@smartkomm/plexus-cli 0.1.11 → 0.1.12

package/dist/cli.mjs

@@ -9599,12 +9599,12 @@ Der Link gilt {{gueltigkeit}} und funktioniert einmal. Danach werden Sie \xFCber
 
 {{passwortLink}}
 
-The link is valid for {{gueltigkeit}} and works once. Afterwards you are signed out everywhere. Until then your current password keeps working \u2014 if you want nothing changed, ignore this email.`}}]},GU=b.object({}),zU={id:"account.emailChanged",category:"security",label:"Anmelde-Adresse ge\xE4ndert",occasion:{de:"Wenn jemand anderes als der Kontoinhaber die Anmelde-Adresse \xE4ndert \u2014 an die bisherige Adresse",en:"When someone other than the account holder changes the login address \u2014 to the previous address"},audience:"external",frame:"letter",timeline:"hidden",paramsValidator:GU,channels:["email"],lockedReason:{de:"Dieser Hinweis sch\xFCtzt Familien davor, dass jemand unbemerkt ihr Konto \xFCbernimmt. Sein Wortlaut ist deshalb fest.",en:"This notice protects families from someone taking over their account unnoticed, so its wording is fixed."},maxAttempts:4,portalVisible:!1},oy=[TV,_V,DV,FV,LV,KV,YV,QV,lU,cU,fU,hU,wU,kU,SU,TU,IU,PU,ZV,XV,eU,_U,NU,CU,jV,BV,UV,WV,oU,RV,OV,FU,MU,KU,BU,UU,zU];function sy(e){let t=oy.find(n=>n.id===e);return t===void 0&&_(`notifications: unknown letter "${e}"`),t}s(sy,"letterDefFor");function ay(e){return oy.some(t=>t.id===e)}s(ay,"hasLetterDef");var Ai=1024*1024,el=["application/pdf","image/jpeg","image/png","image/webp"];var af=["application/pdf","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/msword","application/vnd.oasis.opendocument.text","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","image/jpeg","image/png"],WR={docRef:{maxBytes:25*Ai,allowedMime:el},partyFile:{maxBytes:25*Ai,allowedMime:el},import:{maxBytes:500*Ai,allowedMime:null},signedContract:{maxBytes:25*Ai,allowedMime:el},artifactVersion:{maxBytes:25*Ai,allowedMime:el},chatAttachment:{maxBytes:25*Ai,allowedMime:el},tenantFile:{maxBytes:20*Ai,allowedMime:af},documentTemplate:{maxBytes:25*Ai,allowedMime:null}};var ly=/^[a-z0-9][a-z0-9-]*$/;function bs(e){return ly.test(e)}s(bs,"isFileKey");function uo(e){return e.trim()===""?"is empty":e==="."||e===".."?"is not a file name":/[/\\]/.test(e)?"must not contain a path separator":/[\u0000-\u001f]/.test(e)?"must not contain control characters":null}s(uo,"fileNameDefect");var HR=b.object({family:b.string()}),YR=b.object({family:b.string(),url:b.optional(b.string())}),yae=b.object({heading:b.optional(YR),body:b.optional(YR)}),WU=b.union(b.literal("sharp"),b.literal("rounded"),b.literal("soft")),HU=b.union(b.literal("light"),b.literal("dark")),YU=b.union(b.literal("sm"),b.literal("md"),b.literal("lg"),b.literal("max")),JU=b.union(b.literal("compact"),b.literal("normal"),b.literal("spacious")),QU=b.object({primary:b.optional(b.string()),accent:b.optional(b.string()),background:b.optional(b.string()),foreground:b.optional(b.string())}),ZU=b.object({heading:b.optional(HR),body:b.optional(HR)}),wae=b.object({colors:b.optional(QU),radius:b.optional(WU),logoSize:b.optional(YU),bannerDensity:b.optional(JU),logoGround:b.optional(HU),filledHeader:b.optional(b.boolean()),websiteUrl:b.optional(b.string()),fonts:b.optional(ZU)}),bae=b.object({primaryUrl:b.union(b.null(),b.string())}),kae=b.literal("primary"),vae=b.object({headingUrl:b.union(b.null(),b.string()),bodyUrl:b.union(b.null(),b.string())}),xae=b.union(b.literal("heading"),b.literal("body")),lf=["logo","fontHeading","fontBody"],JR={logo:null,fontHeading:"heading",fontBody:"body"};function QR(e){let{contentType:t,size:n}=e;return t==null||!t.startsWith("image/")?{de:`Das Logo muss ein Bild sein (erhalten: \u201E${t??"unbekannt"}\u201C).`,en:`The logo must be an image (received: "${t??"unknown"}").`}:t.startsWith("image/svg")?{de:"Das Logo muss eine Rastergrafik sein (PNG, JPEG oder GIF) \u2013 E-Mail-Programme zeigen SVG nicht an.",en:"The logo must be a raster image (PNG, JPEG or GIF) \u2013 email clients do not display SVG."}:n>3e6?{de:`Das Logo ist zu gro\xDF (${n} Byte, h\xF6chstens 3000000 Byte).`,en:`The logo is too large (${n} bytes, at most 3000000 bytes).`}:null}s(QR,"logoFileProblem");var dy="font/woff2";var XU=["Inter Variable","Azeret Mono Variable","Source Sans 3 Variable"];function ZR(e){return e?.trim()?XU.some(t=>t.toLowerCase()===e.trim().toLowerCase())?{de:`\u201E${e}\u201C ist die Schrift von Plexus selbst \u2013 w\xE4hlen Sie f\xFCr eine eigene Datei einen anderen Familiennamen.`,en:`"${e}" is Plexus's own typeface \u2013 choose a different family name for your own file.`}:null:{de:"Speichern Sie zuerst die Schriftfamilie \u2013 die Datei wird unter diesem Namen eingebunden.",en:"Save the font family first \u2013 the file is registered under that name."}}s(ZR,"fontFamilyProblem");var eG=["login","security","admission","tasks","schoolMessages","staffTasks","staffAppointments","staffDeadlines","familyMessages","mentions"],Oae=b.union(...eG.map(e=>b.literal(e)));var Pae=b.union(b.literal("admission"),b.literal("tasks"),b.literal("staff"),b.literal("chat")),cy=["loginOnly","all"],_ae=b.union(b.literal("loginOnly"),b.literal("all"));function XR(e){return typeof e=="string"&&cy.includes(e)}s(XR,"isMailLevel");var tG=["ad","ae","af","ag","ai","al","am","ao","aq","ar","as","at","au","aw","ax","az","ba","bb","bd","be","bf","bg","bh","bi","bj","bl","bm","bn","bo","bq","br","bs","bt","bv","bw","by","bz","ca","cc","cd","cf","cg","ch","ci","ck","cl","cm","cn","co","cr","cu","cv","cw","cx","cy","cz","de","dj","dk","dm","do","dz","ec","ee","eg","eh","er","es","et","fi","fj","fk","fm","fo","fr","ga","gb","gd","ge","gf","gg","gh","gi","gl","gm","gn","gp","gq","gr","gs","gt","gu","gw","gy","hk","hm","hn","hr","ht","hu","id","ie","il","im","in","io","iq","ir","is","it","je","jm","jo","jp","ke","kg","kh","ki","km","kn","kp","kr","kw","ky","kz","la","lb","lc","li","lk","lr","ls","lt","lu","lv","ly","ma","mc","md","me","mf","mg","mh","mk","ml","mm","mn","mo","mp","mq","mr","ms","mt","mu","mv","mw","mx","my","mz","na","nc","ne","nf","ng","ni","nl","no","np","nr","nu","nz","om","pa","pe","pf","pg","ph","pk","pl","pm","pn","pr","ps","pt","pw","py","qa","re","ro","rs","ru","rw","sa","sb","sc","sd","se","sg","sh","si","sj","sk","sl","sm","sn","so","sr","ss","st","sv","sx","sy","sz","tc","td","tf","tg","th","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","tz","ua","ug","um","us","uy","uz","va","vc","ve","vg","vi","vn","vu","wf","ws","xk","ye","yt","za","zm","zw"],nG=new Set(tG);function df(e){return nG.has(e)}s(df,"isCountryCode");var uy=["off","always","deviating"],eI={mode:"deviating",defaultCountryCode:"de"};var rG=["street","plz","ort"];function iG(e){return rG.filter(t=>!e.has(t))}s(iG,"missingInvoiceAddressParts");var oG=new Set(["0-1-select","0-n-select"]);function tI(e){return e===void 0?null:new Set(e.properties.flatMap(t=>t.addressPart!==void 0&&b$(t.addressPart)?[t.addressPart]:[]))}s(tI,"declaredAddressParts");function sG(e){return oG.has(e)}s(sG,"isSelectFieldKind");function nI(e){let t=[];for(let o of e)if(o.isNationality&&(sG(o.kind)?o.listKind!=="country"&&t.push({code:"nationality/notCountryList",fieldKey:o.key}):t.push({code:"nationality/wrongFieldKind",fieldKey:o.key})),o.isAccountEmail&&o.kind!=="email"&&t.push({code:"accountEmail/wrongFieldKind",fieldKey:o.key}),o.isContactPhone&&o.kind!=="tel"&&t.push({code:"contactPhone/wrongFieldKind",fieldKey:o.key}),o.isInvoiceAddress)if(o.addressParts===null)t.push({code:"invoiceAddress/wrongFieldKind",fieldKey:o.key});else{let a=iG(o.addressParts);a.length>0&&t.push({code:"invoiceAddress/missingPart",fieldKey:o.key,parts:a})}let n=e.filter(o=>o.isAccountEmail);if(n.length>1)for(let o of n)t.push({code:"accountEmail/multiple",fieldKey:o.key});let r=e.filter(o=>o.isContactPhone);if(r.length>1)for(let o of r)t.push({code:"contactPhone/multiple",fieldKey:o.key});let i=e.filter(o=>o.isInvoiceAddress);if(i.length>1)for(let o of i)t.push({code:"invoiceAddress/multiple",fieldKey:o.key});return t}s(nI,"fieldRoleFindings");function rI(e,t,...n){let r=e[t.code];return r(t,...n)}s(rI,"wordListElementFinding");function iI(e,t){let n=[];for(let r of t){if(e.kind==="plain"){r.countryCode!==void 0&&n.push({code:"list/countryCodeOnPlain",elementKey:r.key,countryCode:r.countryCode});continue}r.countryCode===void 0?n.push({code:"list/countryCodeMissing",elementKey:r.key}):r.countryCode!==null&&!df(r.countryCode)&&n.push({code:"list/unknownCountryCode",elementKey:r.key,countryCode:r.countryCode})}return n}s(iI,"listElementCountryFindings");var lG={key:!0,tenant:!0,foundation:!0,source:!0,displayGroups:!0,lists:!0,roles:!0,fields:!0,roleFields:!0,contractRoleMappings:!0,templatePlaceholders:!0,searchTargets:!0,searchFilters:!0,partyResultIcons:!0,notificationLetters:!0,admission:!0,files:!0,agent:!0,deferredColumns:!0,ignoredColumns:!0},dG={slug:!0,name:!0,enabledModules:!0,permissions:!0,defaultApplicantGroupKey:!0,defaultEnrolleeRoleKey:!0,priceCriteriaFacts:!0,defaultInteressentRoleKey:!0,admissionFieldDisplayGroupKey:!0,defaultStartInProxy:!0,terms:!0,mailLevel:!0,notificationChrome:!0,hideMailLevelNotice:!0,magicLinkLogin:!0,externalSignIn:!0,nationalityFlag:!0,bankImportScope:!0,branding:!0,brandingAssets:!0,partyRetention:!0},cG=new Set(["enabledMailCategories","mailEnabled"]);function uG(e){let t=s((n,r,i)=>n.filter(o=>!Object.hasOwn(r,o)&&!(i==="tenant."&&cG.has(o))).map(o=>`[config/unknownKey] ${i}${o} is not a config field of this release \u2014 a typo, or a field a newer release introduced.`),"unknown");return[...t(Object.keys(e),lG,""),...t(Object.keys(e.tenant),dG,"tenant.")]}s(uG,"unknownKeyFindings");var oI=["plain","country"],fG={"list/countryCodeMissing":s(({elementKey:e},t)=>`Element "${t}.${e}" of a country list must state countryCode (null for no state).`,"list/countryCodeMissing"),"list/countryCodeOnPlain":s(({elementKey:e},t)=>`Element "${t}.${e}" carries countryCode, but list "${t}" is not kind "country".`,"list/countryCodeOnPlain"),"list/unknownCountryCode":s(({elementKey:e,countryCode:t},n)=>`Element "${n}.${e}" has unknown countryCode ${JSON.stringify(t)}.`,"list/unknownCountryCode")},pG={"nationality/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isNationality but not a 0-1-select / 0-n-select.`,"nationality/wrongFieldKind"),"nationality/notCountryList":s(({fieldKey:e})=>`Field "${e}" is isNationality but its list is not kind "country".`,"nationality/notCountryList"),"accountEmail/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isAccountEmail but not an email field.`,"accountEmail/wrongFieldKind"),"accountEmail/multiple":s(({fieldKey:e})=>`Field "${e}" is one of several isAccountEmail fields \u2014 at most one per tenant.`,"accountEmail/multiple"),"contactPhone/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isContactPhone but not a tel field.`,"contactPhone/wrongFieldKind"),"contactPhone/multiple":s(({fieldKey:e})=>`Field "${e}" is one of several isContactPhone fields \u2014 at most one per tenant.`,"contactPhone/multiple"),"invoiceAddress/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isInvoiceAddress but not an object field.`,"invoiceAddress/wrongFieldKind"),"invoiceAddress/missingPart":s(({fieldKey:e,parts:t})=>`Field "${e}" is isInvoiceAddress but declares no property for the address part(s) ${t.join(", ")} (objectSchema.properties[].addressPart) \u2014 an invoice cannot print its address without them.`,"invoiceAddress/missingPart"),"invoiceAddress/multiple":s(({fieldKey:e})=>`Field "${e}" is one of several isInvoiceAddress fields \u2014 at most one per tenant.`,"invoiceAddress/multiple")};function mG(e){let t=pG[e.code];return t(e)}s(mG,"roleText");function hG(e){let t=[],n=e.tenant.nationalityFlag,r=typeof n=="object"&&n!==null?n:{},i=r.mode;if(uy.includes(i)||t.push(`[nationality/flagMode] tenant.nationalityFlag.mode must be one of ${uy.join(", ")} (got ${n===void 0?"no tenant.nationalityFlag":JSON.stringify(i??null)}).`),n!==void 0){let l=r.defaultCountryCode;(typeof l!="string"||!df(l))&&t.push(`[nationality/defaultCountryCode] tenant.nationalityFlag.defaultCountryCode must be a lowercase ISO 3166-1 alpha-2 code (got ${JSON.stringify(l??null)}).`)}let o=new Map;for(let l of e.lists){let d=l.kind;if(!oI.includes(d)){t.push(`[list/kind] List "${l.key}" has kind ${JSON.stringify(d??null)} \u2014 one of ${oI.join(", ")}.`);continue}o.set(l.key,l.kind);for(let c of iI({key:l.key,kind:l.kind},l.elements))t.push(`[${c.code}] ${rI(fG,c,l.key)}`)}let a=nI(e.fields.map(l=>({key:l.key,kind:l.type,listKind:l.listKey===void 0?null:o.get(l.listKey)??null,isNationality:l.isNationality===!0,isAccountEmail:l.isAccountEmail===!0,isContactPhone:l.isContactPhone===!0,isInvoiceAddress:l.isInvoiceAddress===!0,addressParts:l.type==="object"?tI(l.objectSchema??{properties:[]}):null})));for(let l of a)t.push(`[${l.code}] ${mG(l)}`);return t}s(hG,"nationalityFindings");function sI(e){return di(e)?.message.de??(e instanceof Error?e.message:String(e))}s(sI,"errorText");function aI(e,t={}){let n=[...uG(e)],r=[];try{xR(e.fields.map(k=>k.key),[])}catch(k){n.push(sI(k))}e.tenant.terms!==void 0&&n.push(...NR(e.tenant.terms)),XR(e.tenant.mailLevel)?e.tenant.mailLevel==="all"&&!Gu(e.tenant.enabledModules,"notifications")&&n.push('[notification/levelWithoutModule] tenant.mailLevel is "all" but the notifications module is not enabled \u2014 only sign-in and security mail would go out. Enable the module or set "loginOnly".'):n.push(`[notification/mailLevel] tenant.mailLevel must be one of ${cy.join(", ")} (got ${e.tenant.mailLevel===void 0?"nothing":JSON.stringify(e.tenant.mailLevel)}).`),"enabledMailCategories"in e.tenant&&n.push('[notification/mailCategoriesRetired] tenant.enabledMailCategories was replaced by tenant.mailLevel \u2014 "all" for every mail, "loginOnly" for sign-in mail only to families (staff mail follows personal settings).'),"mailEnabled"in e.tenant&&n.push('[notification/mailEnabledRetired] tenant.mailEnabled was replaced by tenant.mailLevel \u2014 "all" for every mail, "loginOnly" for sign-in mail only to families (staff mail follows personal settings).'),St(e.displayGroups.map(k=>k.key),"display group",n),St(e.lists.map(k=>k.key),"list",n),St(e.roles.map(k=>k.key),"role",n),St(e.fields.map(k=>k.key),"field",n),St(e.foundation.legalEntities.map(k=>k.key),"legal entity",n),St(e.foundation.units.map(k=>k.key),"unit",n),St(e.foundation.permissionGroups.map(k=>k.key),"permission group",n),"teams"in e.foundation&&n.push("foundation.teams is retired: a team is a permission group \u2014 move each team to foundation.permissionGroups (same key) and remove the block.");for(let k of e.foundation.users)"teamKeys"in k&&n.push(`User "${k.email}" carries teamKeys, retired: team membership is the user's permission-group membership.