@astram/identity 0.16.0 → 0.17.0

package/dist/features/org-structure/org-unit-name.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * G-012 (spec §10): the ONE name rule for departments and branches, shared by the create and rename
+ * routes, `OrgCatalogService.ensure*` and the org bootstrap planner, so "Quality  Assurance" in a
+ * bootstrap file and "Quality Assurance" typed in the UI are the same name.
+ *
+ * Order (spec §10, as written): Unicode NFC; trim and collapse every whitespace run (JS `\s`, so
+ * tab, CR and LF too) to one space; refuse any control character left (U+0000–U+001F,
+ * U+007F–U+009F, e.g. NUL or NEL); refuse an empty result or one longer than
+ * {@link ORG_UNIT_NAME_MAX} characters (code points, the column width). The template's
+ * `validateName` (`pages/org-structure/orgStructure.js`) applies the same order, so the client
+ * never accepts a name the server refuses.
+ *
+ * Case, accents and width are NOT folded here: the stored name keeps what the user typed; the
+ * column collation (`utf8mb4_unicode_ci`) decides uniqueness, and the bootstrap planner compares
+ * with `nameKey` on top of this.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_UNIT_NAME_MAX = void 0;
+exports.normaliseOrgUnitName = normaliseOrgUnitName;
+exports.orgUnitNameMessage = orgUnitNameMessage;
+/** The column width of `d_name` / `b_name` (VARCHAR(150), counted in characters). */
+exports.ORG_UNIT_NAME_MAX = 150;
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/u;
+/** Normalise a department or branch name, or say why it is refused. Pure. */
+function normaliseOrgUnitName(raw) {
+    if (typeof raw !== 'string')
+        return { ok: false, reason: 'not_text' };
+    const nfc = raw.normalize('NFC');
+    const value = nfc.trim().replace(/\s+/gu, ' ');
+    if (CONTROL.test(value))
+        return { ok: false, reason: 'control_character' };
+    if (value.length === 0)
+        return { ok: false, reason: 'empty' };
+    if ([...value].length > exports.ORG_UNIT_NAME_MAX)
+        return { ok: false, reason: 'too_long' };
+    return { ok: true, value };
+}
+/** The fixed, user-facing 400 text for a refusal (`kind` is "department" or "branch"). */
+function orgUnitNameMessage(kind, reason) {
+    switch (reason) {
+        case 'control_character':
+            return `A ${kind} name cannot contain control characters.`;
+        case 'too_long':
+            return `A ${kind} name can be at most ${exports.ORG_UNIT_NAME_MAX} characters.`;
+        default:
+            return `Enter a ${kind} name.`;
+    }
+}

package/dist/features/role/role.controller.d.ts

@@ -5,9 +5,26 @@ export declare class RoleController {
     private readonly roles;
     constructor(roles: RoleService);
     /**
-     * List roles — gated on `identity:role:read` (see class doc). Server-side DataTable:
-     * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` —
-     * `total` reflects the FILTERED set so the client can page the true result count.
+     * One company's own roles — `identity:role:read`. The company is reached through the walled
+     * `company` read first (404 out of reach). `?page&limit&search&sortBy&sortOrder` as `GET /roles`
+     * ⇒ `{ total, rows, page, limit }`.
+     */
+    listCompanyRoles(companyUuid: string, query: ListQueryDto): Promise<{
+        total: number;
+        rows: readonly import("packages/engine/dist/types.js").RecordView[];
+        page: number;
+        limit: number;
+    }>;
+    /** Create a role in a company — `identity:role:create` ⇒ 201 `{ uuid, name }`. */
+    createCompanyRole(companyUuid: string, body: unknown): Promise<{
+        uuid: string;
+        name: string;
+    }>;
+    /**
+     * List roles — gated on `identity:role:read` (see class doc): the roles owned in the caller's
+     * reachable subtree (root: every role, ownerless ones included). Server-side DataTable:
+     * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` — `total`
+     * reflects the FILTERED set so the client can page the true result count.
      */
     listRoles(query: ListQueryDto): Promise<{
         total: number;
@@ -15,19 +32,17 @@ export declare class RoleController {
         page: number;
         limit: number;
     }>;
-    /** Create a role — gated on `identity:role:create`. */
-    createRole(req: AuthedRequest, body: {
-        name?: string;
-    }): Promise<{
+    /**
+     * Create a role in the caller's active company (else its tenant) — `identity:role:create`. Kept
+     * for existing clients; a caller with no company ⇒ 400. Any owner in the body is ignored.
+     */
+    createRole(req: AuthedRequest, body: unknown): Promise<{
         id: import("packages/engine/dist/types.js").RecordId;
     }>;
-    /** Read one role — gated on `identity:role:read` (CONTROL-plane; root, the identity
-     *  administrator, may read roles). */
+    /** Read one role — gated on `identity:role:read`; walled by owner (404 outside the subtree). */
     getRole(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
-    /** Update a role — gated on `identity:role:update`. */
-    updateRole(req: AuthedRequest, uuid: string, body: {
-        name?: string;
-    }): Promise<{
+    /** Rename a role — gated on `identity:role:update`. */
+    updateRole(req: AuthedRequest, uuid: string, body: unknown): Promise<{
         success: boolean;
     }>;
     /** Delete a role — gated on `identity:role:delete`. */

