
+    return str.replace(/\\/g, '\\\\').replace(/%/g, '\\%').replace(/_/g, '\\_');
+}
+/**
+ * Build a condition that checks if a JSONB text array column contains a keyword (case-insensitive).
+ * Used for keywords/tags filtering on pipelines, plugins, and compliance rules.
+ */
+export function buildJsonbKeywordCondition(column, keyword) {
+    const escaped = escapeLikeWildcards(keyword.toLowerCase());
+    return sql `EXISTS (SELECT 1 FROM jsonb_array_elements_text(${column}) AS el WHERE lower(el) LIKE ${'%' + escaped + '%'})`;
+}
+/**
+ * Parse boolean filter value from string or boolean
+ */
+export function parseBooleanFilter(value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'string')
+        return value === 'true';
+    return Boolean(value);
+}
+/**
+ * Normalize string filter value to lowercase
+ */
+export function normalizeStringFilter(value) {
+    return typeof value === 'string' ? value.toLowerCase() : String(value).toLowerCase();
+}
+/**
+ * Build an ID predicate with UUID prefix matching.
+ *
+ * - Full UUID → exact match
+ * - Partial UUID → prefix match via `LIKE` (a list-search affordance)
+ * - Absent → `null` (no predicate)
+ *
+ * Standalone so entities that DON'T use {@link AccessControlQueryBuilder}'s
+ * access control (e.g. pipeline templates, which carry their own three-rung
+ * visibility ladder) still share one id-matching implementation.
+ */
+export function buildIdCondition(idColumn, id) {
+    if (id === undefined || id === null)
+        return null;
+    const idString = String(id).toLowerCase();
+    if (FULL_UUID.test(idString)) {
+        return eq(idColumn, idString);
+    }
+    // Escape SQL LIKE wildcards to prevent wildcard injection
+    const escaped = escapeLikeWildcards(idString);
+    return sql `${idColumn}::text LIKE ${escaped + '%'} ESCAPE '\\'`;
+}
+/**
+ * Build the `isDefault` / `isActive` predicates shared by every catalog entity.
+ * `isActive` defaults to true so soft-deleted rows stay out of normal reads.
+ * Standalone for the same reason as {@link buildIdCondition}.
+ */
+export function buildBooleanConditions(columns, filter) {
+    const conditions = [];
+    if (filter.isDefault !== undefined) {
+        conditions.push(eq(columns.isDefault, parseBooleanFilter(filter.isDefault)));
+    }
+    if (filter.isActive !== undefined) {
+        conditions.push(eq(columns.isActive, parseBooleanFilter(filter.isActive)));
+    }
+    else {
+        // Default to active records only to exclude soft-deleted entities
+        conditions.push(eq(columns.isActive, true));
+    }
+    return conditions;
+}
+/** Fail-closed predicate: matches no rows. */
+const NO_ROWS = sql `false`;
+/**
+ * Generic access control query builder for multi-tenant entities.
+ *
+ * Consolidates duplicate access control logic shared across pipeline and plugin queries.
+ * Handles:
+ * - Multi-tenant access control (public/private/org-and-public)
+ * - UUID prefix matching for ID filters
+ * - Boolean field normalization
+ *
+ * @typeParam TSchema - Schema table type with access control fields
+ * @typeParam TFilter - Filter type extending BaseAccessFilter
+ */
+export class AccessControlQueryBuilder {
+    schema;
+    constructor(schema) {
+        this.schema = schema;
+    }
+    /**
+     * Build the caller's visible slice of a catalog, from the three-rung
+     * `visibility` ladder shared by every catalog entity.
+     *
+     * Effective read set for a caller in org `O` as user `V` whose parent org is `P`:
+     *
+     *   (org_id = O AND (visibility <> 'private' OR created_by = V))
+     *   OR (visibility = 'public' AND (org_id = 'system' OR org_id = P))
+     *
+     * i.e. your own org's shared rungs plus your own drafts, widened by the system
+     * org's public catalog (the standing "system-org content is visible from every
+     * org" rule) and — for a team — its parent's public rows. The `public`-only
+     * restriction applies solely to those OTHER orgs' rows; within your own org you
+     * always see everything you are entitled to, or a freshly-created private row
+     * would vanish from its own author's listing.
+     *
+     * An explicit `visibility` filter NARROWS within that set, never widens it —
+     * so `?visibility=public` still surfaces the system-org catalog.
+     *
+     * Fails CLOSED on both axes: no `orgId` (anonymous) ⇒ system-org public only;
+     * no `viewerUserId` ⇒ the private rung matches nothing rather than everything.
+     * `viewerIsSuperAdmin` lifts the private rung only — a platform operator
+     * administers the whole catalog.
+     *
+     * @param filter - Filter criteria
+     * @param orgId - User's organization ID (optional)
+     * @param parentOrgId - Parent org ID when the caller is a team (optional)
+     * @returns Array of SQL conditions for access control
+     */
+    buildAccessControl(filter, orgId, parentOrgId) {
+        const conditions = [];
+        const requested = filter.visibility;
+        if (!orgId) {
+            // No org context — only the system org's public catalog.
+            conditions.push(eq(this.schema.orgId, SYSTEM_ORG_ID));
+            conditions.push(eq(this.schema.visibility, 'public'));
+            // An anonymous caller asking for a narrower rung gets nothing, rather than
+            // having the narrowing silently ignored.