`);St(e.foundation.users.map(k=>k.key),"user",n),St((e.searchFilters??[]).map(k=>k.key),"search filter",n),St((e.searchTargets??[]).map(k=>k.objectPropertyKey===void 0?k.fieldKey:`${k.fieldKey}.${k.objectPropertyKey}`),"search target",n),St((e.partyResultIcons??[]).map(k=>k.key),"party result icon",n),St((e.templatePlaceholders??[]).map(k=>k.key),"template placeholder",n),St((e.notificationLetters??[]).map(lI),"notification letter",n),SG(e.notificationLetters??[],n),AG(e.tenant.notificationChrome,n),e.tenant.bankImportScope!==void 0&&!["sepa_only","full_statement"].includes(e.tenant.bankImportScope)&&n.push("tenant.bankImportScope must be sepa_only or full_statement."),e.tenant.hideMailLevelNotice!==void 0&&typeof e.tenant.hideMailLevelNotice!="boolean"&&n.push("tenant.hideMailLevelNotice must be true or false (the dashboard's mail-level notice)."),typeof e.tenant.magicLinkLogin!="boolean"&&n.push("tenant.magicLinkLogin must be true or false (the login page's sign-in link option)."),bR(e.tenant.externalSignIn)||n.push(`[auth/externalSignIn] tenant.externalSignIn must be { mode: "permanentLink" }, { mode: "oneTimeLink" } or { mode: "periodLink", validDays: 1\u2013${Bg} } (how families sign in).`);let i=new Set(e.displayGroups.map(k=>k.key)),o=new Set(e.lists.map(k=>k.key)),a=new Set(e.roles.map(k=>k.key)),l=new Set(e.fields.map(k=>k.key)),d=new Map(e.fields.map(k=>[k.key,k])),c=new Set(e.foundation.legalEntities.map(k=>k.key)),u=new Set(e.foundation.units.map(k=>k.key)),f=new Set(e.foundation.permissionGroups.map(k=>k.key));Gu(e.tenant.enabledModules,"bewerbungsmanagement")&&e.tenant.defaultApplicantGroupKey!==void 0&&(e.foundation.permissionGroups.find(A=>A.key===e.tenant.defaultApplicantGroupKey)?.permissions.includes("bewerbungsmanagement.applications.submitOwn")||n.push(`Default applicant group "${e.tenant.defaultApplicantGroupKey}" must grant submitOwn.`));let m=e.tenant.admissionFieldDisplayGroupKey;m!==void 0&&!i.has(m)&&n.push(`tenant.admissionFieldDisplayGroupKey "${m}" names no display group of this config.`),m===void 0&&(Gu(e.tenant.enabledModules,"bewerbungsmanagement")||(e.admission?.fields.length??0)>0)&&n.push("tenant.admissionFieldDisplayGroupKey is required when admissions is enabled or admission.fields declares fields: it names the display group the fields an offer creates land in."),n.push(...hG(e)),St(e.fields.flatMap(k=>(k.relationshipKinds??[]).map(A=>A.key)),"relationship kind",n);for(let k of e.fields){i.has(k.displayGroupKey)||n.push(`Field "${k.key}" references missing display group "${k.displayGroupKey}".`),yG(k,n),k.formWritable===!0&&!Wg[k.type].fieldMapTarget&&n.push(`Field "${k.key}" is formWritable, but a form cannot write a "${k.type}" field.`),k.type==="auto-string"?wG(k,d,n):k.autoString!==void 0&&n.push(`Non-automatic field "${k.key}" must not define autoString.`),(!Number.isFinite(k.sortOrder)||k.sortOrder<0)&&n.push(`Field "${k.key}" has invalid sortOrder "${k.sortOrder}" (must be a non-negative number).`),(k.type==="0-1-select"||k.type==="0-n-select")&&!k.listKey&&n.push(`Select field "${k.key}" must define listKey.`),k.type!=="0-1-select"&&k.type!=="0-n-select"&&k.listKey!==void 0&&n.push(`Non-select field "${k.key}" must not define listKey.`),k.listKey&&!o.has(k.listKey)&&n.push(`Field "${k.key}" references missing list "${k.listKey}".`),(k.type==="object"||k.type==="relationship")&&!k.objectSchema&&n.push(`Field "${k.key}" must define objectSchema.`),k.type!=="object"&&k.type!=="relationship"&&k.objectSchema&&n.push(`Non-object field "${k.key}" must not define objectSchema.`);for(let A of k.objectSchema?.properties??[])(A.type==="0-1-select"||A.type==="0-n-select")&&!A.listKey&&n.push(`Object select property "${k.key}.${A.key}" must define listKey.`),A.listKey&&!o.has(A.listKey)&&n.push(`Object property "${k.key}.${A.key}" references missing list "${A.listKey}".`);gG(k,n)}let g=e.tenant.priceCriteriaFacts;if(g){let k=e.fields.find(A=>A.key===g.birthDateFieldKey);(!k||k.type!=="date")&&n.push("Price criteria require a configured date field for birth dates."),a.has(g.studentRoleKey)||n.push("Price criteria require a configured Student eligibility role.");for(let A of Object.keys(g))A!=="birthDateFieldKey"&&A!=="studentRoleKey"&&n.push(`Unknown price criteria fact setting "${A}".`)}let w=e.tenant.defaultEnrolleeRoleKey;w&&!a.has(w)&&n.push(`Default enrollment role "${w}" does not exist.`),w&&e.roles.some(k=>k.parentRoleKey===w)&&n.push(`Default enrollment role "${w}" must be a leaf role.`);for(let k of e.roles){(typeof k.icon!="string"||k.icon.trim().length===0)&&n.push(`Role "${k.key}" must define an icon.`),k.parentRoleKey&&!a.has(k.parentRoleKey)&&n.push(`Role "${k.key}" references missing parent role "${k.parentRoleKey}".`);for(let A of k.listDisplayFieldKeys??[])l.has(A)||n.push(`Role "${k.key}" list display references missing field "${A}".`)}let y=new Map(e.roles.map(k=>[k.key,k.parentRoleKey])),v=new Map;for(let k of e.roleFields){let A=v.get(k.roleKey)??[];A.push({roleId:k.roleKey,customFieldId:k.fieldKey}),v.set(k.roleKey,A)}for(let k of e.roles)try{kR(k.key,y,v)}catch(A){n.push(sI(A))}for(let k of e.roleFields){a.has(k.roleKey)||n.push(`Role field references missing role "${k.roleKey}" for field "${k.fieldKey}".`),l.has(k.fieldKey)||n.push(`Role field references missing field "${k.fieldKey}" for role "${k.roleKey}".`);for(let A of k.targetRequirementFieldKeys??[])l.has(A)||n.push(`Role field "${k.roleKey}.${k.fieldKey}" references missing target requirement field "${A}".`)}xG(e.contractRoleMappings??[],a,n);for(let k of e.templatePlaceholders??[])lR.test(k.key)||n.push(`Template placeholder "${k.key}" must use lower_snake_case segments, optionally separated by dots.`),k.source.kind==="customField"?cf(k.source,d,n,`Template placeholder "${k.key}"`):k.source.kind==="relationshipTargetField"&&bG(k,d,n);for(let k of e.searchTargets??[])cf(k,d,n,"Search target");for(let k of e.fields)OR(k.key)&&(k.defaultValue!==void 0||k.validations!==void 0)&&n.push(`System field "${k.key}" takes no defaultValue or validations.`);for(let k of e.lists)St(k.elements.map((A,q)=>String(A.sortOrder??(q+1)*10)),`sortOrder of an element of list "${k.key}"`,n);for(let k of e.searchFilters??[])St((k.options??[]).map((A,q)=>String(A.sortOrder??(q+1)*10)),`sortOrder of an option of search filter "${k.key}"`,n);for(let k of e.foundation.permissionGroups){k.grantAllCustomFields===!0&&k.customFieldPermissions!==void 0&&n.push(`Permission group "${k.key}" states both grantAllCustomFields and customFieldPermissions \u2014 one of them.`),St((k.customFieldPermissions??[]).map(A=>A.displayGroupKey),`display group of a field permission of group "${k.key}"`,n);for(let A of k.customFieldPermissions??[]){i.has(A.displayGroupKey)||n.push(`Permission group "${k.key}" grants field permissions on missing display group "${A.displayGroupKey}".`);for(let q of A.permissions)$R.includes(q)||n.push(`Permission group "${k.key}" grants unknown field permission "${q}".`)}}let T=e.tenant.partyRetention;T!==void 0&&(IR(T.days)||n.push(`tenant.partyRetention.days must be a whole number of days from 1 to ${36500} (got ${JSON.stringify(T.days)}).`),Number.isFinite(T.enabledAt)||n.push("tenant.partyRetention.enabledAt must be a timestamp (epoch ms)."),T.formerRoleKey!==void 0&&!a.has(T.formerRoleKey)&&n.push(`tenant.partyRetention references missing role "${T.formerRoleKey}".`));for(let k of e.searchFilters??[]){(k.kind==="chips"||k.kind==="select")&&(k.options?.length??0)===0&&n.push(`Search filter "${k.key}" must define options.`),(k.kind==="text"||k.kind==="numberRange")&&k.target===void 0&&n.push(`Search filter "${k.key}" must define a target field.`),k.options!==void 0&&St(k.options.map(A=>A.key),`search filter option for "${k.key}"`,n),cf(k.target,d,n,`Search filter "${k.key}"`);for(let A of k.options??[]){A.predicates.length===0&&n.push(`Search filter option "${k.key}.${A.key}" must define at least one predicate.`);for(let q of A.predicates){if(q.kind==="role"){a.has(q.roleKey)||n.push(`Search filter option "${k.key}.${A.key}" references missing role "${q.roleKey}".`);continue}cf(q,d,n,`Search filter option "${k.key}.${A.key}"`)}}}for(let k of e.partyResultIcons??[])kG(k,d,n);for(let k of e.foundation.legalEntities)if(k.signatoryUserKey!==void 0&&k.type==="school_group"&&n.push(`[config/signatoryOnGroup] Legal entity "${k.key}" is a school_group \u2014 only a Tr\xE4ger (school_operator, service_entity) declares an Unterschriftsperson.`),k.parentLegalEntityKey&&!c.has(k.parentLegalEntityKey)&&n.push(`Legal entity "${k.key}" references missing parent "${k.parentLegalEntityKey}".`),k.address!==void 0){let A=k.address,q=["street","hausnr","plz","ort"];k.type==="school_group"?n.push(`Legal entity "${k.key}" is a school_group \u2014 only a Tr\xE4ger (school_operator, service_entity) has an address.`):(typeof A!="object"||A===null||Array.isArray(A)||Object.keys(A).some(P=>!q.includes(P))||q.some(P=>typeof A[P]!="string"||(A[P]??"").trim()===""))&&n.push(`Legal entity "${k.key}" has an invalid address \u2014 expected { street, hausnr, plz, ort }, each non-empty.`)}let $=new Map;for(let k of e.foundation.units){if(k.slug!==void 0){let A=typeof k.slug=="string"?ER(k.slug):"must be a string";A!==void 0&&n.push(`Unit "${k.key}" has invalid slug "${k.slug}" (${A}).`);let q=$.get(k.slug);q!==void 0&&n.push(`Units "${q}" and "${k.key}" both declare slug "${k.slug}" (unit slugs are unique per tenant).`),$.set(k.slug,k.key)}c.has(k.legalEntityKey)||n.push(`Unit "${k.key}" references missing legal entity "${k.legalEntityKey}".`),k.parentUnitKey&&!u.has(k.parentUnitKey)&&n.push(`Unit "${k.key}" references missing parent unit "${k.parentUnitKey}".`),k.chargeReviewEnabled!==void 0&&typeof k.chargeReviewEnabled!="boolean"&&n.push(`Unit "${k.key}": chargeReviewEnabled must be true or false.`),k.sortOrder!==void 0&&(!Number.isFinite(k.sortOrder)||k.sortOrder<0)&&n.push(`Unit "${k.key}" has invalid sortOrder "${k.sortOrder}" (must be a non-negative number).`)}let O=/^[0-9a-f]{32}:[0-9a-f]{128}$/;for(let k of e.foundation.users){f.has(k.permissionGroupKey)||n.push(`User "${k.email}" references missing permission group "${k.permissionGroupKey}".`),k.unitKey&&!u.has(k.unitKey)&&n.push(`User "${k.email}" references missing unit "${k.unitKey}".`),k.status!==void 0&&k.status!=="deactivated"&&n.push(`User "${k.email}": status must be "deactivated" or absent, not "${String(k.status)}".`);let A=[k,...k.additionalMemberships??[]];for(let P of k.additionalMemberships??[])f.has(P.permissionGroupKey)||n.push(`User "${k.email}" references missing permission group "${P.permissionGroupKey}".`),P.unitKey&&!u.has(P.unitKey)&&n.push(`User "${k.email}" references missing unit "${P.unitKey}".`);St(A.map(P=>`${P.permissionGroupKey}/${P.unitKey??""}`),`membership (permission group/unit) of user "${k.email}"`,n);for(let P of A)P.validFrom!==void 0&&P.validTo!==void 0&&P.validTo<=P.validFrom&&n.push(`User "${k.email}": membership "${P.permissionGroupKey}" ends (validTo) before it starts (validFrom).`);let q=[k.firstName,k.lastName];q.some(P=>P!==void 0)&&q.some(P=>typeof P!="string"||P.trim()==="")&&n.push(`[config/userNameIncomplete] User "${k.email}" states only part of firstName/lastName (or an empty one) \u2014 set both or neither.`);for(let P of["staging","prod"]){let Y=k.passwordHashes?.[P];Y!==void 0&&!O.test(Y)&&n.push(`User "${k.email}" passwordHashes.${P} is not in Better Auth scrypt format "<32hex>:<128hex>".`)}}EG(e.tenant.branding,n),TG(e.tenant,n);let N=dI(e.fields.flatMap(k=>k.sourceColumns));for(let k of N)r.push(`Source column "${k}" is mapped by more than one field.`);IG(e,n);let L=t.sourceColumns===void 0||e.source===void 0?void 0:$G(e,t.sourceColumns,n);return{ok:n.length===0,errors:n,warnings:r,coverage:L}}s(aI,"validateTenantConfig");function gG(e,t){let n=new Map;for(let r of e.objectSchema?.properties??[]){let i=r.addressPart;if(i===void 0)continue;let o=`Object property "${e.key}.${r.key}"`;if(!ug.includes(i)){t.push(`${o}: addressPart "${i}" is none of ${ug.join(", ")}.`);continue}e.type!=="object"&&t.push(`${o}: only an object field stores an address (addressPart).`),r.type!=="string"&&t.push(`${o}: addressPart "${i}" needs a string property, not "${r.type}".`);let a=n.get(i);a!==void 0&&t.push(`${o}: addressPart "${i}" is already declared by "${e.key}.${a}".`),n.set(i,r.key)}}s(gG,"validateAddressParts");function yG(e,t){let n=e.relationshipKinds;if(n===void 0)return;if(e.type!=="relationship"){t.push(`Field "${e.key}" declares relationshipKinds, but only a relationship field carries them.`);return}let r=new Map((e.objectSchema?.properties??[]).map(i=>[i.key,i]));for(let i of n){let o=`Field "${e.key}" relationship kind "${i.key}"`;if(typeof i.key!="string"||i.key.trim()===""){t.push(`Field "${e.key}": a relationship kind needs a key.`);continue}for(let l of["de","en"])(i.label?.[l]??"").trim()===""&&t.push(`${o}: label.${l} is required \u2014 [i18n/missingTranslation] every shown text needs German and English.`);if(i.edge===null||typeof i.edge!="object"||Array.isArray(i.edge)){t.push(`${o}: edge must be an object.`);continue}i.sibling!==void 0&&i.sibling!==!0&&t.push(`${o}: sibling must be true or absent.`),i.sibling===!0&&i.mergeInto!==void 0&&t.push(`${o}: a sibling kind's edge is its identity \u2014 it cannot declare mergeInto.`);let a=n.flatMap(l=>l.mergeInto!==void 0?[l.mergeInto]:[]);if(i.sibling===!0&&a.some(l=>l in i.edge)&&t.push(`${o}: a sibling kind's edge is its identity \u2014 it cannot declare a property another kind of the field merges into.`),i.sibling===!0&&Object.keys(i.edge).length===0&&t.push(`${o}: a sibling kind's edge is its identity \u2014 an empty edge would count every edge of the field.`),i.mergeInto!==void 0){let l=r.get(i.mergeInto);l===void 0||l.type!=="0-n-select"?t.push(`${o}: mergeInto "${i.mergeInto}" must name a 0-n-select property of the field's objectSchema.`):Array.isArray(i.edge[i.mergeInto])||t.push(`${o}: mergeInto "${i.mergeInto}" must be set to a list in the edge.`)}}}s(yG,"validateRelationshipKinds");function wG(e,t,n){if(e.autoString===void 0){n.push(`Automatic field "${e.key}" must define autoString.`);return}e.allowMultiple===!0&&n.push(`Automatic field "${e.key}" must not allow multiple values.`),e.shareable===!0&&n.push(`Automatic field "${e.key}" must not be shareable.