package/dist/features/role/role.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAM3E;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}
+{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAiBvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGH,gBAAgB,CACkB,WAAW,EAAE,MAAM,EAC1C,KAAK,EAAE,YAAY;;;;;;IAK9B,kFAAkF;IAGlF,iBAAiB,CAAiC,WAAW,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;;IAI5F;;;;;OAKG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAKjE,gGAAgG;IAGhG,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE,OAAO;;;IAMvB,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/role/role.controller.js

@@ -18,39 +18,61 @@ const guard_1 = require("@astram/guard");
 const role_service_js_1 = require("./role.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
 const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
-// Role management is gated on `identity:role:<action>` grants. `role` is CONTROL-plane
-// for ALL actions — including read: the capped root is the identity administrator (the
-// identity-administrator model), so it may list/read roles AND manage them. Update/delete
-// also pass the role-binding rule (a role used outside the caller's subtree is root-only).
+// Role management is gated on `identity:role:<action>` grants. `role` is CONTROL-plane for ALL
+// actions — including read: the capped root is the identity administrator, so it may list/read
+// roles AND manage them. G-013 (ADR-0047): every role is OWNED by one company; reads and writes are
+// walled by that owner (the role object's readScope: out of reach ⇒ 404, ownerless ⇒ root only),
+// and rename/delete also pass the owner rule (`GrantCeiling.assertRoleAdministrable`). The owner is
+// stamped server-side from the reached company (or the caller's active company on `POST /roles`),
+// never from the body. The company sub-paths are static segments declared before `roles/:uuid`;
+// this controller stays registered before `GrantAdminController`.
+/** The body's `name`, untouched (the service normalises and validates it; non-text ⇒ 400). */
+function nameFrom(body) {
+    return body?.name;
+}
 let RoleController = class RoleController {
     roles;
     constructor(roles) {
         this.roles = roles;
     }
     /**
-     * List roles — gated on `identity:role:read` (see class doc). Server-side DataTable:
-     * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` —
-     * `total` reflects the FILTERED set so the client can page the true result count.
+     * One company's own roles — `identity:role:read`. The company is reached through the walled
+     * `company` read first (404 out of reach). `?page&limit&search&sortBy&sortOrder` as `GET /roles`
+     * ⇒ `{ total, rows, page, limit }`.
+     */
+    listCompanyRoles(companyUuid, query) {
+        return this.roles.listCompanyRoles(companyUuid, query);
+    }
+    /** Create a role in a company — `identity:role:create` ⇒ 201 `{ uuid, name }`. */
+    createCompanyRole(companyUuid, body) {
+        return this.roles.createCompanyRole(companyUuid, nameFrom(body));
+    }
+    /**
+     * List roles — gated on `identity:role:read` (see class doc): the roles owned in the caller's
+     * reachable subtree (root: every role, ownerless ones included). Server-side DataTable:
+     * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` — `total`
+     * reflects the FILTERED set so the client can page the true result count.
      */
     async listRoles(query) {
         const { page, limit, params } = (0, list_query_js_1.parseListQuery)(query);
         const result = await this.roles.listRoles(params);
         return { total: result.total, rows: result.rows, page, limit };
     }
-    /** Create a role — gated on `identity:role:create`. */
+    /**
+     * Create a role in the caller's active company (else its tenant) — `identity:role:create`. Kept
+     * for existing clients; a caller with no company ⇒ 400. Any owner in the body is ignored.
+     */
     async createRole(req, body) {
-        // The owner is derived from the principal in the service; any owner in the body is ignored.
-        const id = await this.roles.createRole(body?.name ?? 'Untitled', req.principal);
+        const id = await this.roles.createRole(nameFrom(body), req.principal);
         return { id };
     }
-    /** Read one role — gated on `identity:role:read` (CONTROL-plane; root, the identity
-     *  administrator, may read roles). */
+    /** Read one role — gated on `identity:role:read`; walled by owner (404 outside the subtree). */
     getRole(uuid) {
         return this.roles.getRole(uuid);
     }
-    /** Update a role — gated on `identity:role:update`. */
+    /** Rename a role — gated on `identity:role:update`. */
     async updateRole(req, uuid, body) {
-        await this.roles.updateRole(req.principal, uuid, { name: body?.name });
+        await this.roles.updateRole(req.principal, uuid, { name: nameFrom(body) });
         return { success: true };
     }
     /** Delete a role — gated on `identity:role:delete`. */
@@ -60,6 +82,24 @@ let RoleController = class RoleController {
     }
 };
 exports.RoleController = RoleController;
+__decorate([
+    (0, common_1.Get)('companies/:companyUuid/roles'),
+    (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", void 0)
+], RoleController.prototype, "listCompanyRoles", null);
+__decorate([
+    (0, common_1.Post)('companies/:companyUuid/roles'),
+    (0, guard_1.Classified)({ typeKey: 'role', action: 'create' }),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", void 0)
+], RoleController.prototype, "createCompanyRole", null);
 __decorate([
     (0, common_1.Get)('roles'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),