+            if (requested !== undefined && requested !== 'public')
+                conditions.push(NO_ROWS);
+            return conditions;
+        }
+        const normalizedOrgId = orgId.toLowerCase();
+        // Own-org rows: everything EXCEPT other people's private drafts.
+        const ownDraftsOnly = filter.viewerUserId ? eq(this.schema.createdBy, filter.viewerUserId) : NO_ROWS;
+        const ownOrg = filter.viewerIsSuperAdmin
+            ? eq(this.schema.orgId, normalizedOrgId)
+            : and(eq(this.schema.orgId, normalizedOrgId), or(ne(this.schema.visibility, 'private'), ownDraftsOnly));
+        // Rows from OTHER orgs are only ever visible at the `public` rung.
+        const otherOrgScopes = [eq(this.schema.orgId, SYSTEM_ORG_ID)];
+        if (parentOrgId)
+            otherOrgScopes.push(eq(this.schema.orgId, parentOrgId.toLowerCase()));
+        const otherOrgsPublic = and(eq(this.schema.visibility, 'public'), or(...otherOrgScopes));
+        conditions.push(or(ownOrg, otherOrgsPublic));
+        if (requested !== undefined)
+            conditions.push(eq(this.schema.visibility, requested));
+        return conditions;
+    }
+    /**
+     * Build ID filter with UUID prefix matching support
+     *
+     * - Full UUID: Exact match
+     * - Partial UUID: Prefix match using SQL LIKE
+     *
+     * @param id - ID filter value (full or partial UUID)
+     * @returns SQL condition or null if no ID filter
+     */
+    buildIdFilter(id) {
+        return buildIdCondition(this.schema.id, id);
+    }
+    /**
+     * Build boolean field conditions (isDefault, isActive)
+     *
+     * @param filter - Filter criteria
+     * @returns Array of SQL conditions for boolean fields
+     */
+    buildBooleanFilters(filter) {
+        return buildBooleanConditions(this.schema, filter);
+    }
+    /**
+     * Build all common conditions (access control + ID + booleans)
+     *
+     * This combines all the generic filters that apply to any access-controlled entity.
+     * Subclasses should call this and add entity-specific conditions.
+     *
+     * @param filter - Filter criteria
+     * @param orgId - User's organization ID (optional — falls back to system-public-only)
+     * @returns Array of SQL conditions
+     */
+    buildCommonConditions(filter, orgId, parentOrgId) {
+        const conditions = [];
+        // Access control (multi-tenant) — handles visibility internally
+        conditions.push(...this.buildAccessControl(filter, orgId, parentOrgId));
+        // ID filter with prefix matching
+        const idCondition = this.buildIdFilter(filter.id);
+        if (idCondition)
+            conditions.push(idCondition);
+        // Boolean filters
+        conditions.push(...this.buildBooleanFilters(filter));