`),e.autoString.segments.length===0&&n.push(`Automatic field "${e.key}" must define at least one segment.`),e.autoString.segments.filter(i=>i.kind==="sequence").length!==1&&n.push(`Automatic field "${e.key}" must define exactly one sequence segment.`);for(let i of e.autoString.segments)if(i.kind==="literal"&&i.value.length===0&&n.push(`Automatic field "${e.key}" has an empty literal segment.`),i.kind==="sequence"&&(i.startAt!==void 0&&(!Number.isInteger(i.startAt)||i.startAt<1)&&n.push(`Automatic field "${e.key}" sequence startAt must be an integer >= 1.`),i.minDigits!==void 0&&(!Number.isInteger(i.minDigits)||i.minDigits<0)&&n.push(`Automatic field "${e.key}" sequence minDigits must be an integer >= 0.`)),i.kind==="field"){let o=t.get(i.fieldKey);if(o===void 0){n.push(`Automatic field "${e.key}" references missing field "${i.fieldKey}".`);continue}i.objectPropertyKey!==void 0&&o.objectSchema?.properties.find(l=>l.key===i.objectPropertyKey)===void 0&&n.push(`Automatic field "${e.key}" references missing object property "${i.fieldKey}.${i.objectPropertyKey}".`)}}s(wG,"validateAutomaticStringField");function cf(e,t,n,r){if(e===void 0)return;let i=t.get(e.fieldKey);if(i===void 0){n.push(`${r} references missing field "${e.fieldKey}".`);return}if(e.objectPropertyKey===void 0)return;(i.objectSchema?.properties.some(a=>a.key===e.objectPropertyKey)??!1)||n.push(`${r} references missing object property "${e.fieldKey}.${e.objectPropertyKey}".`)}s(cf,"validateSearchTarget");function bG(e,t,n){if(e.source.kind!=="relationshipTargetField")return;let r=`Template placeholder "${e.key}"`,i=t.get(e.source.relationshipFieldKey);if(i===void 0)n.push(`${r} references missing relationship field "${e.source.relationshipFieldKey}".`);else if(i.type!=="relationship")n.push(`${r} relationship field "${e.source.relationshipFieldKey}" must be a relationship field.`);else{for(let a of e.source.edgeFilters??[])fy(i,a.propertyKey,n,`${r} edge filter`);e.source.selection?.sortPropertyKey!==void 0&&fy(i,e.source.selection.sortPropertyKey,n,`${r} selection sort`)}let o=t.get(e.source.targetFieldKey);if(o===void 0){n.push(`${r} references missing target field "${e.source.targetFieldKey}".`);return}o.type==="relationship"&&n.push(`${r} target field "${e.source.targetFieldKey}" must not be a relationship field.`),e.source.targetObjectPropertyKey!==void 0&&fy(o,e.source.targetObjectPropertyKey,n,`${r} target`)}s(bG,"validateRelationshipTemplatePlaceholder");function fy(e,t,n,r){(e.objectSchema?.properties.some(o=>o.key===t)??!1)||n.push(`${r} references missing object property "${e.key}.${t}".`)}s(fy,"validateObjectPropertyReference");function kG(e,t,n){let r=`Party result icon "${e.key}"`,i=t.get(e.when.fieldKey);if(i===void 0){n.push(`${r} references missing field "${e.when.fieldKey}".`);return}if(e.when.objectPropertyKey===void 0){i.type!=="boolean"&&n.push(`${r} must target a Boolean field or object property.`);return}let o=i.objectSchema?.properties.find(a=>a.key===e.when.objectPropertyKey);if(o===void 0){n.push(`${r} references missing object property "${e.when.fieldKey}.${e.when.objectPropertyKey}".`);return}o.type!=="boolean"&&n.push(`${r} must target a Boolean field or object property.`)}s(kG,"validatePartyResultIconTarget");function lI(e){return`${e.templateId}:${e.locale}:${e.scopeKey}`}s(lI,"letterIdentity");function vG(e){return`${e.generatorKey??"*"}/${e.partyKind}/${e.roleKey}`}s(vG,"contractRoleMappingIdentity");function xG(e,t,n){let r=new Set;for(let i of e){let o=vG(i),a=`Contract role mapping "${o}"`;Vg.includes(i.partyKind)||n.push(`${a}: partyKind must be one of ${Vg.join(", ")}.`),t.has(i.roleKey)||n.push(`${a} references missing role "${i.roleKey}".`),i.generatorKey!==void 0&&i.generatorKey.trim()===""&&n.push(`${a}: generatorKey must not be blank \u2014 omit it for the tenant default.`),r.has(o)&&n.push(`${a} is declared twice.`),r.add(o)}}s(xG,"validateContractRoleMappings");function SG(e,t){for(let n of e){let r=`Notification letter "${lI(n)}"`;if(!Qu(n.locale)){t.push(`${r} declares locale "${String(n.locale)}" \u2014 letters are written in ${Je.map(i=>`"${i}"`).join(" and ")} only, so no mail would ever read this deviation.`);continue}if(n.scopeKey!==zu){t.push(`${r} declares scopeKey "${n.scopeKey}" \u2014 the only scope is "${zu}" (the whole school).`);continue}if(Object.keys(n.slots).length===0){t.push(`${r} overrides no block. A deviation that deviates in nothing is not an entry \u2014 remove it.`);continue}if(!ay(n.templateId)){t.push(`${r} references no registered letter \u2014 "${n.templateId}" is not in the letter catalog.`);continue}for(let i of FR(sy(n.templateId),n.slots,n.locale))t.push(`${r}, block "${i.slotKey}" [${i.code}]: ${i.message.de}`)}}s(SG,"validateNotificationLetters");function AG(e,t){if(e!==void 0)for(let n of LR(e))t.push(`Notification chrome: ${n.de}`)}s(AG,"validateNotificationChrome");function EG(e,t){if(e===void 0)return;let n=/^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/,r=/^(?:rgb|rgba|hsl|hsla)\(.+\)$/i,i=s(c=>n.test(c.trim())||r.test(c.trim()),"isColor");for(let[c,u]of Object.entries(e.colors??{}))u!==void 0&&(i(u)||t.push(`Branding color "colors.${c}" has invalid value "${u}" (expected hex "#rgb"/"#rrggbb"/"#rrggbbaa" or rgb()/rgba()/hsl()/hsla()).`));let o=["sharp","rounded","soft"];e.radius!==void 0&&!o.includes(e.radius)&&t.push(`Branding radius "${e.radius}" is invalid (expected "sharp", "rounded", or "soft").`);let a=["sm","md","lg","max"];e.logoSize!==void 0&&!a.includes(e.logoSize)&&t.push(`Branding logoSize "${e.logoSize}" is invalid (expected "sm", "md", "lg", or "max").`);let l=["compact","normal","spacious"];e.bannerDensity!==void 0&&!l.includes(e.bannerDensity)&&t.push(`Branding bannerDensity "${e.bannerDensity}" is invalid (expected "compact", "normal", or "spacious").`);let d=["light","dark"];e.logoGround!==void 0&&!d.includes(e.logoGround)&&t.push(`Branding logoGround "${e.logoGround}" is invalid (expected "light" or "dark").`),e.websiteUrl!==void 0&&!e.websiteUrl.startsWith("https://")&&t.push(`Branding websiteUrl must be an https:// URL (got "${e.websiteUrl}").`);for(let c of["heading","body"]){let u=e.fonts?.[c];u!==void 0&&((typeof u.family!="string"||u.family.trim().length===0)&&t.push(`Branding font "fonts.${c}" must define a non-empty family.`),Object.hasOwn(u,"url")&&t.push(`Branding font "fonts.${c}.url" is no longer supported \u2014 the font file is uploaded (plexus-cli branding set-font --slot ${c} --file <woff2>) and config carries the family only.`))}}s(EG,"validateBranding");function TG(e,t){let n=e.brandingAssets;if(n!==void 0){if(typeof n!="object"||n===null||Array.isArray(n)){t.push(`tenant.brandingAssets must be an object keyed by slot (${lf.join(", ")}).`);return}for(let[r,i]of Object.entries(n)){let o=`tenant.brandingAssets.${r}`;if(!lf.includes(r)){t.push(`${o}: unknown slot (expected ${lf.join(", ")}).`);continue}if(typeof i!="object"||i===null){t.push(`${o}: must be { sha256, sizeBytes, mimeType }.`);continue}if("size"in i){t.push(`[config/fileRefRenamed] ${o} still names size \u2014 this bundle was exported before the file-field rename, or by a plexus-cli older than this release (now sizeBytes). Update plexus-cli, export it again (plexus-cli --env <env> config export) and re-apply.`);continue}cI.test(i.sha256??"")||t.push(`${o}: sha256 must be 64 lowercase hex chars.`),(!Number.isInteger(i.sizeBytes)||i.sizeBytes<=0)&&t.push(`${o}: sizeBytes must be a positive integer.`);let a=JR[r];if(a===null){let l=QR({contentType:i.mimeType,size:i.sizeBytes});l!==null&&t.push(`${o}: ${l.de}`)}else{i.mimeType!==dy&&t.push(`${o}: mimeType must be "${dy}" (got "${i.mimeType}").`);let l=ZR(e.branding?.fonts?.[a]?.family);l!==null&&t.push(`${o}: [branding/fontFamilyMissing] tenant.branding.fonts.${a}: ${l.de}`)}"path"in i&&t.push(`${o}: "path" is a CLI snapshot field \u2014 resolve it with plexus-cli config apply.`)}}}s(TG,"validateBrandingAssets");function $G(e,t,n){let{source:r}=e;r===void 0&&_("validateSourceCoverage: called without a `source` block.");let i=new Set(t),o=new Set(e.fields.flatMap(w=>w.sourceColumns)),a=new Set(e.deferredColumns.map(w=>w.column)),l=new Set(e.ignoredColumns.map(w=>w.column)),d=new Set([...o,...a,...l]),c=r.requiredColumns.filter(w=>!i.has(w)),u=t.filter(w=>!d.has(w)),f=[...o].filter(w=>!i.has(w)),m=[...a].filter(w=>!i.has(w)),g=[...l].filter(w=>!i.has(w));for(let w of c)n.push(`Required source column "${w}" is missing from ${r.primaryTable}.`);for(let w of u)n.push(`Source column "${w}" is neither mapped nor explicitly deferred/ignored.`);for(let w of f)n.push(`Mapped source column "${w}" does not exist in the source schema.`);for(let w of m)n.push(`Deferred source column "${w}" does not exist in the source schema.`);for(let w of g)n.push(`Ignored source column "${w}" does not exist in the source schema.`);return{table:r.primaryTable,availableColumns:t.length,mappedColumns:[...o].filter(w=>i.has(w)).length,deferredColumns:[...a].filter(w=>i.has(w)).length,ignoredColumns:[...l].filter(w=>i.has(w)).length,missingRequiredColumns:c,unmappedColumns:u,unknownMappedColumns:f,unknownDeferredColumns:m,unknownIgnoredColumns:g}}s($G,"validateSourceCoverage");function St(e,t,n){for(let r of dI(e))n.push(`Duplicate ${t} key "${r}".`)}s(St,"requireUnique");function dI(e){let t=new Set,n=new Set;for(let r of e)t.has(r)&&n.add(r),t.add(r);return[...n]}s(dI,"duplicates");var cI=/^[0-9a-f]{64}$/,RG=["fileName","size"];function IG(e,t){if(!Array.isArray(e.files)){t.push('"files" is missing \u2014 declare the file library (an empty list is fine).');return}St(e.files.map(n=>n.key),"file",t);for(let n of e.files){let r=`files["${n.key}"]`;bs(n.key)||t.push(`${r}: key must match ${ly}.`);for(let o of["de","en"])(n.label?.[o]??"").trim()===""&&t.push(`${r}: label.${o} is required \u2014 [i18n/missingTranslation] every shown text needs German and English.`);let i=RG.filter(o=>o in n);if(i.length>0){t.push(`[config/fileRefRenamed] ${r} still names ${i.join(", ")} \u2014 this bundle was exported before the file-field rename, or by a plexus-cli older than this release (now filename / sizeBytes). Update plexus-cli, export it again (plexus-cli --env <env> config export) and re-apply.`);continue}if(typeof n.filename!="string")t.push(`${r}: filename is missing.`);else{let o=uo(n.filename);o!==null&&t.push(`${r}: filename ${o}.`)}af.includes(n.mimeType)||t.push(`${r}: mimeType "${n.mimeType}" is not allowed (${af.join(", ")}).`),cI.test(n.sha256??"")||t.push(`${r}: sha256 must be 64 lowercase hex chars.`),(!Number.isInteger(n.sizeBytes)||n.sizeBytes<=0)&&t.push(`${r}: sizeBytes must be a positive integer.`),"path"in n&&t.push(`${r}: "path" is a CLI snapshot field \u2014 resolve it with plexus-cli config apply.`)}}s(IG,"validateFiles");var OG=new WeakMap,PG=new WeakSet;function py(e,t){t(e);let r=e.asOptional.bind(e);return Object.defineProperty(e,"asOptional",{value:s(()=>py(r(),t),"value"),enumerable:!1}),e}s(py,"carry");function ks(e,t){return py(e,n=>OG.set(n,t))}s(ks,"tagged");var _G="tenant teardown drains every table explicitly (config/wipe.ts)",qt={belongsTo:s(e=>ks(e,{kind:"belongsTo"}),"belongsTo"),owns:s(e=>ks(e,{kind:"owns"}),"owns"),holds:s(e=>ks(e,{kind:"holds"}),"holds"),restrict:s((e,t)=>ks(e,t?{kind:"restrict",unindexed:t.unindexed}:{kind:"restrict"}),"restrict"),history:s(e=>ks(e,{kind:"history"}),"history"),tenant:s(e=>ks(e,{kind:"restrict",unindexed:_G}),"tenant"),historyOf:s(e=>py(e,t=>PG.add(t)),"historyOf")};var NG=b.object({street:b.string(),hausnr:b.string(),plz:b.string(),ort:b.string()}),uI=b.union(b.literal("school_operator"),b.literal("school_group"),b.literal("service_entity")),vr=uI.members.map(e=>e.value),CG={tenantId:qt.tenant(b.id("tenants")),name:b.optional(b.string()),type:uI,parentLegalEntityId:b.optional(qt.restrict(b.id("legal_entities"))),configKey:b.optional(b.string()),partyId:b.optional(qt.restrict(b.id("parties"))),address:b.optional(NG),signatoryUserId:b.optional(qt.restrict(b.id("users")))},Tle=Mr(CG).index("by_tenantId",["tenantId"]).index("by_parentLegalEntityId",["parentLegalEntityId"]).index("by_tenantId_and_configKey",["tenantId","configKey"]).index("by_partyId",["partyId"]).index("by_signatoryUserId",["signatoryUserId"]);var DG=b.union(b.literal("school"),b.literal("kindergarten"),b.literal("after_school_care"),b.literal("department"),b.literal("site"),b.literal("other")),In=DG.members.map(e=>e.value),Ile=b.union(b.literal("school"),b.literal("vocational"),b.literal("care"),b.literal("seminar"),b.literal("other")),Ole=b.union(b.literal("none"),b.literal("manual"),b.literal("annual_rollover")),Ple=b.union(b.literal("grade_level"),b.literal("module"),b.literal("phase"),b.literal("other")),_le=b.union(b.literal("school_year"),b.literal("cohort"),b.literal("seminar"),b.literal("care_period"),b.literal("other")),Nle=b.union(b.literal("planned"),b.literal("active"),b.literal("completed"),b.literal("archived")),Cle=b.union(b.literal("class"),b.literal("course"),b.literal("care_group"),b.literal("seminar_group"),b.literal("mixed_age_group"),b.literal("other")),Dle=b.union(b.literal("planned"),b.literal("active"),b.literal("completed"),b.literal("withdrawn"),b.literal("candidate")),Fle=b.union(b.literal("planned"),b.literal("active"),b.literal("completed"),b.literal("cancelled")),Lle=b.union(b.literal("class_teacher"),b.literal("teacher"),b.literal("mentor"),b.literal("instructor"),b.literal("assistant"),b.literal("other")),Mle=b.union(b.literal("units"),b.literal("unit_profiles"),b.literal("programs"),b.literal("program_stages"),b.literal("program_runs"),b.literal("learning_groups"),b.literal("enrollments"),b.literal("learning_group_staff_assignments")),qle=b.union(b.literal("open"),b.literal("mapped"),b.literal("ignored"));function pI(e){let t=["street","hausnr","plz","ort"].filter(n=>e[n]!==void 0);if(t.length!==0){if(t.length!==4)throw new Error(`config legal-entity add: an address needs all of --street, --hausnr, --plz and --ort (got ${t.map(n=>`--${n}`).join(", ")})`);return{street:e.street,hausnr:e.hausnr,plz:e.plz,ort:e.ort}}}s(pI,"addressFrom");function mI(e){if(!vr.includes(e))throw new Error(`config legal-entity add: --type "${e}" is none of ${vr.join(", ")}`);return e}s(mI,"legalEntityType");function hI(e){if(!In.includes(e))throw new Error(`config unit add: --kind "${e}" is none of ${In.join(", ")}`);return e}s(hI,"unitKind");function gI(e,t,n){let r=e.find(i=>i.key===t.key);if(r===void 0)return e.push(t),"create";if(Pe(r)===Pe(t))return"same";throw new Error(`${n} "${t.key}" already exists with other values \u2014 decide by hand, nothing written.