package/dist/features/role/role.service.d.ts

@@ -1,18 +1,26 @@
-import { RecordsService, type RecordId } from '@astram/engine';
+import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
 import type { Principal } from '@astram/core';
-import { type ListParams } from '../shared/list-query.js';
+import { type ListParams, type ListQueryDto } from '../shared/list-query.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
 import { GrantAdminService } from '../authz/grant-admin.service.js';
 import { type PostingVersionBump } from '../membership/posting-version-bump.js';
+import { type OrgUnitNameRefusal } from '../org-structure/org-unit-name.js';
+/** The 400 of `POST /identity/roles` for a caller with no company to own the role (spec §10). */
+export declare const NO_ROLE_COMPANY = "Choose a company for the role.";
+/** The fixed, user-facing 400 text for a refused role name (the G-012 rule, spec §10). */
+export declare function roleNameMessage(reason: OrgUnitNameRefusal): string;
 /**
- * RoleService — role CRUD on the paved road, via the framework's RecordsService
- * facade. The facade supplies the acting identity (the request principal) for the pipe;
- * no raw SQL, no RECORD_ENGINE.
+ * RoleService — role CRUD on the paved road, via the framework's RecordsService facade (the engine
+ * pipe: gate, wall, validate, write, audit). No raw SQL, no RECORD_ENGINE.
  *
- * Roles are a GLOBAL catalog, so renaming or deleting one changes every tenant that uses it (a
- * delete cascades its postings). Security hardening #1 (D1 interim rule): update/delete first pass
- * `GrantCeiling.assertRoleAdministrable` — the role must be bound inside the actor's subtree and
- * nowhere outside it (a shared role is root-only). The engine's write wall still applies after.
+ * G-013 (spec §5.A, ADR-0047): every role is OWNED by one company (`ownerCompanyUuid`, immutable),
+ * stamped here from the reached company (or the caller's active company on the legacy route), never
+ * from a request body (R1). The role object's `readScope` walls every read and write by that owner
+ * (R3: out of reach ⇒ 404; an ownerless legacy row is root only, R5). Names follow the G-012 rule
+ * (`normaliseOrgUnitName`) and are unique within the owner company under the column collation; the
+ * check runs under a lock inside one transaction and the per-company unique index is the backstop
+ * (a driver 1062 ⇒ the same 409, R6). Rename and delete first pass
+ * `GrantCeiling.assertRoleAdministrable` (owner in the actor's subtree, else 404).
  */
 export declare class RoleService {
     private readonly records;
@@ -21,26 +29,55 @@ export declare class RoleService {
     private readonly grants?;
     constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined, grants?: (GrantAdminService | null) | undefined);
     /**
-     * Create a role. The owner is derived here from the actor, never from a client value: a non-root
-     * actor's role is owned by its active company (else its tenant); root's role is shared (no owner).
-     * A root-flagged actor bound to a declared operation (the org bootstrap's `roles` step, Shield #9)
-     * is anchored at the tenant it creates roles for, so its role is owned by that tenant.
-     * No actor (internal callers) ⇒ no owner field.
+     * Create a role (`POST /identity/roles`, kept for existing clients). Owner = the caller's active
+     * company, else its tenant; a caller with neither ⇒ 400 "Choose a company for the role." The
+     * company is then reached and locked exactly as {@link createCompanyRole} does.
+     *
+     * `companyUuid` is for the org bootstrap only (spec §5.E): the bound `roles` step names the
+     * DECLARING company explicitly and holds no company key (gate 7), so that company is not read or
+     * locked here; the engine's create wall checks the owner against the actor's reach, the duplicate
+     * check runs in the transaction and the unique index is the backstop.
+     */
+    createRole(rawName: unknown, actor: Principal, companyUuid?: string): Promise<RecordId>;
+    /**
+     * Create a role in `companyUuid` (`POST /identity/companies/:companyUuid/roles`): normalise the
+     * name; in one transaction lock the company, reach it through the wall (404), refuse a name the
+     * company already holds (409 naming the stored role) and create the role owned by the REACHED
+     * company. Returns `{ uuid, name }` (the stored name).
      */
-    createRole(name: string, actor?: Principal): Promise<RecordId>;
-    /** List roles (tenant-scoped by the pipe), with paging/search/sort. */
+    createCompanyRole(companyUuid: string, rawName: unknown): Promise<{