+        return conditions;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLWNvbnRyb2wtYnVpbGRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hcGkvYWNjZXNzLWNvbnRyb2wtYnVpbGRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUMzRCxPQUFPLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFHeEQsTUFBTSxTQUFTLEdBQUcsaUVBQWlFLENBQUM7QUFFcEY7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLG1CQUFtQixDQUFDLEdBQVc7SUFDN0MsT0FBTyxHQUFHLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDOUUsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSwwQkFBMEIsQ0FBQyxNQUFpQixFQUFFLE9BQWU7SUFDM0UsTUFBTSxPQUFPLEdBQUcsbUJBQW1CLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDM0QsT0FBTyxHQUFHLENBQUEsbURBQW1ELE1BQU0sZ0NBQWdDLEdBQUcsR0FBRyxPQUFPLEdBQUcsR0FBRyxHQUFHLENBQUM7QUFDNUgsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxVQUFVLGtCQUFrQixDQUFDLEtBQWM7SUFDL0MsSUFBSSxPQUFPLEtBQUssS0FBSyxTQUFTO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDN0MsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1FBQUUsT0FBTyxLQUFLLEtBQUssTUFBTSxDQUFDO0lBQ3ZELE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ3hCLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxLQUFjO0lBQ2xELE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztBQUN2RixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxRQUFtQixFQUFFLEVBQVc7SUFDL0QsSUFBSSxFQUFFLEtBQUssU0FBUyxJQUFJLEVBQUUsS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFakQsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQzFDLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sRUFBRSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNoQyxDQUFDO0lBQ0QsMERBQTBEO0lBQzFELE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzlDLE9BQU8sR0FBRyxDQUFBLEdBQUcsUUFBUSxlQUFlLE9BQU8sR0FBRyxHQUFHLGNBQWMsQ0FBQztBQUNsRSxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FDcEMsT0FBc0QsRUFDdEQsTUFBbUQ7SUFFbkQsTUFBTSxVQUFVLEdBQVUsRUFBRSxDQUFDO0lBRTdCLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNuQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUVELElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNsQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDN0UsQ0FBQztTQUFNLENBQUM7UUFDTixrRUFBa0U7UUFDbEUsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFRCxPQUFPLFVBQVUsQ0FBQztBQUNwQixDQUFDO0FBa0NELDhDQUE4QztBQUM5QyxNQUFNLE9BQU8sR0FBUSxHQUFHLENBQUEsT0FBTyxDQUFDO0FBRWhDOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUsxQixNQUFNO0lBRGhCLFlBQ1UsTUFBZTtzQkFBZixNQUFNO0lBQ2IsQ0FBQztJQUVKOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O09BNEJHO0lBQ08sa0JBQWtCLENBQUMsTUFBd0IsRUFBRSxLQUFjLEVBQUUsV0FBb0I7UUFDekYsTUFBTSxVQUFVLEdBQVUsRUFBRSxDQUFDO1FBQzdCLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7UUFFcEMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ1gseURBQXlEO1lBQ3pELFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7WUFDdEQsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUN0RCwyRUFBMkU7WUFDM0UseUNBQXlDO1lBQ3pDLElBQUksU0FBUyxLQUFLLFNBQVMsSUFBSSxTQUFTLEtBQUssUUFBUTtnQkFBRSxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2hGLE9BQU8sVUFBVSxDQUFDO1FBQ3BCLENBQUM7UUFFRCxNQUFNLGVBQWUsR0FBRyxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