+The link is valid for {{gueltigkeit}} and works once. Afterwards you are signed out everywhere. Until then your current password keeps working \u2014 if you want nothing changed, ignore this email.`}}]},GU=b.object({}),zU={id:"account.emailChanged",category:"security",label:"Anmelde-Adresse ge\xE4ndert",occasion:{de:"Wenn jemand anderes als der Kontoinhaber die Anmelde-Adresse \xE4ndert \u2014 an die bisherige Adresse",en:"When someone other than the account holder changes the login address \u2014 to the previous address"},audience:"external",frame:"letter",timeline:"hidden",paramsValidator:GU,channels:["email"],lockedReason:{de:"Dieser Hinweis sch\xFCtzt Familien davor, dass jemand unbemerkt ihr Konto \xFCbernimmt. Sein Wortlaut ist deshalb fest.",en:"This notice protects families from someone taking over their account unnoticed, so its wording is fixed."},maxAttempts:4,portalVisible:!1},oy=[TV,_V,DV,FV,LV,KV,YV,QV,lU,cU,fU,hU,wU,kU,SU,TU,IU,PU,ZV,XV,eU,_U,NU,CU,jV,BV,UV,WV,oU,RV,OV,FU,MU,KU,BU,UU,zU];function sy(e){let t=oy.find(n=>n.id===e);return t===void 0&&_(`notifications: unknown letter "${e}"`),t}s(sy,"letterDefFor");function ay(e){return oy.some(t=>t.id===e)}s(ay,"hasLetterDef");var Ai=1024*1024,el=["application/pdf","image/jpeg","image/png","image/webp"];var af=["application/pdf","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/msword","application/vnd.oasis.opendocument.text","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","image/jpeg","image/png"],WR={docRef:{maxBytes:25*Ai,allowedMime:el},partyFile:{maxBytes:25*Ai,allowedMime:el},import:{maxBytes:500*Ai,allowedMime:null},signedContract:{maxBytes:25*Ai,allowedMime:el},artifactVersion:{maxBytes:25*Ai,allowedMime:el},chatAttachment:{maxBytes:25*Ai,allowedMime:el},tenantFile:{maxBytes:20*Ai,allowedMime:af},documentTemplate:{maxBytes:25*Ai,allowedMime:null}};var ly=/^[a-z0-9][a-z0-9-]*$/;function bs(e){return ly.test(e)}s(bs,"isFileKey");function uo(e){return e.trim()===""?"is empty":e==="."||e===".."?"is not a file name":/[/\\]/.test(e)?"must not contain a path separator":/[\u0000-\u001f]/.test(e)?"must not contain control characters":null}s(uo,"fileNameDefect");var HR=b.object({family:b.string()}),YR=b.object({family:b.string(),url:b.optional(b.string())}),yae=b.object({heading:b.optional(YR),body:b.optional(YR)}),WU=b.union(b.literal("sharp"),b.literal("rounded"),b.literal("soft")),HU=b.union(b.literal("light"),b.literal("dark")),YU=b.union(b.literal("sm"),b.literal("md"),b.literal("lg"),b.literal("max")),JU=b.union(b.literal("compact"),b.literal("normal"),b.literal("spacious")),QU=b.object({primary:b.optional(b.string()),accent:b.optional(b.string()),background:b.optional(b.string()),foreground:b.optional(b.string())}),ZU=b.object({heading:b.optional(HR),body:b.optional(HR)}),wae=b.object({colors:b.optional(QU),radius:b.optional(WU),logoSize:b.optional(YU),bannerDensity:b.optional(JU),logoGround:b.optional(HU),filledHeader:b.optional(b.boolean()),websiteUrl:b.optional(b.string()),fonts:b.optional(ZU)}),bae=b.object({primaryUrl:b.union(b.null(),b.string())}),kae=b.literal("primary"),vae=b.object({headingUrl:b.union(b.null(),b.string()),bodyUrl:b.union(b.null(),b.string())}),xae=b.union(b.literal("heading"),b.literal("body")),lf=["logo","fontHeading","fontBody"],JR={logo:null,fontHeading:"heading",fontBody:"body"};function QR(e){let{contentType:t,size:n}=e;return t==null||!t.startsWith("image/")?{de:`Das Logo muss ein Bild sein (erhalten: \u201E${t??"unbekannt"}\u201C).`,en:`The logo must be an image (received: "${t??"unknown"}").`}:t.startsWith("image/svg")?{de:"Das Logo muss eine Rastergrafik sein (PNG, JPEG oder GIF) \u2013 E-Mail-Programme zeigen SVG nicht an.",en:"The logo must be a raster image (PNG, JPEG or GIF) \u2013 email clients do not display SVG."}:n>3e6?{de:`Das Logo ist zu gro\xDF (${n} Byte, h\xF6chstens 3000000 Byte).`,en:`The logo is too large (${n} bytes, at most 3000000 bytes).`}:null}s(QR,"logoFileProblem");var dy="font/woff2";var XU=["Inter Variable","Azeret Mono Variable","Source Sans 3 Variable"];function ZR(e){return e?.trim()?XU.some(t=>t.toLowerCase()===e.trim().toLowerCase())?{de:`\u201E${e}\u201C ist die Schrift von Plexus selbst \u2013 w\xE4hlen Sie f\xFCr eine eigene Datei einen anderen Familiennamen.`,en:`"${e}" is Plexus's own typeface \u2013 choose a different family name for your own file.`}:null:{de:"Speichern Sie zuerst die Schriftfamilie \u2013 die Datei wird unter diesem Namen eingebunden.",en:"Save the font family first \u2013 the file is registered under that name."}}s(ZR,"fontFamilyProblem");var eG=["login","security","admission","tasks","schoolMessages","staffTasks","staffAppointments","staffDeadlines","familyMessages","mentions"],Oae=b.union(...eG.map(e=>b.literal(e)));var Pae=b.union(b.literal("admission"),b.literal("tasks"),b.literal("staff"),b.literal("chat")),cy=["loginOnly","all"],_ae=b.union(b.literal("loginOnly"),b.literal("all"));function XR(e){return typeof e=="string"&&cy.includes(e)}s(XR,"isMailLevel");var tG=["ad","ae","af","ag","ai","al","am","ao","aq","ar","as","at","au","aw","ax","az","ba","bb","bd","be","bf","bg","bh","bi","bj","bl","bm","bn","bo","bq","br","bs","bt","bv","bw","by","bz","ca","cc","cd","cf","cg","ch","ci","ck","cl","cm","cn","co","cr","cu","cv","cw","cx","cy","cz","de","dj","dk","dm","do","dz","ec","ee","eg","eh","er","es","et","fi","fj","fk","fm","fo","fr","ga","gb","gd","ge","gf","gg","gh","gi","gl","gm","gn","gp","gq","gr","gs","gt","gu","gw","gy","hk","hm","hn","hr","ht","hu","id","ie","il","im","in","io","iq","ir","is","it","je","jm","jo","jp","ke","kg","kh","ki","km","kn","kp","kr","kw","ky","kz","la","lb","lc","li","lk","lr","ls","lt","lu","lv","ly","ma","mc","md","me","mf","mg","mh","mk","ml","mm","mn","mo","mp","mq","mr","ms","mt","mu","mv","mw","mx","my","mz","na","nc","ne","nf","ng","ni","nl","no","np","nr","nu","nz","om","pa","pe","pf","pg","ph","pk","pl","pm","pn","pr","ps","pt","pw","py","qa","re","ro","rs","ru","rw","sa","sb","sc","sd","se","sg","sh","si","sj","sk","sl","sm","sn","so","sr","ss","st","sv","sx","sy","sz","tc","td","tf","tg","th","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","tz","ua","ug","um","us","uy","uz","va","vc","ve","vg","vi","vn","vu","wf","ws","xk","ye","yt","za","zm","zw"],nG=new Set(tG);function df(e){return nG.has(e)}s(df,"isCountryCode");var uy=["off","always","deviating"],eI={mode:"deviating",defaultCountryCode:"de"};var rG=["street","plz","ort"];function iG(e){return rG.filter(t=>!e.has(t))}s(iG,"missingInvoiceAddressParts");var oG=new Set(["0-1-select","0-n-select"]);function tI(e){return e===void 0?null:new Set(e.properties.flatMap(t=>t.addressPart!==void 0&&b$(t.addressPart)?[t.addressPart]:[]))}s(tI,"declaredAddressParts");function sG(e){return oG.has(e)}s(sG,"isSelectFieldKind");function nI(e){let t=[];for(let o of e)if(o.isNationality&&(sG(o.kind)?o.listKind!=="country"&&t.push({code:"nationality/notCountryList",fieldKey:o.key}):t.push({code:"nationality/wrongFieldKind",fieldKey:o.key})),o.isAccountEmail&&o.kind!=="email"&&t.push({code:"accountEmail/wrongFieldKind",fieldKey:o.key}),o.isContactPhone&&o.kind!=="tel"&&t.push({code:"contactPhone/wrongFieldKind",fieldKey:o.key}),o.isInvoiceAddress)if(o.addressParts===null)t.push({code:"invoiceAddress/wrongFieldKind",fieldKey:o.key});else{let a=iG(o.addressParts);a.length>0&&t.push({code:"invoiceAddress/missingPart",fieldKey:o.key,parts:a})}let n=e.filter(o=>o.isAccountEmail);if(n.length>1)for(let o of n)t.push({code:"accountEmail/multiple",fieldKey:o.key});let r=e.filter(o=>o.isContactPhone);if(r.length>1)for(let o of r)t.push({code:"contactPhone/multiple",fieldKey:o.key});let i=e.filter(o=>o.isInvoiceAddress);if(i.length>1)for(let o of i)t.push({code:"invoiceAddress/multiple",fieldKey:o.key});return t}s(nI,"fieldRoleFindings");function rI(e,t,...n){let r=e[t.code];return r(t,...n)}s(rI,"wordListElementFinding");function iI(e,t){let n=[];for(let r of t){if(e.kind==="plain"){r.countryCode!==void 0&&n.push({code:"list/countryCodeOnPlain",elementKey:r.key,countryCode:r.countryCode});continue}r.countryCode===void 0?n.push({code:"list/countryCodeMissing",elementKey:r.key}):r.countryCode!==null&&!df(r.countryCode)&&n.push({code:"list/unknownCountryCode",elementKey:r.key,countryCode:r.countryCode})}return n}s(iI,"listElementCountryFindings");var lG={key:!0,tenant:!0,foundation:!0,source:!0,displayGroups:!0,lists:!0,roles:!0,fields:!0,roleFields:!0,contractRoleMappings:!0,templatePlaceholders:!0,searchTargets:!0,searchFilters:!0,partyResultIcons:!0,notificationLetters:!0,admission:!0,files:!0,agent:!0,deferredColumns:!0,ignoredColumns:!0},dG={slug:!0,name:!0,enabledModules:!0,permissions:!0,defaultApplicantGroupKey:!0,defaultEnrolleeRoleKey:!0,priceCriteriaFacts:!0,defaultInteressentRoleKey:!0,admissionFieldDisplayGroupKey:!0,defaultStartInProxy:!0,terms:!0,mailLevel:!0,notificationChrome:!0,hideMailLevelNotice:!0,magicLinkLogin:!0,externalSignIn:!0,nationalityFlag:!0,adminSeesSignatureImages:!0,bankImportScope:!0,branding:!0,brandingAssets:!0,partyRetention:!0},cG=new Set(["enabledMailCategories","mailEnabled"]);function uG(e){let t=s((n,r,i)=>n.filter(o=>!Object.hasOwn(r,o)&&!(i==="tenant."&&cG.has(o))).map(o=>`[config/unknownKey] ${i}${o} is not a config field of this release \u2014 a typo, or a field a newer release introduced.`),"unknown");return[...t(Object.keys(e),lG,""),...t(Object.keys(e.tenant),dG,"tenant.")]}s(uG,"unknownKeyFindings");var oI=["plain","country"],fG={"list/countryCodeMissing":s(({elementKey:e},t)=>`Element "${t}.${e}" of a country list must state countryCode (null for no state).`,"list/countryCodeMissing"),"list/countryCodeOnPlain":s(({elementKey:e},t)=>`Element "${t}.${e}" carries countryCode, but list "${t}" is not kind "country".`,"list/countryCodeOnPlain"),"list/unknownCountryCode":s(({elementKey:e,countryCode:t},n)=>`Element "${n}.${e}" has unknown countryCode ${JSON.stringify(t)}.`,"list/unknownCountryCode")},pG={"nationality/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isNationality but not a 0-1-select / 0-n-select.`,"nationality/wrongFieldKind"),"nationality/notCountryList":s(({fieldKey:e})=>`Field "${e}" is isNationality but its list is not kind "country".`,"nationality/notCountryList"),"accountEmail/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isAccountEmail but not an email field.`,"accountEmail/wrongFieldKind"),"accountEmail/multiple":s(({fieldKey:e})=>`Field "${e}" is one of several isAccountEmail fields \u2014 at most one per tenant.`,"accountEmail/multiple"),"contactPhone/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isContactPhone but not a tel field.`,"contactPhone/wrongFieldKind"),"contactPhone/multiple":s(({fieldKey:e})=>`Field "${e}" is one of several isContactPhone fields \u2014 at most one per tenant.`,"contactPhone/multiple"),"invoiceAddress/wrongFieldKind":s(({fieldKey:e})=>`Field "${e}" is isInvoiceAddress but not an object field.`,"invoiceAddress/wrongFieldKind"),"invoiceAddress/missingPart":s(({fieldKey:e,parts:t})=>`Field "${e}" is isInvoiceAddress but declares no property for the address part(s) ${t.join(", ")} (objectSchema.properties[].addressPart) \u2014 an invoice cannot print its address without them.`,"invoiceAddress/missingPart"),"invoiceAddress/multiple":s(({fieldKey:e})=>`Field "${e}" is one of several isInvoiceAddress fields \u2014 at most one per tenant.`,"invoiceAddress/multiple")};function mG(e){let t=pG[e.code];return t(e)}s(mG,"roleText");function hG(e){let t=[],n=e.tenant.nationalityFlag,r=typeof n=="object"&&n!==null?n:{},i=r.mode;if(uy.includes(i)||t.push(`[nationality/flagMode] tenant.nationalityFlag.mode must be one of ${uy.join(", ")} (got ${n===void 0?"no tenant.nationalityFlag":JSON.stringify(i??null)}).`),n!==void 0){let l=r.defaultCountryCode;(typeof l!="string"||!df(l))&&t.push(`[nationality/defaultCountryCode] tenant.nationalityFlag.defaultCountryCode must be a lowercase ISO 3166-1 alpha-2 code (got ${JSON.stringify(l??null)}).`)}let o=new Map;for(let l of e.lists){let d=l.kind;if(!oI.includes(d)){t.push(`[list/kind] List "${l.key}" has kind ${JSON.stringify(d??null)} \u2014 one of ${oI.join(", ")}.`);continue}o.set(l.key,l.kind);for(let c of iI({key:l.key,kind:l.kind},l.elements))t.push(`[${c.code}] ${rI(fG,c,l.key)}`)}let a=nI(e.fields.map(l=>({key:l.key,kind:l.type,listKind:l.listKey===void 0?null:o.get(l.listKey)??null,isNationality:l.isNationality===!0,isAccountEmail:l.isAccountEmail===!0,isContactPhone:l.isContactPhone===!0,isInvoiceAddress:l.isInvoiceAddress===!0,addressParts:l.type==="object"?tI(l.objectSchema??{properties:[]}):null})));for(let l of a)t.push(`[${l.code}] ${mG(l)}`);return t}s(hG,"nationalityFindings");function sI(e){return di(e)?.message.de??(e instanceof Error?e.message:String(e))}s(sI,"errorText");function aI(e,t={}){let n=[...uG(e)],r=[];try{xR(e.fields.map(k=>k.key),[])}catch(k){n.push(sI(k))}e.tenant.terms!==void 0&&n.push(...NR(e.tenant.terms)),XR(e.tenant.mailLevel)?e.tenant.mailLevel==="all"&&!Gu(e.tenant.enabledModules,"notifications")&&n.push('[notification/levelWithoutModule] tenant.mailLevel is "all" but the notifications module is not enabled \u2014 only sign-in and security mail would go out. Enable the module or set "loginOnly".'):n.push(`[notification/mailLevel] tenant.mailLevel must be one of ${cy.join(", ")} (got ${e.tenant.mailLevel===void 0?"nothing":JSON.stringify(e.tenant.mailLevel)}).`),"enabledMailCategories"in e.tenant&&n.push('[notification/mailCategoriesRetired] tenant.enabledMailCategories was replaced by tenant.mailLevel \u2014 "all" for every mail, "loginOnly" for sign-in mail only to families (staff mail follows personal settings).'),"mailEnabled"in e.tenant&&n.push('[notification/mailEnabledRetired] tenant.mailEnabled was replaced by tenant.mailLevel \u2014 "all" for every mail, "loginOnly" for sign-in mail only to families (staff mail follows personal settings).'),St(e.displayGroups.map(k=>k.key),"display group",n),St(e.lists.map(k=>k.key),"list",n),St(e.roles.map(k=>k.key),"role",n),St(e.fields.map(k=>k.key),"field",n),St(e.foundation.legalEntities.map(k=>k.key),"legal entity",n),St(e.foundation.units.map(k=>k.key),"unit",n),St(e.foundation.permissionGroups.map(k=>k.key),"permission group",n),"teams"in e.foundation&&n.push("foundation.teams is retired: a team is a permission group \u2014 move each team to foundation.permissionGroups (same key) and remove the block.");for(let k of e.foundation.users)"teamKeys"in k&&n.push(`User "${k.email}" carries teamKeys, retired: team membership is the user's permission-group membership.`);St(e.foundation.users.map(k=>k.key),"user",n),St((e.searchFilters??[]).map(k=>k.key),"search filter",n),St((e.searchTargets??[]).map(k=>k.objectPropertyKey===void 0?k.fieldKey:`${k.fieldKey}.${k.objectPropertyKey}`),"search target",n),St((e.partyResultIcons??[]).map(k=>k.key),"party result icon",n),St((e.templatePlaceholders??[]).map(k=>k.key),"template placeholder",n),St((e.notificationLetters??[]).map(lI),"notification letter",n),SG(e.notificationLetters??[],n),AG(e.tenant.notificationChrome,n),e.tenant.bankImportScope!==void 0&&!["sepa_only","full_statement"].includes(e.tenant.bankImportScope)&&n.push("tenant.bankImportScope must be sepa_only or full_statement."),e.tenant.hideMailLevelNotice!==void 0&&typeof e.tenant.hideMailLevelNotice!="boolean"&&n.push("tenant.hideMailLevelNotice must be true or false (the dashboard's mail-level notice)."),typeof e.tenant.magicLinkLogin!="boolean"&&n.push("tenant.magicLinkLogin must be true or false (the login page's sign-in link option)."),typeof e.tenant.adminSeesSignatureImages!="boolean"&&n.push("tenant.adminSeesSignatureImages must be true or false (whether a school administrator sees other accounts' signature images)."),bR(e.tenant.externalSignIn)||n.push(`[auth/externalSignIn] tenant.externalSignIn must be { mode: "permanentLink" }, { mode: "oneTimeLink" } or { mode: "periodLink", validDays: 1\u2013${Bg} } (how families sign in).`);let i=new Set(e.displayGroups.map(k=>k.key)),o=new Set(e.lists.map(k=>k.key)),a=new Set(e.roles.map(k=>k.key)),l=new Set(e.fields.map(k=>k.key)),d=new Map(e.fields.map(k=>[k.key,k])),c=new Set(e.foundation.legalEntities.map(k=>k.key)),u=new Set(e.foundation.units.map(k=>k.key)),f=new Set(e.foundation.permissionGroups.map(k=>k.key));Gu(e.tenant.enabledModules,"bewerbungsmanagement")&&e.tenant.defaultApplicantGroupKey!==void 0&&(e.foundation.permissionGroups.find(A=>A.key===e.tenant.defaultApplicantGroupKey)?.permissions.includes("bewerbungsmanagement.applications.submitOwn")||n.push(`Default applicant group "${e.tenant.defaultApplicantGroupKey}" must grant submitOwn.`));let m=e.tenant.admissionFieldDisplayGroupKey;m!==void 0&&!i.has(m)&&n.push(`tenant.admissionFieldDisplayGroupKey "${m}" names no display group of this config.`),m===void 0&&(Gu(e.tenant.enabledModules,"bewerbungsmanagement")||(e.admission?.fields.length??0)>0)&&n.push("tenant.admissionFieldDisplayGroupKey is required when admissions is enabled or admission.fields declares fields: it names the display group the fields an offer creates land in."),n.push(...hG(e)),St(e.fields.flatMap(k=>(k.relationshipKinds??