+        uuid: string;
+        name: string;
+    }>;
+    /**
+     * One company's own roles (`GET /identity/companies/:companyUuid/roles`): the company is reached
+     * through the walled read first (404 when out of reach), then its roles are listed with the same
+     * paging, search and sort allowlists as {@link listRoles}.
+     */
+    listCompanyRoles(companyUuid: string, query?: ListQueryDto): Promise<{
+        total: number;
+        rows: readonly RecordView[];
+        page: number;
+        limit: number;
+    }>;
+    /** List roles (walled by owner through the role object's readScope), with paging/search/sort. */
     listRoles(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
-    /** Read a single role. */
-    getRole(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Rename a role — only a role the actor may administer (binding rule). Patch whitelisted. */
+    /** Read a single role (walled by owner). */
+    getRole(uuid: string): Promise<RecordView | null>;
+    /**
+     * Rename a role — only a role the actor may administer (owner in reach, else 404). The name goes
+     * through the name rule (400); in one transaction the role row is locked, re-read through the wall
+     * (404; ownerless ⇒ root only), and a name another role of the same company holds is refused (409
+     * naming the stored role). The same name ⇒ no write. Only `name` is ever written.
+     */
     updateRole(actor: Principal, uuid: string, patch: {
         name?: unknown;
     }): Promise<void>;
     /**
-     * Delete a role — only a role the actor may administer (binding rule) AND whose every holder the
+     * Delete a role — only a role the actor may administer (owner rule) AND whose every holder the
      * actor dominates (Phase 8 #2: the delete cascades the holders' postings, stripping their
      * authority). In ONE transaction: lock the role row (the posting and grant paths lock the same
-     * row first), re-check the binding rule and holder dominance against what is committed now, read
+     * row first), re-check the owner rule and holder dominance against what is committed now, read
      * the holder tenants (before the cascade removes the postings), then delete. After the commit,
      * every holder tenant's permission version is bumped so cached roles drop at the next request.
      * The bump runs after the commit, never before: an earlier bump would let a session reload the
@@ -64,5 +101,23 @@ export declare class RoleService {
      * (the engine mints it), so it can never pick up anything left behind.
      */
     deleteRole(actor: Principal, uuid: string): Promise<void>;
+    private validName;
+    /** Lock the company FIRST, reach it through the wall (404), then create the role it owns. */
+    private createInCompany;
+    /** Duplicate check, then the role owned by `owner`, on the caller's transaction. */
+    private insertRole;
+    /**
+     * Refuse a name another role of the same company already holds. The engine's equality runs under
+     * the column collation (`utf8mb4_unicode_ci`: case, accents and width fold), so "manager" finds
+     * "Manager"; the 409 names the STORED clashing role.
+     */
+    private assertNameFree;
+    private findByName;
+    /**
+     * Run a create/rename; a driver duplicate key (the per-company unique index, the backstop for a
+     * concurrent write) becomes the same 409 naming the stored role. Errno only: the driver's message
+     * holds the value and is never echoed (KI #87).
+     */
+    private mappingDuplicates;
 }
 //# sourceMappingURL=role.service.d.ts.map

package/dist/features/role/role.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAe,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAK/C;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQ9D,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBhE"}
+{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EAGd,KAAK,QAAQ,EACb,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,mCAAmC,CAAC;AAK3C,iGAAiG;AACjG,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CASlE;AAmCD;;;;;;;;;;;;GAYG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD;;;;;;;;;OASG;IACG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAwB7F;;;;;OAKG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1C;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAYvF,iGAAiG;IACjG,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,4CAA4C;IAC5C,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB/D,OAAO,CAAC,SAAS;IAMjB,6FAA6F;YAC/E,eAAe;IAoB7B,oFAAoF;YACtE,UAAU;IAKxB;;;;OAIG;YACW,cAAc;YAUd,UAAU;IAWxB;;;;OAIG;YACW,iBAAiB;CAsBhC"}