7UUFFNUMsaUVBQWlFO1FBQ2pFLE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUNyRyxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsa0JBQWtCO1lBQ3RDLENBQUMsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsZUFBZSxDQUFDO1lBQ3hDLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLGVBQWUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLEVBQUUsYUFBYSxDQUFFLENBQUUsQ0FBQztRQUU1RyxtRUFBbUU7UUFDbkUsTUFBTSxjQUFjLEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUM5RCxJQUFJLFdBQVc7WUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLE1BQU0sZUFBZSxHQUFHLEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUcsY0FBYyxDQUFFLENBQUUsQ0FBQztRQUUzRixVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsZUFBZSxDQUFFLENBQUMsQ0FBQztRQUU5QyxJQUFJLFNBQVMsS0FBSyxTQUFTO1lBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUVwRixPQUFPLFVBQVUsQ0FBQztJQUNwQixDQUFDO0lBRUQ7Ozs7Ozs7O09BUUc7SUFDTyxhQUFhLENBQUMsRUFBVztRQUNqQyxPQUFPLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNPLG1CQUFtQixDQUFDLE1BQXdCO1FBQ3BELE9BQU8sc0JBQXNCLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0kscUJBQXFCLENBQUMsTUFBd0IsRUFBRSxLQUFjLEVBQUUsV0FBb0I7UUFDekYsTUFBTSxVQUFVLEdBQVUsRUFBRSxDQUFDO1FBRTdCLGdFQUFnRTtRQUNoRSxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUV4RSxpQ0FBaUM7UUFDakMsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEQsSUFBSSxXQUFXO1lBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUU5QyxrQkFBa0I7UUFDbEIsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBRXJELE9BQU8sVUFBVSxDQUFDO0lBQ3BCLENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBTWVNURU1fT1JHX0lEIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUnO1xuaW1wb3J0IHsgYW5kLCBlcSwgbmUsIG9yLCBzcWwsIFNRTCB9IGZyb20gJ2RyaXp6bGUtb3JtJztcbmltcG9ydCB0eXBlIHsgQW55Q29sdW1uIH0gZnJvbSAnZHJpenpsZS1vcm0vY29sdW1uJztcblxuY29uc3QgRlVMTF9VVUlEID0gL15bMC05YS1mXXs4fS1bMC05YS1mXXs0fS1bMC05YS1mXXs0fS1bMC05YS1mXXs0fS1bMC05YS1mXXsxMn0kL2k7XG5cbi8qKlxuICogRXNjYXBlIFNRTCBMSUtFIHdpbGRjYXJkIGNoYXJhY3RlcnMgdG8gcHJldmVudCB3aWxkY2FyZCBpbmplY3Rpb24uXG4gKiBSZXBsYWNlcyBgJWAg4oaSIGBcXFxcJWAsIGBfYCDihpIgYFxcXFxfYCwgYW5kIGBcXFxcYCDihpIgYFxcXFxcXFxcYC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGVzY2FwZUxpa2VXaWxkY2FyZHMoc3RyOiBzdHJpbmcpOiBzdHJpbmcge1xuICByZXR1cm4gc3RyLnJlcGxhY2UoL1xcXFwvZywgJ1xcXFxcXFxcJykucmVwbGFjZSgvJS9nLCAnXFxcXCUnKS5yZXBsYWNlKC9fL2csICdcXFxcXycpO1xufVxuXG4vKipcbiAqIEJ1aWxkIGEgY29uZGl0aW9uIHRoYXQgY2hlY2tzIGlmIGEgSlNPTkIgdGV4dCBhcnJheSBjb2x1bW4gY29udGFpbnMgYSBrZXl3b3JkIChjYXNlLWluc2Vuc2l0aXZlKS5cbiAqIFVzZWQgZm9yIGtleXdvcmRzL3RhZ3MgZmlsdGVyaW5nIG9uIHBpcGVsaW5lcywgcGx1Z2lucywgYW5kIGNvbXBsaWFuY2UgcnVsZXMuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBidWlsZEpzb25iS2V5d29yZENvbmRpdGlvbihjb2x1bW46IEFueUNvbHVtbiwga2V5d29yZDogc3RyaW5nKTogU1FMIHtcbiAgY29uc3QgZXNjYXBlZCA9IGVzY2FwZUxpa2VXaWxkY2FyZHMoa2V5d29yZC50b0xvd2VyQ2FzZSgpKTtcbiAgcmV0dXJuIHNxbGBFWElTVFMgKFNFTEVDVCAxIEZST00ganNvbmJfYXJyYXlfZWxlbWVudHNfdGV4dCgke2NvbHVtbn0pIEFTIGVsIFdIRVJFIGxvd2VyKGVsKSBMSUtFICR7JyUnICsgZXNjYXBlZCArICclJ30pYDtcbn1cblxuLyoqXG4gKiBQYXJzZSBib29sZWFuIGZpbHRlciB2YWx1ZSBmcm9tIHN0cmluZyBvciBib29sZWFuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBwYXJzZUJvb2xlYW5GaWx0ZXIodmFsdWU6IHVua25vd24pOiBib29sZWFuIHtcbiAgaWYgKHR5cGVvZiB2YWx1ZSA9PT0gJ2Jvb2xlYW4nKSByZXR1cm4gdmFsdWU7XG4gIGlmICh0eXBlb2YgdmFsdWUgPT09ICdzdHJpbmcnKSByZXR1cm4gdmFsdWUgPT09ICd0cnVlJztcbiAgcmV0dXJuIEJvb2xlYW4odmFsdWUpO1xufVxuXG4vKipcbiAqIE5vcm1hbGl6ZSBzdHJpbmcgZmlsdGVyIHZhbHVlIHRvIGxvd2VyY2FzZVxuICovXG5leHBvcnQgZnVuY3Rpb24gbm9ybWFsaXplU3RyaW5nRmlsdGVyKHZhbHVlOiB1bmtub3duKTogc3RyaW5nIHtcbiAgcmV0dXJuIHR5cGVvZiB2YWx1ZSA9PT0gJ3N0cmluZycgPyB2YWx1ZS50b0xvd2VyQ2FzZSgpIDogU3RyaW5nKHZhbHVlKS50b0xvd2VyQ2FzZSgpO1xufVxuXG4vKipcbiAqIEJ1aWxkIGFuIElEIHByZWRpY2F0ZSB3aXRoIFVVSUQgcHJlZml4IG1hdGNoaW5nLlxuICpcbiAqIC0gRnVsbCBVVUlEIOKGkiBleGFjdCBtYXRjaFxuICogLSBQYXJ0aWFsIFVVSUQg4oaSIHByZWZpeCBtYXRjaCB2aWEgYExJS0VgIChhIGxpc3Qtc2VhcmNoIGFmZm9yZGFuY2UpXG4gKiAtIEFic2VudCDihpIgYG51bGxgIChubyBwcmVkaWNhdGUpXG4gKlxuICogU3RhbmRhbG9uZSBzbyBlbnRpdGllcyB0aGF0IERPTidUIHVzZSB7QGxpbmsgQWNjZXNzQ29udHJvbFF1ZXJ5QnVpbGRlcn0nc1xuICogYWNjZXNzIGNvbnRyb2wgKGUuZy4gcGlwZWxpbmUgdGVtcGxhdGVzLCB3aGljaCBjYXJyeSB0aGVpciBvd24gdGhyZWUtcnVuZ1xuICogdmlzaWJpbGl0eSBsYWRkZXIpIHN0aWxsIHNoYXJlIG9uZSBpZC1tYXRjaGluZyBpbXBsZW1lbnRhdGlvbi5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJ1aWxkSWRDb25kaXRpb24oaWRDb2x1bW46IEFueUNvbHVtbiwgaWQ6IHVua25vd24pOiBTUUwgfCBudWxsIHtcbiAgaWYgKGlkID09PSB1bmRlZmluZWQgfHwgaWQgPT09IG51bGwpIHJldHVybiBudWxsO1xuXG4gIGNvbnN0IGlkU3RyaW5nID0gU3RyaW5nKGlkKS50b0xvd2VyQ2FzZSgpO1xuICBpZiAoRlVMTF9VVUlELnRlc3QoaWRTdHJpbmcpKSB7XG4gICAgcmV0dXJuIGVxKGlkQ29sdW1uLCBpZFN0cmluZyk7XG4gIH1cbiAgLy8gRXNjYXBlIFNRTCBMSUtFIHdpbGRjYXJkcyB0byBwcmV2ZW50IHdpbGRjYXJkIGluamVjdGlvblxuICBjb25zdCBlc2NhcGVkID0gZXNjYXBlTGlrZVdpbGRjYXJkcyhpZFN0cmluZyk7XG4gIHJldHVybiBzcWxgJHtpZENvbHVtbn06OnRleHQgTElLRSAke2VzY2FwZWQgKyAnJSd9IEVTQ0FQRSAnXFxcXCdgO1xufVxuXG4vKipcbiAqIEJ1aWxkIHRoZSBgaXNEZWZhdWx0YCAvIGBpc0FjdGl2ZWAgcHJlZGljYXRlcyBzaGFyZWQgYnkgZXZlcnkgY2F0YWxvZyBlbnRpdHkuXG4gKiBgaXNBY3RpdmVgIGRlZmF1bHRzIHRvIHRydWUgc28gc29mdC1kZWxldGVkIHJvd3Mgc3RheSBvdXQgb2Ygbm9ybWFsIHJlYWRzLlxuICogU3RhbmRhbG9uZSBmb3IgdGhlIHNhbWUgcmVhc29uIGFzIHtAbGluayBidWlsZElkQ29uZGl0aW9ufS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJ1aWxkQm9vbGVhbkNvbmRpdGlvbnMoXG4gIGNvbHVtbnM6IHsgaXNEZWZhdWx0OiBBbnlDb2x1bW47IGlzQWN0aXZlOiBBbnlDb2x1bW4gfSxcbiAgZmlsdGVyOiB7IGlzRGVmYXVsdD86IHVua25vd247IGlzQWN0aXZlPzogdW5rbm93biB9LFxuKTogU1FMW10ge1xuICBjb25zdCBjb25kaXRpb25zOiBTUUxbXSA9IFtdO1xuXG4gIGlmIChmaWx0ZXIuaXNEZWZhdWx0ICE9PSB1bmRlZmluZWQpIHtcbiAgICBjb25kaXRpb25zLnB1c2goZXEoY29sdW1ucy5pc0RlZmF1bHQsIHBhcnNlQm9vbGVhbkZpbHRlcihmaWx0ZXIuaXNEZWZhdWx0KSkpO1xuICB9XG5cbiAgaWYgKGZpbHRlci5pc0FjdGl2ZSAhPT0gdW5kZWZpbmVkKSB7XG4gICAgY29uZGl0aW9ucy5wdXNoKGVxKGNvbHVtbnMuaXNBY3RpdmUsIHBhcnNlQm9vbGVhbkZpbHRlcihmaWx0ZXIuaXNBY3RpdmUpKSk7XG4gIH0gZWxzZSB7XG4gICAgLy8gRGVmYXVsdCB0byBhY3RpdmUgcmVjb3JkcyBvbmx5IHRvIGV4Y2x1ZGUgc29mdC1kZWxldGVkIGVudGl0aWVzXG4gICAgY29uZGl0aW9ucy5wdXNoKGVxKGNvbHVtbnMuaXNBY3RpdmUsIHRydWUpKTtcbiAgfVxuXG4gIHJldHVybiBjb25kaXRpb25zO1xufVxuXG4vKipcbiAqIFNjaGVtYSB0YWJsZSBpbnRlcmZhY2UgZm9yIGFjY2VzcyBjb250cm9sIHF1ZXJpZXMuIEV2ZXJ5IGNhdGFsb2cgZW50aXR5XG4gKiBjYXJyaWVzIHRoZSBzYW1lIGZpdmUgY29sdW1ucywgd2hpY2ggaXMgd2hhdCBsZXRzIE9ORSBwcmVkaWNhdGUgc2VydmVcbiAqIHBpcGVsaW5lcywgcGx1Z2lucyBhbmQgdGVtcGxhdGVzIGFsaWtlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFjY2Vzc0NvbnRyb2xTY2hlbWEge1xuICBpZDogQW55Q29sdW1uO1xuICBvcmdJZDogQW55Q29sdW1uO1xuICAvKiogVGhyZWUtcnVuZyBzaGFyaW5nIGxhZGRlciDigJQgc2VlIGFwaS1jb3JlJ3MgYFZpc2liaWxpdHlgLiAqL1xuICB2aXNpYmlsaXR5OiBBbnlDb2x1bW47XG4gIC8qKiBBdXRob3IuIE93bnMgdGhlIGBwcml2YXRlYCBydW5nLiAqL1xuICBjcmVhdGVkQnk6IEFueUNvbHVtbjtcbiAgaXNEZWZhdWx0OiBBbnlDb2x1bW47XG4gIGlzQWN0aXZlOiBBbnlDb2x1bW47XG59XG5cbi8qKlxuICogQmFzZSBmaWx0ZXIgaW50ZXJmYWNlIHdpdGggY29tbW9uIGFjY2VzcyBjb250cm9sIGZpZWxkcy5cbiAqXG4gKiBgdmlld2VyVXNlcklkYCAvIGB2aWV3ZXJJc1N1cGVyQWRtaW5gIGFyZSBTRVJWRVItU0VUIChzdGFtcGVkIGZyb20gdGhlIHJlcXVlc3Qnc1xuICogdGVuYW50IGNvbnRleHQgYnkgYHdpdGhWaWV3ZXJDb250ZXh0YCksIG5ldmVyIGNsaWVudC1zdXBwbGllZCDigJQgc2VlXG4gKiBgdmlld2VyLWNvbnRleHQudHNgIGZvciB3aHkgdGhlIHRlbmFudCBjb250ZXh0IGlzIHRoZSBjaGFubmVsLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEJhc2VBY2Nlc3NGaWx0ZXIge1xuICBpZD86IHN0cmluZyB8IHN0cmluZ1tdO1xuICB2aXNpYmlsaXR5Pzogc3RyaW5nO1xuICBpc0RlZmF1bHQ/OiBib29sZWFuIHwgc3RyaW5nO1xuICBpc0FjdGl2ZT86IGJvb2xlYW4gfCBzdHJpbmc7XG4gIHZpZXdlclVzZXJJZD86IHN0cmluZztcbiAgdmlld2VySXNTdXBlckFkbWluPzogYm9vbGVhbjtcbn1cblxuLyoqIEZhaWwtY2xvc2VkIHByZWRpY2F0ZTogbWF0Y2hlcyBubyByb3dzLiAqL1xuY29uc3QgTk9fUk9XUzogU1FMID0gc3FsYGZhbHNlYDtcblxuLyoqXG4gKiBHZW5lcmljIGFjY2VzcyBjb250cm9sIHF1ZXJ5IGJ1aWxkZXIgZm9yIG11bHRpLXRlbmFudCBlbnRpdGllcy5cbiAqXG4gKiBDb25zb2xpZGF0ZXMgZHVwbGljYXRlIGFjY2VzcyBjb250cm9sIGxvZ2ljIHNoYXJlZCBhY3Jvc3MgcGlwZWxpbmUgYW5kIHBsdWdpbiBxdWVyaWVzLlxuICogSGFuZGxlczpcbiAqIC0gTXVsdGktdGVuYW50IGFjY2VzcyBjb250cm9sIChwdWJsaWMvcHJpdmF0ZS9vcmctYW5kLXB1YmxpYylcbiAqIC0gVVVJRCBwcmVmaXggbWF0Y2hpbmcgZm9yIElEIGZpbHRlcnNcbiAqIC0gQm9vbGVhbiBmaWVsZCBub3JtYWxpemF0aW9uXG4gKlxuICogQHR5cGVQYXJhbSBUU2NoZW1hIC0gU2NoZW1hIHRhYmxlIHR5cGUgd2l0aCBhY2Nlc3MgY29udHJvbCBmaWVsZHNcbiAqIEB0eXBlUGFyYW0gVEZpbHRlciAtIEZpbHRlciB0eXBlIGV4dGVuZGluZyBCYXNlQWNjZXNzRmlsdGVyXG4gKi9cbmV4cG9ydCBjbGFzcyBBY2Nlc3NDb250cm9sUXVlcnlCdWlsZGVyPFxuICBUU2NoZW1hIGV4dGVuZHMgQWNjZXNzQ29udHJvbFNjaGVtYSxcbiAgVEZpbHRlciBleHRlbmRzIEJhc2VBY2Nlc3NGaWx0ZXIsXG4+IHtcbiAgY29uc3RydWN0b3IoXG4gICAgcHJpdmF0ZSBzY2hlbWE6IFRTY2hlbWEsXG4gICkge31cblxuICAvKipcbiAgICogQnVpbGQgdGhlIGNhbGxlcidzIHZpc2libGUgc2xpY2Ugb2YgYSBjYXRhbG9nLCBmcm9tIHRoZSB0aHJlZS1ydW5nXG4gICAqIGB2aXNpYmlsaXR5YCBsYWRkZXIgc2hhcmVkIGJ5IGV2ZXJ5IGNhdGFsb2cgZW50aXR5LlxuICAgKlxuICAgKiBFZmZlY3RpdmUgcmVhZCBzZXQgZm9yIGEgY2FsbGVyIGluIG9yZyBgT2AgYXMgdXNlciBgVmAgd2hvc2UgcGFyZW50IG9yZyBpcyBgUGA6XG4gICAqXG4gICAqICAgKG9yZ19pZCA9IE8gQU5EICh2aXNpYmlsaXR5IDw+ICdwcml2YXRlJyBPUiBjcmVhdGVkX2J5ID0gVikpXG4gICAqICAgT1IgKHZpc2liaWxpdHkgPSAncHVibGljJyBBTkQgKG9yZ19pZCA9ICdzeXN0ZW0nIE9SIG9yZ19pZCA9IFApKVxuICAgKlxuICAgKiBpLmUuIHlvdXIgb3duIG9yZydzIHNoYXJlZCBydW5ncyBwbHVzIHlvdXIgb3duIGRyYWZ0cywgd2lkZW5lZCBieSB0aGUgc3lzdGVtXG4gICAqIG9yZydzIHB1YmxpYyBjYXRhbG9nICh0aGUgc3RhbmRpbmcgXCJzeXN0ZW0tb3JnIGNvbnRlbnQgaXMgdmlzaWJsZSBmcm9tIGV2ZXJ5XG4gICAqIG9yZ1wiIHJ1bGUpIGFuZCDigJQgZm9yIGEgdGVhbSDigJQgaXRzIHBhcmVudCdzIHB1YmxpYyByb3dzLiBUaGUgYHB1YmxpY2Atb25seVxuICAgKiByZXN0cmljdGlvbiBhcHBsaWVzIHNvbGVseSB0byB0aG9zZSBPVEhFUiBvcmdzJyByb3dzOyB3aXRoaW4geW91ciBvd24gb3JnIHlvdVxuICAgKiBhbHdheXMgc2VlIGV2ZXJ5dGhpbmcgeW91IGFyZSBlbnRpdGxlZCB0bywgb3IgYSBmcmVzaGx5LWNyZWF0ZWQgcHJpdmF0ZSByb3dcbiAgICogd291bGQgdmFuaXNoIGZyb20gaXRzIG93biBhdXRob3IncyBsaXN0aW5nLlxuICAgKlxuICAgKiBBbiBleHBsaWNpdCBgdmlzaWJpbGl0eWAgZmlsdGVyIE5BUlJPV1Mgd2l0aGluIHRoYXQgc2V0LCBuZXZlciB3aWRlbnMgaXQg4oCUXG4gICAqIHNvIGA/dmlzaWJpbGl0eT1wdWJsaWNgIHN0aWxsIHN1cmZhY2VzIHRoZSBzeXN0ZW0tb3JnIGNhdGFsb2cuXG4gICAqXG4gICAqIEZhaWxzIENMT1NFRCBvbiBib3RoIGF4ZXM6IG5vIGBvcmdJZGAgKGFub255bW91cykg4oeSIHN5c3RlbS1vcmcgcHVibGljIG9ubHk7XG4gICAqIG5vIGB2aWV3ZXJVc2VySWRgIOKHkiB0aGUgcHJpdmF0ZSBydW5nIG1hdGNoZXMgbm90aGluZyByYXRoZXIgdGhhbiBldmVyeXRoaW5nLlxuICAgKiBgdmlld2VySXNTdXBlckFkbWluYCBsaWZ0cyB0aGUgcHJpdmF0ZSBydW5nIG9ubHkg4oCUIGEgcGxhdGZvcm0gb3BlcmF0b3JcbiAgICogYWRtaW5pc3RlcnMgdGhlIHdob2xlIGNhdGFsb2cuXG4gICAqXG4gICAqIEBwYXJhbSBmaWx0ZXIgLSBGaWx0ZXIgY3JpdGVyaWFcbiAgICogQHBhcmFtIG9yZ0lkIC0gVXNlcidzIG9yZ2FuaXphdGlvbiBJRCAob3B0aW9uYWwpXG4gICAqIEBwYXJhbSBwYXJlbnRPcmdJZCAtIFBhcmVudCBvcmcgSUQgd2hlbiB0aGUgY2FsbGVyIGlzIGEgdGVhbSAob3B0aW9uYWwpXG4gICAqIEByZXR1cm5zIEFycmF5IG9mIFNRTCBjb25kaXRpb25zIGZvciBhY2Nlc3MgY29udHJvbFxuICAgKi9cbiAgcHJvdGVjdGVkIGJ1aWxkQWNjZXNzQ29udHJvbChmaWx0ZXI6IFBhcnRpYWw8VEZpbHRlcj4sIG9yZ0lkPzogc3RyaW5nLCBwYXJlbnRPcmdJZD86IHN0cmluZyk6IFNRTFtdIHtcbiAgICBjb25zdCBjb25kaXRpb25zOiBTUUxbXSA9IFtdO1xuICAgIGNvbnN0IHJlcXVlc3RlZCA9IGZpbHRlci52aXNpYmlsaXR5O1xuXG4gICAgaWYgKCFvcmdJZCkge1xuICAgICAgLy8gTm8gb3JnIGNvbnRleHQg4oCUIG9ubHkgdGhlIHN5c3RlbSBvcmcncyBwdWJsaWMgY2F0YWxvZy5cbiAgICAgIGNvbmRpdGlvbnMucHVzaChlcSh0aGlzLnNjaGVtYS5vcmdJZCwgU1lTVEVNX09SR19JRCkpO1xuICAgICAgY29uZGl0aW9ucy5wdXNoKGVxKHRoaXMuc2NoZW1hLnZpc2liaWxpdHksICdwdWJsaWMnKSk7XG4gICAgICAvLyBBbiBhbm9ueW1vdXMgY2FsbGVyIGFza2luZyBmb3IgYSBuYXJyb3dlciBydW5nIGdldHMgbm90aGluZywgcmF0aGVyIHRoYW5cbiAgICAgIC8vIGhhdmluZyB0aGUgbmFycm93aW5nIHNpbGVudGx5IGlnbm9yZWQuXG4gICAgICBpZiAocmVxdWVzdGVkICE9PSB1bmRlZmluZWQgJiYgcmVxdWVzdGVkICE9PSAncHVibGljJykgY29uZGl0aW9ucy5wdXNoKE5PX1JPV1MpO1xuICAgICAgcmV0dXJuIGNvbmRpdGlvbnM7XG4gICAgfVxuXG4gICAgY29uc3Qgbm9ybWFsaXplZE9yZ0lkID0gb3JnSWQudG9Mb3dlckNhc2UoKTtcblxuICAgIC8vIE93bi1vcmcgcm93czogZXZlcnl0aGluZyBFWENFUFQgb3RoZXIgcGVvcGxlJ3MgcHJpdmF0ZSBkcmFmdHMuXG4gICAgY29uc3Qgb3duRHJhZnRzT25seSA9IGZpbHRlci52aWV3ZXJVc2VySWQgPyBlcSh0aGlzLnNjaGVtYS5jcmVhdGVkQnksIGZpbHRlci52aWV3ZXJVc2VySWQpIDogTk9fUk9XUztcbiAgICBjb25zdCBvd25PcmcgPSBmaWx0ZXIudmlld2VySXNTdXBlckFkbWluXG4gICAgICA/IGVxKHRoaXMuc2NoZW1hLm9yZ0lkLCBub3JtYWxpemVkT3JnSWQpXG4gICAgICA6IGFuZChlcSh0aGlzLnNjaGVtYS5vcmdJZCwgbm9ybWFsaXplZE9yZ0lkKSwgb3IobmUodGhpcy5zY2hlbWEudmlzaWJpbGl0eSwgJ3ByaXZhdGUnKSwgb3duRHJhZnRzT25seSkhKSE7XG5cbiAgICAvLyBSb3dzIGZyb20gT1RIRVIgb3JncyBhcmUgb25seSBldmVyIHZpc2libGUgYXQgdGhlIGBwdWJsaWNgIHJ1bmcuXG4gICAgY29uc3Qgb3RoZXJPcmdTY29wZXMgPSBbZXEodGhpcy5zY2hlbWEub3JnSWQsIFNZU1RFTV9PUkdfSUQpXTtcbiAgICBpZiAocGFyZW50T3JnSWQpIG90aGVyT3JnU2NvcGVzLnB1c2goZXEodGhpcy5zY2hlbWEub3JnSWQsIHBhcmVudE9yZ0lkLnRvTG93ZXJDYXNlKCkpKTtcbiAgICBjb25zdCBvdGhlck9yZ3NQdWJsaWMgPSBhbmQoZXEodGhpcy5zY2hlbWEudmlzaWJpbGl0eSwgJ3B1YmxpYycpLCBvciguLi5vdGhlck9yZ1Njb3BlcykhKSE7XG5cbiAgICBjb25kaXRpb25zLnB1c2gob3Iob3duT3JnLCBvdGhlck9yZ3NQdWJsaWMpISk7XG5cbiAgICBpZiAocmVxdWVzdGVkICE9PSB1bmRlZmluZWQpIGNvbmRpdGlvbnMucHVzaChlcSh0aGlzLnNjaGVtYS52aXNpYmlsaXR5LCByZXF1ZXN0ZWQpKTtcblxuICAgIHJldHVybiBjb25kaXRpb25zO1xuICB9XG5cbiAgLyoqXG4gICAqIEJ1aWxkIElEIGZpbHRlciB3aXRoIFVVSUQgcHJlZml4IG1hdGNoaW5nIHN1cHBvcnRcbiAgICpcbiAgICogLSBGdWxsIFVVSUQ6IEV4YWN0IG1hdGNoXG4gICAqIC0gUGFydGlhbCBVVUlEOiBQcmVmaXggbWF0Y2ggdXNpbmcgU1FMIExJS0VcbiAgICpcbiAgICogQHBhcmFtIGlkIC0gSUQgZmlsdGVyIHZhbHVlIChmdWxsIG9yIHBhcnRpYWwgVVVJRClcbiAgICogQHJldHVybnMgU1FMIGNvbmRpdGlvbiBvciBudWxsIGlmIG5vIElEIGZpbHRlclxuICAgKi9cbiAgcHJvdGVjdGVkIGJ1aWxkSWRGaWx0ZXIoaWQ6IHVua25vd24pOiBTUUwgfCBudWxsIHtcbiAgICByZXR1cm4gYnVpbGRJZENvbmRpdGlvbih0aGlzLnNjaGVtYS5pZCwgaWQpO1xuICB9XG5cbiAgLyoqXG4gICAqIEJ1aWxkIGJvb2xlYW4gZmllbGQgY29uZGl0aW9ucyAoaXNEZWZhdWx0LCBpc0FjdGl2ZSlcbiAgICpcbiAgICogQHBhcmFtIGZpbHRlciAtIEZpbHRlciBjcml0ZXJpYVxuICAgKiBAcmV0dXJucyBBcnJheSBvZiBTUUwgY29uZGl0aW9ucyBmb3IgYm9vbGVhbiBmaWVsZHNcbiAgICovXG4gIHByb3RlY3RlZCBidWlsZEJvb2xlYW5GaWx0ZXJzKGZpbHRlcjogUGFydGlhbDxURmlsdGVyPik6IFNRTFtdIHtcbiAgICByZXR1cm4gYnVpbGRCb29sZWFuQ29uZGl0aW9ucyh0aGlzLnNjaGVtYSwgZmlsdGVyKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBCdWlsZCBhbGwgY29tbW9uIGNvbmRpdGlvbnMgKGFjY2VzcyBjb250cm9sICsgSUQgKyBib29sZWFucylcbiAgICpcbiAgICogVGhpcyBjb21iaW5lcyBhbGwgdGhlIGdlbmVyaWMgZmlsdGVycyB0aGF0IGFwcGx5IHRvIGFueSBhY2Nlc3MtY29udHJvbGxlZCBlbnRpdHkuXG4gICAqIFN1YmNsYXNzZXMgc2hvdWxkIGNhbGwgdGhpcyBhbmQgYWRkIGVudGl0eS1zcGVjaWZpYyBjb25kaXRpb25zLlxuICAgKlxuICAgKiBAcGFyYW0gZmlsdGVyIC0gRmlsdGVyIGNyaXRlcmlhXG4gICAqIEBwYXJhbSBvcmdJZCAtIFVzZXIncyBvcmdhbml6YXRpb24gSUQgKG9wdGlvbmFsIOKAlCBmYWxscyBiYWNrIHRvIHN5c3RlbS1wdWJsaWMtb25seSlcbiAgICogQHJldHVybnMgQXJyYXkgb2YgU1FMIGNvbmRpdGlvbnNcbiAgICovXG4gIHB1YmxpYyBidWlsZENvbW1vbkNvbmRpdGlvbnMoZmlsdGVyOiBQYXJ0aWFsPFRGaWx0ZXI+LCBvcmdJZD86IHN0cmluZywgcGFyZW50T3JnSWQ/OiBzdHJpbmcpOiBTUUxbXSB7XG4gICAgY29uc3QgY29uZGl0aW9uczogU1FMW10gPSBbXTtcblxuICAgIC8vIEFjY2VzcyBjb250cm9sIChtdWx0aS10ZW5hbnQpIOKAlCBoYW5kbGVzIHZpc2liaWxpdHkgaW50ZXJuYWxseVxuICAgIGNvbmRpdGlvbnMucHVzaCguLi50aGlzLmJ1aWxkQWNjZXNzQ29udHJvbChmaWx0ZXIsIG9yZ0lkLCBwYXJlbnRPcmdJZCkpO1xuXG4gICAgLy8gSUQgZmlsdGVyIHdpdGggcHJlZml4IG1hdGNoaW5nXG4gICAgY29uc3QgaWRDb25kaXRpb24gPSB0aGlzLmJ1aWxkSWRGaWx0ZXIoZmlsdGVyLmlkKTtcbiAgICBpZiAoaWRDb25kaXRpb24pIGNvbmRpdGlvbnMucHVzaChpZENvbmRpdGlvbik7XG5cbiAgICAvLyBCb29sZWFuIGZpbHRlcnNcbiAgICBjb25kaXRpb25zLnB1c2goLi4udGhpcy5idWlsZEJvb2xlYW5GaWx0ZXJzKGZpbHRlcikpO1xuXG4gICAgcmV0dXJuIGNvbmRpdGlvbnM7XG4gIH1cbn1cbiJdfQ==