[]).map(A=>A.key)),"relationship kind",n);for(let k of e.fields){i.has(k.displayGroupKey)||n.push(`Field "${k.key}" references missing display group "${k.displayGroupKey}".`),yG(k,n),k.formWritable===!0&&!Wg[k.type].fieldMapTarget&&n.push(`Field "${k.key}" is formWritable, but a form cannot write a "${k.type}" field.`),k.type==="auto-string"?wG(k,d,n):k.autoString!==void 0&&n.push(`Non-automatic field "${k.key}" must not define autoString.`),(!Number.isFinite(k.sortOrder)||k.sortOrder<0)&&n.push(`Field "${k.key}" has invalid sortOrder "${k.sortOrder}" (must be a non-negative number).`),(k.type==="0-1-select"||k.type==="0-n-select")&&!k.listKey&&n.push(`Select field "${k.key}" must define listKey.`),k.type!=="0-1-select"&&k.type!=="0-n-select"&&k.listKey!==void 0&&n.push(`Non-select field "${k.key}" must not define listKey.`),k.listKey&&!o.has(k.listKey)&&n.push(`Field "${k.key}" references missing list "${k.listKey}".`),(k.type==="object"||k.type==="relationship")&&!k.objectSchema&&n.push(`Field "${k.key}" must define objectSchema.`),k.type!=="object"&&k.type!=="relationship"&&k.objectSchema&&n.push(`Non-object field "${k.key}" must not define objectSchema.`);for(let A of k.objectSchema?.properties??[])(A.type==="0-1-select"||A.type==="0-n-select")&&!A.listKey&&n.push(`Object select property "${k.key}.${A.key}" must define listKey.`),A.listKey&&!o.has(A.listKey)&&n.push(`Object property "${k.key}.${A.key}" references missing list "${A.listKey}".`);gG(k,n)}let g=e.tenant.priceCriteriaFacts;if(g){let k=e.fields.find(A=>A.key===g.birthDateFieldKey);(!k||k.type!=="date")&&n.push("Price criteria require a configured date field for birth dates."),a.has(g.studentRoleKey)||n.push("Price criteria require a configured Student eligibility role.");for(let A of Object.keys(g))A!=="birthDateFieldKey"&&A!=="studentRoleKey"&&n.push(`Unknown price criteria fact setting "${A}".`)}let w=e.tenant.defaultEnrolleeRoleKey;w&&!a.has(w)&&n.push(`Default enrollment role "${w}" does not exist.`),w&&e.roles.some(k=>k.parentRoleKey===w)&&n.push(`Default enrollment role "${w}" must be a leaf role.`);for(let k of e.roles){(typeof k.icon!="string"||k.icon.trim().length===0)&&n.push(`Role "${k.key}" must define an icon.`),k.parentRoleKey&&!a.has(k.parentRoleKey)&&n.push(`Role "${k.key}" references missing parent role "${k.parentRoleKey}".`);for(let A of k.listDisplayFieldKeys??[])l.has(A)||n.push(`Role "${k.key}" list display references missing field "${A}".`)}let y=new Map(e.roles.map(k=>[k.key,k.parentRoleKey])),v=new Map;for(let k of e.roleFields){let A=v.get(k.roleKey)??[];A.push({roleId:k.roleKey,customFieldId:k.fieldKey}),v.set(k.roleKey,A)}for(let k of e.roles)try{kR(k.key,y,v)}catch(A){n.push(sI(A))}for(let k of e.roleFields){a.has(k.roleKey)||n.push(`Role field references missing role "${k.roleKey}" for field "${k.fieldKey}".`),l.has(k.fieldKey)||n.push(`Role field references missing field "${k.fieldKey}" for role "${k.roleKey}".`);for(let A of k.targetRequirementFieldKeys??[])l.has(A)||n.push(`Role field "${k.roleKey}.${k.fieldKey}" references missing target requirement field "${A}".`)}xG(e.contractRoleMappings??[],a,n);for(let k of e.templatePlaceholders??[])lR.test(k.key)||n.push(`Template placeholder "${k.key}" must use lower_snake_case segments, optionally separated by dots.`),k.source.kind==="customField"?cf(k.source,d,n,`Template placeholder "${k.key}"`):k.source.kind==="relationshipTargetField"&&bG(k,d,n);for(let k of e.searchTargets??[])cf(k,d,n,"Search target");for(let k of e.fields)OR(k.key)&&(k.defaultValue!==void 0||k.validations!==void 0)&&n.push(`System field "${k.key}" takes no defaultValue or validations.`);for(let k of e.lists)St(k.elements.map((A,q)=>String(A.sortOrder??(q+1)*10)),`sortOrder of an element of list "${k.key}"`,n);for(let k of e.searchFilters??[])St((k.options??[]).map((A,q)=>String(A.sortOrder??(q+1)*10)),`sortOrder of an option of search filter "${k.key}"`,n);for(let k of e.foundation.permissionGroups){k.grantAllCustomFields===!0&&k.customFieldPermissions!==void 0&&n.push(`Permission group "${k.key}" states both grantAllCustomFields and customFieldPermissions \u2014 one of them.`),St((k.customFieldPermissions??[]).map(A=>A.displayGroupKey),`display group of a field permission of group "${k.key}"`,n);for(let A of k.customFieldPermissions??[]){i.has(A.displayGroupKey)||n.push(`Permission group "${k.key}" grants field permissions on missing display group "${A.displayGroupKey}".`);for(let q of A.permissions)$R.includes(q)||n.push(`Permission group "${k.key}" grants unknown field permission "${q}".`)}}let T=e.tenant.partyRetention;T!==void 0&&(IR(T.days)||n.push(`tenant.partyRetention.days must be a whole number of days from 1 to ${36500} (got ${JSON.stringify(T.days)}).`),Number.isFinite(T.enabledAt)||n.push("tenant.partyRetention.enabledAt must be a timestamp (epoch ms)."),T.formerRoleKey!==void 0&&!a.has(T.formerRoleKey)&&n.push(`tenant.partyRetention references missing role "${T.formerRoleKey}".`));for(let k of e.searchFilters??[]){(k.kind==="chips"||k.kind==="select")&&(k.options?.length??0)===0&&n.push(`Search filter "${k.key}" must define options.`),(k.kind==="text"||k.kind==="numberRange")&&k.target===void 0&&n.push(`Search filter "${k.key}" must define a target field.`),k.options!==void 0&&St(k.options.map(A=>A.key),`search filter option for "${k.key}"`,n),cf(k.target,d,n,`Search filter "${k.key}"`);for(let A of k.options??[]){A.predicates.length===0&&n.push(`Search filter option "${k.key}.${A.key}" must define at least one predicate.`);for(let q of A.predicates){if(q.kind==="role"){a.has(q.roleKey)||n.push(`Search filter option "${k.key}.${A.key}" references missing role "${q.roleKey}".`);continue}cf(q,d,n,`Search filter option "${k.key}.${A.key}"`)}}}for(let k of e.partyResultIcons??[])kG(k,d,n);for(let k of e.foundation.legalEntities)if(k.signatoryUserKey!==void 0&&k.type==="school_group"&&n.push(`[config/signatoryOnGroup] Legal entity "${k.key}" is a school_group \u2014 only a Tr\xE4ger (school_operator, service_entity) declares an Unterschriftsperson.`),k.parentLegalEntityKey&&!c.has(k.parentLegalEntityKey)&&n.push(`Legal entity "${k.key}" references missing parent "${k.parentLegalEntityKey}".`),k.address!==void 0){let A=k.address,q=["street","hausnr","plz","ort"];k.type==="school_group"?n.push(`Legal entity "${k.key}" is a school_group \u2014 only a Tr\xE4ger (school_operator, service_entity) has an address.`):(typeof A!="object"||A===null||Array.isArray(A)||Object.keys(A).some(P=>!q.includes(P))||q.some(P=>typeof A[P]!="string"||(A[P]??"").trim()===""))&&n.push(`Legal entity "${k.key}" has an invalid address \u2014 expected { street, hausnr, plz, ort }, each non-empty.`)}let $=new Map;for(let k of e.foundation.units){if(k.slug!==void 0){let A=typeof k.slug=="string"?ER(k.slug):"must be a string";A!==void 0&&n.push(`Unit "${k.key}" has invalid slug "${k.slug}" (${A}).`);let q=$.get(k.slug);q!==void 0&&n.push(`Units "${q}" and "${k.key}" both declare slug "${k.slug}" (unit slugs are unique per tenant).`),$.set(k.slug,k.key)}c.has(k.legalEntityKey)||n.push(`Unit "${k.key}" references missing legal entity "${k.legalEntityKey}".`),k.parentUnitKey&&!u.has(k.parentUnitKey)&&n.push(`Unit "${k.key}" references missing parent unit "${k.parentUnitKey}".`),k.chargeReviewEnabled!==void 0&&typeof k.chargeReviewEnabled!="boolean"&&n.push(`Unit "${k.key}": chargeReviewEnabled must be true or false.`),k.sortOrder!==void 0&&(!Number.isFinite(k.sortOrder)||k.sortOrder<0)&&n.push(`Unit "${k.key}" has invalid sortOrder "${k.sortOrder}" (must be a non-negative number).`)}let O=/^[0-9a-f]{32}:[0-9a-f]{128}$/;for(let k of e.foundation.users){f.has(k.permissionGroupKey)||n.push(`User "${k.email}" references missing permission group "${k.permissionGroupKey}".`),k.unitKey&&!u.has(k.unitKey)&&n.push(`User "${k.email}" references missing unit "${k.unitKey}".`),k.status!==void 0&&k.status!=="deactivated"&&n.push(`User "${k.email}": status must be "deactivated" or absent, not "${String(k.status)}".`);let A=[k,...k.additionalMemberships??[]];for(let P of k.additionalMemberships??[])f.has(P.permissionGroupKey)||n.push(`User "${k.email}" references missing permission group "${P.permissionGroupKey}".`),P.unitKey&&!u.has(P.unitKey)&&n.push(`User "${k.email}" references missing unit "${P.unitKey}".`);St(A.map(P=>`${P.permissionGroupKey}/${P.unitKey??""}`),`membership (permission group/unit) of user "${k.email}"`,n);for(let P of A)P.validFrom!==void 0&&P.validTo!==void 0&&P.validTo<=P.validFrom&&n.push(`User "${k.email}": membership "${P.permissionGroupKey}" ends (validTo) before it starts (validFrom).`);let q=[k.firstName,k.lastName];q.some(P=>P!==void 0)&&q.some(P=>typeof P!="string"||P.trim()==="")&&n.push(`[config/userNameIncomplete] User "${k.email}" states only part of firstName/lastName (or an empty one) \u2014 set both or neither.`);for(let P of["staging","prod"]){let Y=k.passwordHashes?.[P];Y!==void 0&&!O.test(Y)&&n.push(`User "${k.email}" passwordHashes.${P} is not in Better Auth scrypt format "<32hex>:<128hex>".`)}}EG(e.tenant.branding,n),TG(e.tenant,n);let N=dI(e.fields.flatMap(k=>k.sourceColumns));for(let k of N)r.push(`Source column "${k}" is mapped by more than one field.`);IG(e,n);let L=t.sourceColumns===void 0||e.source===void 0?void 0:$G(e,t.sourceColumns,n);return{ok:n.length===0,errors:n,warnings:r,coverage:L}}s(aI,"validateTenantConfig");function gG(e,t){let n=new Map;for(let r of e.objectSchema?.properties??[]){let i=r.addressPart;if(i===void 0)continue;let o=`Object property "${e.key}.${r.key}"`;if(!ug.includes(i)){t.push(`${o}: addressPart "${i}" is none of ${ug.join(", ")}.`);continue}e.type!=="object"&&t.push(`${o}: only an object field stores an address (addressPart).`),r.type!=="string"&&t.push(`${o}: addressPart "${i}" needs a string property, not "${r.type}".`);let a=n.get(i);a!==void 0&&t.push(`${o}: addressPart "${i}" is already declared by "${e.key}.${a}".`),n.set(i,r.key)}}s(gG,"validateAddressParts");function yG(e,t){let n=e.relationshipKinds;if(n===void 0)return;if(e.type!=="relationship"){t.push(`Field "${e.key}" declares relationshipKinds, but only a relationship field carries them.`);return}let r=new Map((e.objectSchema?.properties??[]).map(i=>[i.key,i]));for(let i of n){let o=`Field "${e.key}" relationship kind "${i.key}"`;if(typeof i.key!="string"||i.key.trim()===""){t.push(`Field "${e.key}": a relationship kind needs a key.`);continue}for(let l of["de","en"])(i.label?.[l]??"").trim()===""&&t.push(`${o}: label.${l} is required \u2014 [i18n/missingTranslation] every shown text needs German and English.`);if(i.edge===null||typeof i.edge!="object"||Array.isArray(i.edge)){t.push(`${o}: edge must be an object.`);continue}i.sibling!==void 0&&i.sibling!==!0&&t.push(`${o}: sibling must be true or absent.`),i.sibling===!0&&i.mergeInto!==void 0&&t.push(`${o}: a sibling kind's edge is its identity \u2014 it cannot declare mergeInto.`);let a=n.flatMap(l=>l.mergeInto!==void 0?[l.mergeInto]:[]);if(i.sibling===!0&&a.some(l=>l in i.edge)&&t.push(`${o}: a sibling kind's edge is its identity \u2014 it cannot declare a property another kind of the field merges into.`),i.sibling===!0&&Object.keys(i.edge).length===0&&t.push(`${o}: a sibling kind's edge is its identity \u2014 an empty edge would count every edge of the field.`),i.mergeInto!==void 0){let l=r.get(i.mergeInto);l===void 0||l.type!=="0-n-select"?t.push(`${o}: mergeInto "${i.mergeInto}" must name a 0-n-select property of the field's objectSchema.`):Array.isArray(i.edge[i.mergeInto])||t.push(`${o}: mergeInto "${i.mergeInto}" must be set to a list in the edge.`)}}}s(yG,"validateRelationshipKinds");function wG(e,t,n){if(e.autoString===void 0){n.push(`Automatic field "${e.key}" must define autoString.`);return}e.allowMultiple===!0&&n.push(`Automatic field "${e.key}" must not allow multiple values.`),e.shareable===!0&&n.push(`Automatic field "${e.key}" must not be shareable.`),e.autoString.segments.length===0&&n.push(`Automatic field "${e.key}" must define at least one segment.`),e.autoString.segments.filter(i=>i.kind==="sequence").length!==1&&n.push(`Automatic field "${e.key}" must define exactly one sequence segment.`);for(let i of e.autoString.segments)if(i.kind==="literal"&&i.value.length===0&&n.push(`Automatic field "${e.key}" has an empty literal segment.`),i.kind==="sequence"&&(i.startAt!==void 0&&(!Number.isInteger(i.startAt)||i.startAt<1)&&n.push(`Automatic field "${e.key}" sequence startAt must be an integer >= 1.`),i.minDigits!==void 0&&(!Number.isInteger(i.minDigits)||i.minDigits<0)&&n.push(`Automatic field "${e.key}" sequence minDigits must be an integer >= 0.`)),i.kind==="field"){let o=t.get(i.fieldKey);if(o===void 0){n.push(`Automatic field "${e.key}" references missing field "${i.fieldKey}".`);continue}i.objectPropertyKey!==void 0&&o.objectSchema?.properties.find(l=>l.key===i.objectPropertyKey)===void 0&&n.push(`Automatic field "${e.key}" references missing object property "${i.fieldKey}.${i.objectPropertyKey}".`)}}s(wG,"validateAutomaticStringField");function cf(e,t,n,r){if(e===void 0)return;let i=t.get(e.fieldKey);if(i===void 0){n.push(`${r} references missing field "${e.fieldKey}".`);return}if(e.objectPropertyKey===void 0)return;(i.objectSchema?.properties.some(a=>a.key===e.objectPropertyKey)??!1)||n.push(`${r} references missing object property "${e.fieldKey}.${e.objectPropertyKey}".`)}s(cf,"validateSearchTarget");function bG(e,t,n){if(e.source.kind!=="relationshipTargetField")return;let r=`Template placeholder "${e.key}"`,i=t.get(e.source.relationshipFieldKey);if(i===void 0)n.push(`${r} references missing relationship field "${e.source.relationshipFieldKey}".`);else if(i.type!=="relationship")n.push(`${r} relationship field "${e.source.relationshipFieldKey}" must be a relationship field.`);else{for(let a of e.source.edgeFilters??[])fy(i,a.propertyKey,n,`${r} edge filter`);e.source.selection?.sortPropertyKey!==void 0&&fy(i,e.source.selection.sortPropertyKey,n,`${r} selection sort`)}let o=t.get(e.source.targetFieldKey);if(o===void 0){n.push(`${r} references missing target field "${e.source.targetFieldKey}".`);return}o.type==="relationship"&&n.push(`${r} target field "${e.source.targetFieldKey}" must not be a relationship field.`),e.source.targetObjectPropertyKey!==void 0&&fy(o,e.source.targetObjectPropertyKey,n,`${r} target`)}s(bG,"validateRelationshipTemplatePlaceholder");function fy(e,t,n,r){(e.objectSchema?.properties.some(o=>o.key===t)??!1)||n.push(`${r} references missing object property "${e.key}.${t}".`)}s(fy,"validateObjectPropertyReference");function kG(e,t,n){let r=`Party result icon "${e.key}"`,i=t.get(e.when.fieldKey);if(i===void 0){n.push(`${r} references missing field "${e.when.fieldKey}".`);return}if(e.when.objectPropertyKey===void 0){i.type!=="boolean"&&n.push(`${r} must target a Boolean field or object property.`);return}let o=i.objectSchema?.properties.find(a=>a.key===e.when.objectPropertyKey);if(o===void 0){n.push(`${r} references missing object property "${e.when.fieldKey}.${e.when.objectPropertyKey}".`);return}o.type!=="boolean"&&n.push(`${r} must target a Boolean field or object property.`)}s(kG,"validatePartyResultIconTarget");function lI(e){return`${e.templateId}:${e.locale}:${e.scopeKey}`}s(lI,"letterIdentity");function vG(e){return`${e.generatorKey??"*"}/${e.partyKind}/${e.roleKey}`}s(vG,"contractRoleMappingIdentity");function xG(e,t,n){let r=new Set;for(let i of e){let o=vG(i),a=`Contract role mapping "${o}"`;Vg.includes(i.partyKind)||n.push(`${a}: partyKind must be one of ${Vg.join(", ")}.`),t.has(i.roleKey)||n.push(`${a} references missing role "${i.roleKey}".`),i.generatorKey!==void 0&&i.generatorKey.trim()===""&&n.push(`${a}: generatorKey must not be blank \u2014 omit it for the tenant default.`),r.has(o)&&n.push(`${a} is declared twice.`),r.add(o)}}s(xG,"validateContractRoleMappings");function SG(e,t){for(let n of e){let r=`Notification letter "${lI(n)}"`;if(!Qu(n.locale)){t.push(`${r} declares locale "${String(n.locale)}" \u2014 letters are written in ${Je.map(i=>`"${i}"`).join(" and ")} only, so no mail would ever read this deviation.`);continue}if(n.scopeKey!==zu){t.push(`${r} declares scopeKey "${n.scopeKey}" \u2014 the only scope is "${zu}" (the whole school).`);continue}if(Object.keys(n.slots).length===0){t.push(`${r} overrides no block. A deviation that deviates in nothing is not an entry \u2014 remove it.`);continue}if(!ay(n.templateId)){t.push(`${r} references no registered letter \u2014 "${n.templateId}" is not in the letter catalog.`);continue}for(let i of FR(sy(n.templateId),n.slots,n.locale))t.push(`${r}, block "${i.slotKey}" [${i.code}]: ${i.message.de}`)}}s(SG,"validateNotificationLetters");function AG(e,t){if(e!==void 0)for(let n of LR(e))t.push(`Notification chrome: ${n.de}`)}s(AG,"validateNotificationChrome");function EG(e,t){if(e===void 0)return;let n=/^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/,r=/^(?:rgb|rgba|hsl|hsla)\(.+\)$/i,i=s(c=>n.test(c.trim())||r.test(c.trim()),"isColor");for(let[c,u]of Object.entries(e.colors??{}))u!==void 0&&(i(u)||t.push(`Branding color "colors.${c}" has invalid value "${u}" (expected hex "#rgb"/"#rrggbb"/"#rrggbbaa" or rgb()/rgba()/hsl()/hsla()).`));let o=["sharp","rounded","soft"];e.radius!==void 0&&!o.includes(e.radius)&&t.push(`Branding radius "${e.radius}" is invalid (expected "sharp", "rounded", or "soft").`);let a=["sm","md","lg","max"];e.logoSize!==void 0&&!a.includes(e.logoSize)&&t.push(`Branding logoSize "${e.logoSize}" is invalid (expected "sm", "md", "lg", or "max").`);let l=["compact","normal","spacious"];e.bannerDensity!==void 0&&!l.includes(e.bannerDensity)&&t.push(`Branding bannerDensity "${e.bannerDensity}" is invalid (expected "compact", "normal", or "spacious").`);let d=["light","dark"];e.logoGround!==void 0&&!d.includes(e.logoGround)&&t.push(`Branding logoGround "${e.logoGround}" is invalid (expected "light" or "dark").`),e.websiteUrl!==void 0&&!e.websiteUrl.startsWith("https://")&&t.push(`Branding websiteUrl must be an https:// URL (got "${e.websiteUrl}").`);for(let c of["heading","body"]){let u=e.fonts?.[c];u!==void 0&&((typeof u.family!="string"||u.family.trim().length===0)&&t.push(`Branding font "fonts.${c}" must define a non-empty family.`),Object.hasOwn(u,"url")&&t.push(`Branding font "fonts.${c}.url" is no longer supported \u2014 the font file is uploaded (plexus-cli branding set-font --slot ${c} --file <woff2>) and config carries the family only.`))}}s(EG,"validateBranding");function TG(e,t){let n=e.brandingAssets;if(n!==void 0){if(typeof n!="object"||n===null||Array.isArray(n)){t.push(`tenant.brandingAssets must be an object keyed by slot (${lf.join(", ")}).`);return}for(let[r,i]of Object.entries(n)){let o=`tenant.brandingAssets.${r}`;if(!lf.includes(r)){t.push(`${o}: unknown slot (expected ${lf.join(", ")}).`);continue}if(typeof i!="object"||i===null){t.push(`${o}: must be { sha256, sizeBytes, mimeType }.`);continue}if("size"in i){t.push(`[config/fileRefRenamed] ${o} still names size \u2014 this bundle was exported before the file-field rename, or by a plexus-cli older than this release (now sizeBytes). Update plexus-cli, export it again (plexus-cli --env <env> config export) and re-apply.`);continue}cI.test(i.sha256??"")||t.push(`${o}: sha256 must be 64 lowercase hex chars.`),(!Number.isInteger(i.sizeBytes)||i.sizeBytes<=0)&&t.push(`${o}: sizeBytes must be a positive integer.`);let a=JR[r];if(a===null){let l=QR({contentType:i.mimeType,size:i.sizeBytes});l!==null&&t.push(`${o}: ${l.de}`)}else{i.mimeType!==dy&&t.push(`${o}: mimeType must be "${dy}" (got "${i.mimeType}").`);let l=ZR(e.branding?.fonts?.[a]?.family);l!==null&&t.push(`${o}: [branding/fontFamilyMissing] tenant.branding.fonts.${a}: ${l.de}`)}"path"in i&&t.push(`${o}: "path" is a CLI snapshot field \u2014 resolve it with plexus-cli config apply.`)}}}s(TG,"validateBrandingAssets");function $G(e,t,n){let{source:r}=e;r===void 0&&_("validateSourceCoverage: called without a `source` block.");let i=new Set(t),o=new Set(e.fields.flatMap(w=>w.sourceColumns)),a=new Set(e.deferredColumns.map(w=>w.column)),l=new Set(e.ignoredColumns.map(w=>w.column)),d=new Set([...o,...a,...l]),c=r.requiredColumns.filter(w=>!i.has(w)),u=t.filter(w=>!d.has(w)),f=[...o].filter(w=>!i.has(w)),m=[...a].filter(w=>!i.has(w)),g=[...l].filter(w=>!i.has(w));for(let w of c)n.push(`Required source column "${w}" is missing from ${r.primaryTable}.`);for(let w of u)n.push(`Source column "${w}" is neither mapped nor explicitly deferred/ignored.`);for(let w of f)n.push(`Mapped source column "${w}" does not exist in the source schema.`);for(let w of m)n.push(`Deferred source column "${w}" does not exist in the source schema.`);for(let w of g)n.push(`Ignored source column "${w}" does not exist in the source schema.`);return{table:r.primaryTable,availableColumns:t.length,mappedColumns:[...o].filter(w=>i.has(w)).length,deferredColumns:[...a].filter(w=>i.has(w)).length,ignoredColumns:[...l].filter(w=>i.has(w)).length,missingRequiredColumns:c,unmappedColumns:u,unknownMappedColumns:f,unknownDeferredColumns:m,unknownIgnoredColumns:g}}s($G,"validateSourceCoverage");function St(e,t,n){for(let r of dI(e))n.push(`Duplicate ${t} key "${r}".`)}s(St,"requireUnique");function dI(e){let t=new Set,n=new Set;for(let r of e)t.has(r)&&n.add(r),t.add(r);return[...n]}s(dI,"duplicates");var cI=/^[0-9a-f]{64}$/,RG=["fileName","size"];function IG(e,t){if(!Array.isArray(e.files)){t.push('"files" is missing \u2014 declare the file library (an empty list is fine).');return}St(e.files.map(n=>n.key),"file",t);for(let n of e.files){let r=`files["${n.key}"]`;bs(n.key)||t.push(`${r}: key must match ${ly}.`);for(let o of["de","en"])(n.label?.[o]??"").trim()===""&&t.push(`${r}: label.${o} is required \u2014 [i18n/missingTranslation] every shown text needs German and English.`);let i=RG.filter(o=>o in n);if(i.length>0){t.push(`[config/fileRefRenamed] ${r} still names ${i.join(", ")} \u2014 this bundle was exported before the file-field rename, or by a plexus-cli older than this release (now filename / sizeBytes). Update plexus-cli, export it again (plexus-cli --env <env> config export) and re-apply.`);continue}if(typeof n.filename!="string")t.push(`${r}: filename is missing.`);else{let o=uo(n.filename);o!==null&&t.push(`${r}: filename ${o}.`)}af.includes(n.mimeType)||t.push(`${r}: mimeType "${n.mimeType}" is not allowed (${af.join(", ")}).`),cI.test(n.sha256??"")||t.push(`${r}: sha256 must be 64 lowercase hex chars.`),(!Number.isInteger(n.sizeBytes)||n.sizeBytes<=0)&&t.push(`${r}: sizeBytes must be a positive integer.`),"path"in n&&t.push(`${r}: "path" is a CLI snapshot field \u2014 resolve it with plexus-cli config apply.`)}}s(IG,"validateFiles");var OG=new WeakMap,PG=new WeakSet;function py(e,t){t(e);let r=e.asOptional.bind(e);return Object.defineProperty(e,"asOptional",{value:s(()=>py(r(),t),"value"),enumerable:!1}),e}s(py,"carry");function ks(e,t){return py(e,n=>OG.set(n,t))}s(ks,"tagged");var _G="tenant teardown drains every table explicitly (config/wipe.ts)",qt={belongsTo:s(e=>ks(e,{kind:"belongsTo"}),"belongsTo"),owns:s(e=>ks(e,{kind:"owns"}),"owns"),holds:s(e=>ks(e,{kind:"holds"}),"holds"),restrict:s((e,t)=>ks(e,t?{kind:"restrict",unindexed:t.unindexed}:{kind:"restrict"}),"restrict"),history:s(e=>ks(e,{kind:"history"}),"history"),tenant:s(e=>ks(e,{kind:"restrict",unindexed:_G}),"tenant"),historyOf:s(e=>py(e,t=>PG.add(t)),"historyOf")};var NG=b.object({street:b.string(),hausnr:b.string(),plz:b.string(),ort:b.string()}),uI=b.union(b.literal("school_operator"),b.literal("school_group"),b.literal("service_entity")),vr=uI.members.map(e=>e.value),CG={tenantId:qt.tenant(b.id("tenants")),name:b.optional(b.string()),type:uI,parentLegalEntityId:b.optional(qt.restrict(b.id("legal_entities"))),configKey:b.optional(b.string()),partyId:b.optional(qt.restrict(b.id("parties"))),address:b.optional(NG),signatoryUserId:b.optional(qt.restrict(b.id("users")))},Tle=Mr(CG).index("by_tenantId",["tenantId"]).index("by_parentLegalEntityId",["parentLegalEntityId"]).index("by_tenantId_and_configKey",["tenantId","configKey"]).index("by_partyId",["partyId"]).index("by_signatoryUserId",["signatoryUserId"]);var DG=b.union(b.literal("school"),b.literal("kindergarten"),b.literal("after_school_care"),b.literal("department"),b.literal("site"),b.literal("other")),In=DG.members.map(e=>e.value),Ile=b.union(b.literal("school"),b.literal("vocational"),b.literal("care"),b.literal("seminar"),b.literal("other")),Ole=b.union(b.literal("none"),b.literal("manual"),b.literal("annual_rollover")),Ple=b.union(b.literal("grade_level"),b.literal("module"),b.literal("phase"),b.literal("other")),_le=b.union(b.literal("school_year"),b.literal("cohort"),b.literal("seminar"),b.literal("care_period"),b.literal("other")),Nle=b.union(b.literal("planned"),b.literal("active"),b.literal("completed"),b.literal("archived")),Cle=b.union(b.literal("class"),b.literal("course"),b.literal("care_group"),b.literal("seminar_group"),b.literal("mixed_age_group"),b.literal("other")),Dle=b.union(b.literal("planned"),b.literal("active"),b.literal("completed"),b.literal("withdrawn"),b.literal("candidate")),Fle=b.union(b.literal("planned"),b.literal("active"),b.literal("completed"),b.literal("cancelled")),Lle=b.union(b.literal("class_teacher"),b.literal("teacher"),b.literal("mentor"),b.literal("instructor"),b.literal("assistant"),b.literal("other")),Mle=b.union(b.literal("units"),b.literal("unit_profiles"),b.literal("programs"),b.literal("program_stages"),b.literal("program_runs"),b.literal("learning_groups"),b.literal("enrollments"),b.literal("learning_group_staff_assignments")),qle=b.union(b.literal("open"),b.literal("mapped"),b.literal("ignored"));function pI(e){let t=["street","hausnr","plz","ort"].filter(n=>e[n]!==void 0);if(t.length!==0){if(t.length!==4)throw new Error(`config legal-entity add: an address needs all of --street, --hausnr, --plz and --ort (got ${t.map(n=>`--${n}`).join(", ")})`);return{street:e.street,hausnr:e.hausnr,plz:e.plz,ort:e.ort}}}s(pI,"addressFrom");function mI(e){if(!vr.includes(e))throw new Error(`config legal-entity add: --type "${e}" is none of ${vr.join(", ")}`);return e}s(mI,"legalEntityType");function hI(e){if(!In.includes(e))throw new Error(`config unit add: --kind "${e}" is none of ${In.join(", ")}`);return e}s(hI,"unitKind");function gI(e,t,n){let r=e.find(i=>i.key===t.key);if(r===void 0)return e.push(t),"create";if(Pe(r)===Pe(t))return"same";throw new Error(`${n} "${t.key}" already exists with other values \u2014 decide by hand, nothing written.
   in the file: ${JSON.stringify(r)}
   requested:   ${JSON.stringify(t)}`)}s(gI,"addRow");function fI(e){return new Set(aI(e).errors)}s(fI,"findings");function yI(e,t){let n=s(()=>JSON.parse(ke(e,"utf8")),"read"),r=n();if(typeof r!="object"||r===null||typeof r.foundation!="object")throw new Error(`config: ${e} is no exported tenant config (no "foundation" block) \u2014 export one with \`config export --out <file>\``);let i=fI(r),o=n(),a=t(o),l=[...fI(o)].filter(d=>!i.has(d));if(l.length>0)throw new Error(`config: the edit is refused by the config validator, nothing written:
   ${l.join(`
   `)}`);return a.action==="create"&&ht(e,`${JSON.stringify(o,null,2)}
-`,"utf8"),{...a,preexisting:[...i]}}s(yI,"editConfigFile");function wI(e,t){return{target:"legalEntities",key:t.key,action:gI(e.foundation.legalEntities,t,"Legal entity")}}s(wI,"addLegalEntity");function bI(e,t){return{target:"units",key:t.key,action:gI(e.foundation.units,t,"Unit")}}s(bI,"addUnit");var my="applicant";var kI="interessent";function vI(e,t){return{slug:e,name:t,enabledModules:[...TR],permissions:[...Ug],defaultApplicantGroupKey:my,defaultInteressentRoleKey:kI,defaultStartInProxy:!1,mailLevel:"all",magicLinkLogin:!0,externalSignIn:{mode:"oneTimeLink"},nationalityFlag:{...eI}}}s(vI,"fullTenant");function xI(e){return{legalEntities:e.legalEntities,units:e.units,permissionGroups:[{key:"tenant_admin",label:ao("Mandantenadmin","Tenant Admin"),permissions:[...Ug],sortOrder:10,grantAllCustomFields:!0},{key:my,label:ao("Extern/Bewerber","External/applicant"),permissions:[...RR],sortOrder:1e3}],users:e.users}}s(xI,"foundationWithTenantAdmin");function SI(e){let{slug:t,name:n}=e,r=`${t}_operator`,i=`${t}_schule`,o=xI({legalEntities:[{key:r,name:`${n} (Tr\xE4ger)`,type:"school_operator"}],units:[{key:i,name:{de:n,en:n},legalEntityKey:r,pedagogyUnit:!0,kind:"school"}],users:[]});return{key:t,tenant:{...vI(t,n),admissionFieldDisplayGroupKey:"stammdaten"},foundation:o,displayGroups:[{key:"stammdaten",label:{de:"Allgemein",en:"General"},color:"#475569",icon:"UserRound",sortOrder:10,defaultExpanded:!0}],lists:[],roles:[],fields:[],roleFields:[],deferredColumns:[],files:[],ignoredColumns:[]}}s(SI,"buildSkeletonTenantConfig");function hy(e,t,n="password"){t.length!==0&&(fo(e,n)||Rm(e,`email,${n}
+`,"utf8"),{...a,preexisting:[...i]}}s(yI,"editConfigFile");function wI(e,t){return{target:"legalEntities",key:t.key,action:gI(e.foundation.legalEntities,t,"Legal entity")}}s(wI,"addLegalEntity");function bI(e,t){return{target:"units",key:t.key,action:gI(e.foundation.units,t,"Unit")}}s(bI,"addUnit");var my="applicant";var kI="interessent";function vI(e,t){return{slug:e,name:t,enabledModules:[...TR],permissions:[...Ug],defaultApplicantGroupKey:my,defaultInteressentRoleKey:kI,defaultStartInProxy:!1,mailLevel:"all",magicLinkLogin:!0,externalSignIn:{mode:"oneTimeLink"},nationalityFlag:{...eI},adminSeesSignatureImages:!1}}s(vI,"fullTenant");function xI(e){return{legalEntities:e.legalEntities,units:e.units,permissionGroups:[{key:"tenant_admin",label:ao("Mandantenadmin","Tenant Admin"),permissions:[...Ug],sortOrder:10,grantAllCustomFields:!0},{key:my,label:ao("Extern/Bewerber","External/applicant"),permissions:[...RR],sortOrder:1e3}],users:e.users}}s(xI,"foundationWithTenantAdmin");function SI(e){let{slug:t,name:n}=e,r=`${t}_operator`,i=`${t}_schule`,o=xI({legalEntities:[{key:r,name:`${n} (Tr\xE4ger)`,type:"school_operator"}],units:[{key:i,name:{de:n,en:n},legalEntityKey:r,pedagogyUnit:!0,kind:"school"}],users:[]});return{key:t,tenant:{...vI(t,n),admissionFieldDisplayGroupKey:"stammdaten"},foundation:o,displayGroups:[{key:"stammdaten",label:{de:"Allgemein",en:"General"},color:"#475569",icon:"UserRound",sortOrder:10,defaultExpanded:!0}],lists:[],roles:[],fields:[],roleFields:[],deferredColumns:[],files:[],ignoredColumns:[]}}s(SI,"buildSkeletonTenantConfig");function hy(e,t,n="password"){t.length!==0&&(fo(e,n)||Rm(e,`email,${n}
 `),Rm(e,t.map(r=>`${r.email},${r.password}
 `).join("")))}s(hy,"writeCredentialRows");function fo(e,t){let n=`email,${t}`,r=Oe(e)?ke(e,"utf8"):"";if(r.trim().length===0)return!1;let i=r.split(`
 `,1)[0];if(i!==n)throw new Error(`plexus: ${e} is not an "${n}" file (header: "${i}") \u2014 pick another --out.`);return!0}s(fo,"assertCredentialFile");function uf(e,t,n,r="password"){hy(e,[{email:t,password:n}],r)}s(uf,"writeCredentialRow");import{createHash as LG}from"node:crypto";var TI={".pdf":"application/pdf",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".doc":"application/msword",".odt":"application/vnd.oasis.opendocument.text",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".jpg":"image/jpeg",".jpeg":"image/jpeg",".png":"image/png"},ff={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif",".avif":"image/avif",".woff2":"font/woff2"};function vs(e){return LG("sha256").update(e).digest("hex")}s(vs,"sha256Hex");function gy(e,t=TI){let n=H.resolve(e),r;try{r=ke(n)}catch{throw new Error(`File not found: ${e}`)}let i=t[H.extname(n).toLowerCase()];if(i===void 0)throw new Error(`${e}: unsupported file type \u2014 allowed: ${Object.keys(t).join(", ")}.`);return{bytes:r,filename:H.basename(n),mimeType:i,sha256:vs(r),sizeBytes:r.length}}s(gy,"readLocalFile");var MG={tenantFile:S.tenantFiles.platformGenerateUploadUrl,brandingAsset:S.branding.platformGenerateBrandingAssetUploadUrl};async function tl(e,t,n,r,i){let{uploadUrl:o,uploadTicket:a}=await e.mutation(MG[i],{client:t}),l=await e.upload(o,n,r);return await e.mutation(S.uploads.registerUpload,{uploadTicket:a,storageId:l}),l}s(tl,"uploadStaged");async function $I(e,t,n,r){return await tl(e,t,n,r,"tenantFile")}s($I,"uploadTenantFile");function yy(e){let t=[...e].filter(([,n])=>"fileName"in n||"size"in n).map(([n])=>n);if(t.length!==0)throw new Error(`[cli/serverPredatesFileRef] ${t.join(", ")}: the target deployment still answers fileName / size \u2014 it runs a release from before file references. Use a plexus-cli built from that release, or wait for the next release.`)}s(yy,"requireFileRefNames");async function nl(e,t){let n=await e.query(S.tenantFiles.platformList,{client:t});return yy(n.map(r=>[`files["${r.key}"]`,r])),n}s(nl,"listLibrary");function AI(e,t,n,r,i){let o=gy(H.resolve(e,t),i);if(o.mimeType!==n)throw new Error(`${r}: ${t} is ${o.mimeType}, the entry declares ${n}.`);return o}s(AI,"readSnapshotEntry");function RI(e,t){let n=new Map,r=(e.files??[]).map(l=>{if(l.path===void 0)return l;let{path:d,...c}=l,u=AI(t,d,c.mimeType,`files["${c.key}"]`,TI);return n.set(c.key,u),{...c,sha256:u.sha256,sizeBytes:u.sizeBytes}}),i=new Map,o=e.tenant.brandingAssets,a;if(o!==void 0){a={};for(let[l,d]of Object.entries(o)){if(d.path===void 0){a[l]=d;continue}let{path:c,...u}=d,f=`tenant.brandingAssets.${l}`,m=AI(t,c,u.mimeType,f,ff);i.set(l,m),a[l]={...u,sha256:m.sha256,sizeBytes:m.sizeBytes}}}return{config:{...e,tenant:{...e.tenant,...a!==void 0?{brandingAssets:a}:{}},files:r},bytes:n,brandingBytes:i}}s(RI,"resolveSnapshotFiles");async function II(e,t,n,r,i){let o={},a={contents:o,changed:[],unavailable:[]};for(let l of e){if(t.get(l.key)===l.sha256)continue;a.changed.push(l.key);let d=await n(l.key);if(d===void 0){a.unavailable.push(l.key);continue}if(vs(d)!==l.sha256)throw new Error(`${l.at}: the supplied bytes do not match sha256 ${l.sha256}.`);i||(o[l.key]=await r(d,l.mimeType))}return a}s(II,"stageChanged");async function OI(e,t,n,r,i){let o=new Map(Object.entries(await e.query(S.tenantFiles.platformFileHashes,{client:t})??{})),a=new Map(n.map(l=>[l.key,l]));return await II(n.map(l=>({key:l.key,sha256:l.sha256,mimeType:l.mimeType,at:`files["${l.key}"]`})),o,l=>r(a.get(l)),(l,d)=>tl(e,t,l,d,"tenantFile"),i)}s(OI,"stageFileContents");async function pf(e,t){let n=await e.query(S.branding.platformBrandingAssets,{client:t});return yy(Object.entries(n??{}).map(([r,i])=>[`tenant.brandingAssets.${r}`,i])),n}s(pf,"listBrandingAssets");async function PI(e,t,n,r,i){let o=new Map(Object.entries(await pf(e,t)??{}).map(([a,l])=>[a,l.sha256]));return await II(Object.entries(n??{}).map(([a,l])=>({key:a,sha256:l.sha256,mimeType:l.mimeType,at:`tenant.brandingAssets.${a}`})),o,r,(a,l)=>tl(e,t,a,l,"brandingAsset"),i)}s(PI,"stageBrandingAssets");async function _I(e,t,n,r){if(e===null)throw new Error(`${n}: its stored object is gone \u2014 ${r}`);let i=await fetch(e);if(!i.ok)throw new Error(`download of ${n} failed (${i.status}).`);let o=new Uint8Array(await i.arrayBuffer());if(vs(o)!==t)throw new Error(`download of ${n} does not match its sha256 ${t}.`);return o}s(_I,"downloadVerified");async function wy(e){return await _I(e.url,e.sha256,`"${e.key}"`,"replace it with `files put` first.")}s(wy,"downloadLibraryFile");async function by(e,t){return await _I(t.url,t.sha256,`branding/${e}`,"upload it again with `branding set-logo` / `branding set-font` first.")}s(by,"downloadBrandingAsset");function qG(e,t){let n=Object.keys(ff).find(r=>ff[r]===t);if(n===void 0)throw new Error(`export: branding/${e} is ${t}, which a snapshot cannot name (${Object.keys(ff).join(", ")}).`);return H.join("branding",`${e}${n}`)}s(qG,"brandingAssetPath");function EI(e,t,n){let r=H.join(e,t);Wt(H.dirname(r),{recursive:!0}),ht(r,n)}s(EI,"writeBeside");async function NI(e,t,n,r){yy([...n.files.map(c=>[`files["${c.key}"]`,c]),...Object.entries(n.tenant.brandingAssets??{}).map(([c,u])=>[`tenant.brandingAssets.${c}`,u])]);let i=new Map((await nl(e,t)).map(c=>[c.key,c])),o=H.dirname(r),a=[];for(let c of n.files){let u=i.get(c.key);if(u===void 0)throw new Error(`export: "${c.key}" vanished from the library between two reads \u2014 rerun.`);let f=uo(c.filename);if(f!==null||!bs(c.key))throw new Error(`export: "${c.key}" / "${c.filename}" is not a safe path (${f??"bad key"}).`);let m=H.join("files",c.key,c.filename);EI(o,m,await wy(u)),a.push({...c,path:m})}let l=n.tenant.brandingAssets,d;if(l!==void 0){let c=await pf(e,t)??{};d={};for(let[u,f]of Object.entries(l)){let m=c[u];if(m===void 0||m.sha256!==f.sha256)throw new Error(`export: branding/${u} changed between two reads \u2014 rerun.`);let g=qG(u,f.mimeType);EI(o,g,await by(u,m)),d[u]={...f,path:g}}}return{...n,tenant:{...n.tenant,...d!==void 0?{brandingAssets:d}:{}},files:a}}s(NI,"writeSnapshotFiles");var On={create:"+",update:"~",destroy:"-"};function DI(e,t=!1){let n=[{kind:`${On.create} create`,target:"(all)",detail:String(e.counts.created)},{kind:`${On.update} update`,target:"(all)",detail:String(e.counts.updated)},{kind:`${On.destroy} delete`,target:"(all)",detail:String(e.counts.deleted)},{kind:"\xB7 unchanged",target:"(all)",detail:String(e.counts.unchanged)}];for(let r of e.creations)n.push({kind:`${On.create} create`,target:r.target,detail:r.key});for(let r of e.updates)n.push({kind:`${On.update} update`,target:r.target,detail:r.key});for(let r of e.deletions)n.push({kind:`${On.destroy} delete`,target:r.target,detail:r.key});for(let r of e.slugChanges)n.push({kind:`${On.update} slug`,target:`units/${r.unitKey}`,detail:`${r.from} \u2192 ${r.to} (old URL /e/units/${r.from} no longer reaches this unit)`});for(let r of e.orphans)n.push({kind:`${On.destroy} orphan`,target:`${r.target}/${r.table}`,detail:`${r.key} (${e.destroyed!==void 0?"destroyed":"would destroy"})`});for(let r of e.accounts.minted)n.push({kind:`${On.create} account`,target:r.email,detail:t?"password: (not echoed)":`password: ${r.password}`});for(let r of e.accounts.pending)n.push({kind:"! no account",target:r,detail:"would get a generated password on --confirm"});return n}s(DI,"planRows");function CI(e,t,n,r,i){return(e?.changed??[]).map(o=>({kind:`${On.update} ${t}`,target:`${n}/${o}`,detail:e?.unavailable.includes(o)?`content differs \u2014 NO bytes in this source; a commit needs them bundled or fails ${r}`:i?"content differs \u2014 would upload":"content uploaded"}))}s(CI,"contentRows");async function KG(e,t){if(e==="blueprint")return{source:"blueprint"};if(e.startsWith("env:")){let n=e.slice(4);if(!n)throw new Error("config: --from env:<srcEnv> needs a source environment.");let r=await Pa({env:n,tenant:t});return{source:"inline",config:await r.query(S.config.api.exportTenant,{tenant:t}),bytesFor:s(async o=>{let a=(await nl(r,t)).find(l=>l.key===o.key);return a===void 0?void 0:await wy(a)},"bytesFor"),brandingBytesFor:s(async o=>{let a=(await pf(r,t))?.[o];return a===void 0?void 0:await by(o,a)},"brandingBytesFor")}}if(e.startsWith("snapshot:")){let n=H.resolve(e.slice(9)),r=JSON.parse(ke(n,"utf8")),{config:i,bytes:o,brandingBytes:a}=RI(r,H.dirname(n));return{source:"inline",config:i,bytesFor:s(async l=>o.get(l.key)?.bytes,"bytesFor"),brandingBytesFor:s(async l=>a.get(l)?.bytes,"brandingBytesFor")}}throw new Error(`config: unknown --from "${e}". Use blueprint | env:<srcEnv> | snapshot:<path>. / Unbekannte Quelle "${e}".`)}s(KG,"resolveSource");function jG(e){try{return JSON.parse(e)}catch{return e}}s(jG,"parseValue");var ky=class extends Se{static{s(this,"ConfigShowCommand")}static paths=[["config","show"]];static usage=E.Usage({category:"Config",description:"Show the resolved connection config (no network) / Verbindung anzeigen"});env=p.String("--env",{description:"Target environment (local|staging|prod)"});tenant=p.String("--tenant",{description:"Tenant slug"});async execute(){let t=AT({env:this.env,tenant:this.tenant});return this.print({env:t.env,source:t.source,convexUrl:t.convexUrl,siteUrl:t.siteUrl,deployment:t.deployment??"(n/a)",tenant:t.tenant??"(none)",authMode:t.authMode,envVars:t.fromEnvVars.join(", ")||"(none)"},n=>[{key:"env",value:n.env},{key:"source",value:n.source},{key:"convexUrl",value:n.convexUrl},{key:"siteUrl",value:n.siteUrl},{key:"deployment",value:n.deployment},{key:"tenant",value:n.tenant},{key:"authMode",value:n.authMode},{key:"envVars",value:n.envVars}],["key","value"]),0}},vy=class extends Se{static{s(this,"ConfigInitCommand")}static paths=[["config","init"]];static usage=E.Usage({category:"Config",description:"Scaffold a minimal, valid tenant config JSON on disk / Mandanten-Konfiguration anlegen"});tenant=p.String("--tenant",{required:!0,description:"New tenant slug"});name=p.String("--name",{required:!0,description:"Tenant display name"});out=p.String("--out",{description:"Output file (default: config/.dev/<tenant>/config.json; refused when it exists, unless --force)"});force=gn();async execute(){let t=SI({slug:this.tenant,name:this.name}),n=or(this.out??H.join(st()?.workspaceRoot??Ia,"config",".dev",this.tenant,"config.json"),this.force);return Wt(H.dirname(n),{recursive:!0}),ht(n,`${JSON.stringify(t,null,2)}
@@ -9771,6 +9771,6 @@ ${n.length} unusable ${o}:
 `),r.length>0&&this.context.stdout.write(`  ${r.length} linkable \u2014 plexus-cli users relink-auth <email>
 `),i.length>0&&this.context.stdout.write(`  ${i.length} without any login account \u2014 plexus-cli users provision --tenant <slug> --email <email> --name <name>
 `)}else this.context.stdout.write(`No unusable identities.
-`);return n.length>0?1:0}},zS=class extends Sn{static{s(this,"UsersRelinkAuthCommand")}static paths=[["users","relink-auth"]];static usage=E.Usage({category:"Users",description:"Relink a user's identity row to its live Better Auth account (heals an orphan)."});email=p.String({required:!0});async execute(){let n=await(await this.caller()).mutation(S.platformAdmin.relinkAuthAccount,{email:this.email}),r=n.changed?`Relinked ${this.email} to live auth account ${n.authId}.`:`${this.email} already linked to the live auth account (no change).`;return this.report(n,r),0}};function X0(e,t){if(e===t)throw new Error("Pass exactly one of --on or --off.");return e}s(X0,"requireOnOff");var eM=[$S,RS,IS,OS,PS,_S,NS,CS,DS,FS,LS,MS,wc,qS,KS,jS,BS,VS,US,GS,zS];function tM(e){return e.de??e.en??Object.values(e)[0]??""}s(tM,"titleDe");function HJ(e){return{id:e._id,kind:e.kind,status:e.status,title:tM(e.title).slice(0,50),assignee:e.assigneeUserId??"",group:e.queueGroupId??"",outcome:e.outcome??""}}s(HJ,"row");var YJ=["id","kind","status","title","assignee","group","outcome"],HS=class extends D{static{s(this,"WorkItemsListCommand")}static paths=[["work-items","list"]];static usage=E.Usage({category:"Work-Items",description:"List work-items for the active tenant (filter by --mine/--application/--group)."});mine=p.Boolean("--mine",!1,{description:"Only items assigned to me."});application=p.String("--application",{description:"Filter by application id."});group=p.String("--group",{description:"Filter by team (permission-group) id."});assignee=p.String("--assignee",{description:"Filter by assignee users._id."});openOnly=p.Boolean("--open-only",!1,{description:"Only open items."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.query(S.workItems.list,{client:n,...this.mine?{mine:!0}:{},...this.application?{applicationId:this.application}:{},...this.group?{queueGroupId:this.group}:{},...this.assignee?{assigneeUserId:this.assignee}:{},...this.openOnly?{openOnly:!0}:{}});return this.print(r,i=>i.map(HJ),YJ),0}},YS=class extends D{static{s(this,"WorkItemsShowCommand")}static paths=[["work-items","show"]];static usage=E.Usage({category:"Work-Items",description:"Show one work-item by id."});workItemId=p.String({required:!0,name:"workItemId"});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.query(S.workItems.get,{client:n,workItemId:this.workItemId});if(r===null)throw new Error(`work-item ${this.workItemId} not found in tenant ${n}.`);return this.print(r,i=>[{field:"id",value:i._id},{field:"kind",value:i.kind},{field:"status",value:i.status},{field:"title",value:tM(i.title)},{field:"assignee",value:i.assigneeUserId??""},{field:"group",value:i.queueGroupId??""},{field:"application",value:i.applicationId??""},{field:"node",value:i.nodeId??""},{field:"outcome",value:i.outcome??""}]),0}},JS=class extends D{static{s(this,"WorkItemsCreateCommand")}static paths=[["work-items","create"]];static usage=E.Usage({category:"Work-Items",description:"Create a manual task work-item."});title=p.String("--title",{required:!0,description:"Task title."});description=p.String("--description",{description:"Task description."});application=p.String("--application",{description:"Link to an application id."});group=p.String("--group",{description:"Team (permission-group) id whose queue holds the task."});assignee=p.String("--assignee",{description:"Assignee users._id."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.mutation(S.workItems.createManual,{client:n,title:this.title,...this.description?{description:this.description}:{},...this.application?{applicationId:this.application}:{},...this.group?{queueGroupId:this.group}:{},...this.assignee?{assigneeUserId:this.assignee}:{}});return this.print({workItemId:r.workItemId},i=>[{field:"workItemId",value:i.workItemId}]),0}},QS=class extends D{static{s(this,"WorkItemsCompleteCommand")}static paths=[["work-items","complete"]];static usage=E.Usage({category:"Work-Items",description:"Complete a work-item (optionally with an outcome)."});workItemId=p.String({required:!0,name:"workItemId"});outcome=p.String("--outcome",{description:"Outcome id to record."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.mutation(S.workItems.complete,{client:n,workItemId:this.workItemId,...this.outcome?{outcome:this.outcome}:{}});return this.print({workItemId:r.workItemId,status:"done"},i=>[{field:"workItemId",value:i.workItemId},{field:"status",value:i.status}]),0}},ZS=class extends D{static{s(this,"WorkItemsAssignCommand")}static paths=[["work-items","assign"]];static usage=E.Usage({category:"Work-Items",description:"Assign a work-item to a user (omit --user to unassign)."});workItemId=p.String({required:!0,name:"workItemId"});user=p.String("--user",{description:"Assignee users._id (omit to clear)."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.mutation(S.workItems.assign,{client:n,workItemId:this.workItemId,...this.user?{userId:this.user}:{}});return this.print({workItemId:r.workItemId,assignee:this.user??"(cleared)"},i=>[{field:"workItemId",value:i.workItemId},{field:"assignee",value:i.assignee}]),0}},nM=[HS,YS,JS,QS,ZS];var Em=[...PT,...wR,...MI,...LI,...cO,...SO,...xO,...Q0,...eM,...d0,...rR,...sO,...z0,...IT,...n$,...eR,...TO,...EO,...IO,...OO,...iO,...UI,...nM,...dF,...HF,...a0,...YF,...C0,...B0,...c0,...b0,...x0,...G0,...J0,...HT];var rM="0.1.11";function iM(){return Em.flatMap(e=>(e.paths??[]).map(t=>{let n=t.join(" "),r=ET[Na(n)];return{path:n,effect:eo(n),host:r===void 0?"shared":"terminal",...r===void 0?{}:{reason:r}}})).sort((e,t)=>e.path.localeCompare(t.path))}s(iM,"plexusCommandCatalog");import Fo from"node:path";function JJ(e){let t=st()?.workspaceRoot??process.cwd(),n=Fo.resolve(t,e),r=Fo.relative(t,n);if(Fo.isAbsolute(e)||r===".."||r.startsWith(`..${Fo.sep}`))throw new Error("plexus: use a relative path inside the current workspace.");return{absolute:n,relative:r}}s(JJ,"workspacePath");function QJ(e){let{absolute:t,relative:n}=JJ(e.path??".");if(e.operation==="list"){if(!Oe(t))return{files:[]};let r=[],i=s(o=>{for(let a of Vi(o,{withFileTypes:!0})){if(a.isSymbolicLink())throw new Error("plexus: workspace symlinks are not supported.");let l=Fo.join(o,a.name);if(a.isDirectory()?i(l):r.push(Fo.relative(t,l)),r.length>200)throw new Error("plexus: the workspace contains too many files. List a subdirectory.")}},"visit");return i(t),{files:r.sort()}}if(!n)throw new Error("plexus: name a workspace file.");if(["read","search","edit"].includes(e.operation)){let r=ke(t);if(r.length>10*1024*1024)throw new Error("plexus: the workspace file exceeds 10 MB.");let i=new TextDecoder("utf-8",{fatal:!0}).decode(r);if(e.operation==="read"){let l=e.offset??0,d=e.maxChars??8e3,c=i.slice(l,l+d);return{path:n,content:c,...l||c.length<i.length?{offset:l,nextOffset:l+c.length<i.length?l+c.length:null,totalCharacters:i.length}:{}}}if(e.operation==="search"){if(!e.query)throw new Error("plexus: search needs a nonempty query.");let l=[],d=e.offset??0;for(;l.length<10;){let c=i.indexOf(e.query,d);if(c<0)break;l.push({offset:c,text:i.slice(Math.max(0,c-160),c+e.query.length+240)}),d=c+e.query.length}return{path:n,matches:l,nextOffset:l.length===10?d:null}}if(!e.oldText||typeof e.content!="string")throw new Error("plexus: edit needs oldText and replacement content.");let o=i.indexOf(e.oldText);if(o<0||o!==i.lastIndexOf(e.oldText))throw new Error("plexus: oldText must match exactly once. Read the current file and choose unique context.");let a=i.slice(0,o)+e.content+i.slice(o+e.oldText.length);if(Buffer.byteLength(a)>10*1024*1024)throw new Error("plexus: the edited file exceeds 10 MB.");return ht(t,a,"utf8"),{path:n,sizeBytes:Buffer.byteLength(a)}}if(e.operation==="write"){if(typeof e.content!="string"||Buffer.byteLength(e.content)>1e6)throw new Error("plexus: file content is missing or too large.");return Wt(Fo.dirname(t),{recursive:!0}),ht(t,e.content,"utf8"),{path:n,sizeBytes:Buffer.byteLength(e.content)}}if(e.operation==="remove")return Ko(t),{path:n,removed:!0};throw new Error("plexus: unknown workspace operation.")}s(QJ,"plexusWorkspace");function oM(e){return s(async function(n,r){if(!r||typeof r!="object"||Array.isArray(r))throw new Error("plexus: tool input must be an object.");let i=r,o=Da[n];if(!o||!Object.hasOwn(Da,n))throw new Error("plexus: unknown agent tool.");if(Object.keys(i).some(a=>!Object.hasOwn(o.inputSchema.properties,a)))throw new Error("plexus: unexpected tool argument.");if(n==="plexus"){if(!Array.isArray(i.argv)||i.argv.some(a=>typeof a!="string")||i.stdin!==void 0&&typeof i.stdin!="string")throw new Error("plexus: invalid command input.");return e.inspectCommand(i.argv),e.executeCommand({argv:i.argv,...i.stdin===void 0?{}:{stdin:i.stdin}})}if(n==="plexus_skill"){if(typeof i.path!="string"||i.path.length>240||!Object.hasOwn(jh,i.path))throw new Error("plexus: unknown skill reference. Start with SKILL.md.");return{path:i.path,content:jh[i.path],skillHash:mu}}if(typeof i.operation!="string"||!["list","read","search","edit","write","remove"].includes(i.operation)||i.path!==void 0&&(typeof i.path!="string"||i.path.length>500)||i.content!==void 0&&(typeof i.content!="string"||i.content.length>1e6)||i.oldText!==void 0&&(typeof i.oldText!="string"||i.oldText.length>1e6)||i.query!==void 0&&(typeof i.query!="string"||!i.query.length||i.query.length>1e3)||i.offset!==void 0&&(typeof i.offset!="number"||!Number.isSafeInteger(i.offset)||i.offset<0)||i.maxChars!==void 0&&(typeof i.maxChars!="number"||!Number.isSafeInteger(i.maxChars)||i.maxChars<1||i.maxChars>24e3))throw new Error("plexus: invalid workspace input.");return QJ(i)},"executePlexusAgentTool")}s(oM,"createPlexusAgentToolExecutor");var Tm=oM({inspectCommand:aM,executeCommand:lM});function $m(){let e=new Uo({binaryLabel:"Plexus CLI",binaryName:"plexus-cli",binaryVersion:rM});e.register(ya.HelpCommand),e.register(ya.VersionCommand);for(let n of Em)e.register(n);async function t(n,r){let i;try{i=e.process(n,r)}catch(o){return(r.stderr??process.stderr).write(e.error(o,{colored:!1})),2}return e4(i,r.stderr??process.stderr),e.run(i,r)}return s(t,"run"),{process(n,r){return e.process(n,r)},run:t,async runExit(n,r){process.exitCode=await t(n,r)}}}s($m,"createPlexusCli");function e4(e,t){let n=e.path.join(" "),r=e.constructor.paths?.[0]?.join(" ");r!==void 0&&n!==r&&_a[n]===r&&dt(t,n,r),n in _a&&eo(n)==="confirm"&&!Ca(e)&&t.write(`plexus-cli: \`${_a[n]}\` only prints its plan without --confirm \u2014 nothing was changed.
+`);return n.length>0?1:0}},zS=class extends Sn{static{s(this,"UsersRelinkAuthCommand")}static paths=[["users","relink-auth"]];static usage=E.Usage({category:"Users",description:"Relink a user's identity row to its live Better Auth account (heals an orphan)."});email=p.String({required:!0});async execute(){let n=await(await this.caller()).mutation(S.platformAdmin.relinkAuthAccount,{email:this.email}),r=n.changed?`Relinked ${this.email} to live auth account ${n.authId}.`:`${this.email} already linked to the live auth account (no change).`;return this.report(n,r),0}};function X0(e,t){if(e===t)throw new Error("Pass exactly one of --on or --off.");return e}s(X0,"requireOnOff");var eM=[$S,RS,IS,OS,PS,_S,NS,CS,DS,FS,LS,MS,wc,qS,KS,jS,BS,VS,US,GS,zS];function tM(e){return e.de??e.en??Object.values(e)[0]??""}s(tM,"titleDe");function HJ(e){return{id:e._id,kind:e.kind,status:e.status,title:tM(e.title).slice(0,50),assignee:e.assigneeUserId??"",group:e.queueGroupId??"",outcome:e.outcome??""}}s(HJ,"row");var YJ=["id","kind","status","title","assignee","group","outcome"],HS=class extends D{static{s(this,"WorkItemsListCommand")}static paths=[["work-items","list"]];static usage=E.Usage({category:"Work-Items",description:"List work-items for the active tenant (filter by --mine/--application/--group)."});mine=p.Boolean("--mine",!1,{description:"Only items assigned to me."});application=p.String("--application",{description:"Filter by application id."});group=p.String("--group",{description:"Filter by team (permission-group) id."});assignee=p.String("--assignee",{description:"Filter by assignee users._id."});openOnly=p.Boolean("--open-only",!1,{description:"Only open items."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.query(S.workItems.list,{client:n,...this.mine?{mine:!0}:{},...this.application?{applicationId:this.application}:{},...this.group?{queueGroupId:this.group}:{},...this.assignee?{assigneeUserId:this.assignee}:{},...this.openOnly?{openOnly:!0}:{}});return this.print(r,i=>i.map(HJ),YJ),0}},YS=class extends D{static{s(this,"WorkItemsShowCommand")}static paths=[["work-items","show"]];static usage=E.Usage({category:"Work-Items",description:"Show one work-item by id."});workItemId=p.String({required:!0,name:"workItemId"});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.query(S.workItems.get,{client:n,workItemId:this.workItemId});if(r===null)throw new Error(`work-item ${this.workItemId} not found in tenant ${n}.`);return this.print(r,i=>[{field:"id",value:i._id},{field:"kind",value:i.kind},{field:"status",value:i.status},{field:"title",value:tM(i.title)},{field:"assignee",value:i.assigneeUserId??""},{field:"group",value:i.queueGroupId??""},{field:"application",value:i.applicationId??""},{field:"node",value:i.nodeId??""},{field:"outcome",value:i.outcome??""}]),0}},JS=class extends D{static{s(this,"WorkItemsCreateCommand")}static paths=[["work-items","create"]];static usage=E.Usage({category:"Work-Items",description:"Create a manual task work-item."});title=p.String("--title",{required:!0,description:"Task title."});description=p.String("--description",{description:"Task description."});application=p.String("--application",{description:"Link to an application id."});group=p.String("--group",{description:"Team (permission-group) id whose queue holds the task."});assignee=p.String("--assignee",{description:"Assignee users._id."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.mutation(S.workItems.createManual,{client:n,title:this.title,...this.description?{description:this.description}:{},...this.application?{applicationId:this.application}:{},...this.group?{queueGroupId:this.group}:{},...this.assignee?{assigneeUserId:this.assignee}:{}});return this.print({workItemId:r.workItemId},i=>[{field:"workItemId",value:i.workItemId}]),0}},QS=class extends D{static{s(this,"WorkItemsCompleteCommand")}static paths=[["work-items","complete"]];static usage=E.Usage({category:"Work-Items",description:"Complete a work-item (optionally with an outcome)."});workItemId=p.String({required:!0,name:"workItemId"});outcome=p.String("--outcome",{description:"Outcome id to record."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.mutation(S.workItems.complete,{client:n,workItemId:this.workItemId,...this.outcome?{outcome:this.outcome}:{}});return this.print({workItemId:r.workItemId,status:"done"},i=>[{field:"workItemId",value:i.workItemId},{field:"status",value:i.status}]),0}},ZS=class extends D{static{s(this,"WorkItemsAssignCommand")}static paths=[["work-items","assign"]];static usage=E.Usage({category:"Work-Items",description:"Assign a work-item to a user (omit --user to unassign)."});workItemId=p.String({required:!0,name:"workItemId"});user=p.String("--user",{description:"Assignee users._id (omit to clear)."});async execute(){let t=await this.caller(),n=this.requireTenant(t),r=await t.mutation(S.workItems.assign,{client:n,workItemId:this.workItemId,...this.user?{userId:this.user}:{}});return this.print({workItemId:r.workItemId,assignee:this.user??"(cleared)"},i=>[{field:"workItemId",value:i.workItemId},{field:"assignee",value:i.assignee}]),0}},nM=[HS,YS,JS,QS,ZS];var Em=[...PT,...wR,...MI,...LI,...cO,...SO,...xO,...Q0,...eM,...d0,...rR,...sO,...z0,...IT,...n$,...eR,...TO,...EO,...IO,...OO,...iO,...UI,...nM,...dF,...HF,...a0,...YF,...C0,...B0,...c0,...b0,...x0,...G0,...J0,...HT];var rM="0.1.12";function iM(){return Em.flatMap(e=>(e.paths??[]).map(t=>{let n=t.join(" "),r=ET[Na(n)];return{path:n,effect:eo(n),host:r===void 0?"shared":"terminal",...r===void 0?{}:{reason:r}}})).sort((e,t)=>e.path.localeCompare(t.path))}s(iM,"plexusCommandCatalog");import Fo from"node:path";function JJ(e){let t=st()?.workspaceRoot??process.cwd(),n=Fo.resolve(t,e),r=Fo.relative(t,n);if(Fo.isAbsolute(e)||r===".."||r.startsWith(`..${Fo.sep}`))throw new Error("plexus: use a relative path inside the current workspace.");return{absolute:n,relative:r}}s(JJ,"workspacePath");function QJ(e){let{absolute:t,relative:n}=JJ(e.path??".");if(e.operation==="list"){if(!Oe(t))return{files:[]};let r=[],i=s(o=>{for(let a of Vi(o,{withFileTypes:!0})){if(a.isSymbolicLink())throw new Error("plexus: workspace symlinks are not supported.");let l=Fo.join(o,a.name);if(a.isDirectory()?i(l):r.push(Fo.relative(t,l)),r.length>200)throw new Error("plexus: the workspace contains too many files. List a subdirectory.")}},"visit");return i(t),{files:r.sort()}}if(!n)throw new Error("plexus: name a workspace file.");if(["read","search","edit"].includes(e.operation)){let r=ke(t);if(r.length>10*1024*1024)throw new Error("plexus: the workspace file exceeds 10 MB.");let i=new TextDecoder("utf-8",{fatal:!0}).decode(r);if(e.operation==="read"){let l=e.offset??0,d=e.maxChars??8e3,c=i.slice(l,l+d);return{path:n,content:c,...l||c.length<i.length?{offset:l,nextOffset:l+c.length<i.length?l+c.length:null,totalCharacters:i.length}:{}}}if(e.operation==="search"){if(!e.query)throw new Error("plexus: search needs a nonempty query.");let l=[],d=e.offset??0;for(;l.length<10;){let c=i.indexOf(e.query,d);if(c<0)break;l.push({offset:c,text:i.slice(Math.max(0,c-160),c+e.query.length+240)}),d=c+e.query.length}return{path:n,matches:l,nextOffset:l.length===10?d:null}}if(!e.oldText||typeof e.content!="string")throw new Error("plexus: edit needs oldText and replacement content.");let o=i.indexOf(e.oldText);if(o<0||o!==i.lastIndexOf(e.oldText))throw new Error("plexus: oldText must match exactly once. Read the current file and choose unique context.");let a=i.slice(0,o)+e.content+i.slice(o+e.oldText.length);if(Buffer.byteLength(a)>10*1024*1024)throw new Error("plexus: the edited file exceeds 10 MB.");return ht(t,a,"utf8"),{path:n,sizeBytes:Buffer.byteLength(a)}}if(e.operation==="write"){if(typeof e.content!="string"||Buffer.byteLength(e.content)>1e6)throw new Error("plexus: file content is missing or too large.");return Wt(Fo.dirname(t),{recursive:!0}),ht(t,e.content,"utf8"),{path:n,sizeBytes:Buffer.byteLength(e.content)}}if(e.operation==="remove")return Ko(t),{path:n,removed:!0};throw new Error("plexus: unknown workspace operation.")}s(QJ,"plexusWorkspace");function oM(e){return s(async function(n,r){if(!r||typeof r!="object"||Array.isArray(r))throw new Error("plexus: tool input must be an object.");let i=r,o=Da[n];if(!o||!Object.hasOwn(Da,n))throw new Error("plexus: unknown agent tool.");if(Object.keys(i).some(a=>!Object.hasOwn(o.inputSchema.properties,a)))throw new Error("plexus: unexpected tool argument.");if(n==="plexus"){if(!Array.isArray(i.argv)||i.argv.some(a=>typeof a!="string")||i.stdin!==void 0&&typeof i.stdin!="string")throw new Error("plexus: invalid command input.");return e.inspectCommand(i.argv),e.executeCommand({argv:i.argv,...i.stdin===void 0?{}:{stdin:i.stdin}})}if(n==="plexus_skill"){if(typeof i.path!="string"||i.path.length>240||!Object.hasOwn(jh,i.path))throw new Error("plexus: unknown skill reference. Start with SKILL.md.");return{path:i.path,content:jh[i.path],skillHash:mu}}if(typeof i.operation!="string"||!["list","read","search","edit","write","remove"].includes(i.operation)||i.path!==void 0&&(typeof i.path!="string"||i.path.length>500)||i.content!==void 0&&(typeof i.content!="string"||i.content.length>1e6)||i.oldText!==void 0&&(typeof i.oldText!="string"||i.oldText.length>1e6)||i.query!==void 0&&(typeof i.query!="string"||!i.query.length||i.query.length>1e3)||i.offset!==void 0&&(typeof i.offset!="number"||!Number.isSafeInteger(i.offset)||i.offset<0)||i.maxChars!==void 0&&(typeof i.maxChars!="number"||!Number.isSafeInteger(i.maxChars)||i.maxChars<1||i.maxChars>24e3))throw new Error("plexus: invalid workspace input.");return QJ(i)},"executePlexusAgentTool")}s(oM,"createPlexusAgentToolExecutor");var Tm=oM({inspectCommand:aM,executeCommand:lM});function $m(){let e=new Uo({binaryLabel:"Plexus CLI",binaryName:"plexus-cli",binaryVersion:rM});e.register(ya.HelpCommand),e.register(ya.VersionCommand);for(let n of Em)e.register(n);async function t(n,r){let i;try{i=e.process(n,r)}catch(o){return(r.stderr??process.stderr).write(e.error(o,{colored:!1})),2}return e4(i,r.stderr??process.stderr),e.run(i,r)}return s(t,"run"),{process(n,r){return e.process(n,r)},run:t,async runExit(n,r){process.exitCode=await t(n,r)}}}s($m,"createPlexusCli");function e4(e,t){let n=e.path.join(" "),r=e.constructor.paths?.[0]?.join(" ");r!==void 0&&n!==r&&_a[n]===r&&dt(t,n,r),n in _a&&eo(n)==="confirm"&&!Ca(e)&&t.write(`plexus-cli: \`${_a[n]}\` only prints its plan without --confirm \u2014 nothing was changed.
 `)}s(e4,"noteRetiredPath");function aM(e){let t=$m().process(la(e),{executePlexusAgentTool:Tm}),n=t.path.join(" ");if(n.startsWith("agent "))throw new Error("plexus: nested agent transports are not allowed.");let r=iM().find(l=>l.path===n);if(!r){if(n===""||n==="--help"||n==="--version")return{path:n,writes:!1,host:"shared"};throw new Error(`plexus: command ${n} has no host classification.`)}let i=t,o=r.effect==="callKind"?xf(xs(Ss),i.fn??"",i.kind):void 0,a=fu(n,{confirm:Ca(t),callKind:o});return{...r,writes:a}}s(aM,"inspectPlexusCommand");async function lM(e,t){if(t)return tA(t,()=>lM(e));if(!Array.isArray(e.argv)||e.argv.length===0||e.argv.length>128||e.argv.some(l=>typeof l!="string"||l.length>128e3)||(e.stdin?.length??0)>1e6)throw new Error("plexus: invalid command invocation.");let n="",r="",i=$m();if(st()){let l=aM(e.argv);if(l.host==="terminal")throw new Error(`plexus: this command requires a local machine. ${l.reason??""}`)}return{exitCode:await i.run(la(e.argv),{executePlexusAgentTool:Tm,stdin:XJ.from(e.stdin===void 0?[]:[e.stdin]),stdout:new sM({write(l,d,c){n+=String(l),c()}}),stderr:new sM({write(l,d,c){r+=String(l),c()}})}),stdout:n,stderr:r}}s(lM,"executePlexusCommand");sA({source:t4.join(import.meta.dirname,"skill")});$m().runExit(la(process.argv.slice(2)),{executePlexusAgentTool:Tm});
 //# sourceMappingURL=cli.mjs.map