@carlonicora/nestjs-neo4jsonapi 1.62.7 → 1.64.0

package/dist/foundations/rbac/dsl/perm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"perm.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/perm.ts"],"names":[],"mappings":";;;AAOA,SAAS,KAAK,CAAmB,MAAS;IACxC,MAAM,EAAE,GAAG,CAAC,IAAY,EAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAW,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAChC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAChC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAEnB,QAAA,IAAI,GAAG;IAClB,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,IAAI,EAAE;QACJ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;QAC/B,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;QACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;QACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;KACZ;CACxB,CAAC"}

package/dist/foundations/rbac/dsl/resolver.d.ts

@@ -0,0 +1,24 @@
+import { RbacMatrix } from "./types";
+/**
+ * Compute the canonical edge JSON for a given (role, module) pair.
+ * Union of module defaults and role-specific tokens, serialised.
+ * Returns undefined if the role or module is not declared.
+ */
+export declare function resolveForRole(matrix: RbacMatrix, roleId: string, moduleId: string): string | undefined;
+/**
+ * Compute the canonical defaults JSON for a module.
+ * Returns undefined if the module is not declared.
+ */
+export declare function resolveDefault(matrix: RbacMatrix, moduleId: string): string | undefined;
+/**
+ * Yield every (role, module) pair declared in the matrix.
+ */
+export declare function iterateDeclaredEdges(matrix: RbacMatrix): Iterable<{
+    roleId: string;
+    moduleId: string;
+}>;
+/**
+ * Yield every module declared in the matrix.
+ */
+export declare function iterateDeclaredModules(matrix: RbacMatrix): Iterable<string>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/foundations/rbac/dsl/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMvG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED;;GAEG;AACH,wBAAiB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQxG;AAED;;GAEG;AACH,wBAAiB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAI5E"}

package/dist/foundations/rbac/dsl/resolver.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveForRole = resolveForRole;
+exports.resolveDefault = resolveDefault;
+exports.iterateDeclaredEdges = iterateDeclaredEdges;
+exports.iterateDeclaredModules = iterateDeclaredModules;
+const to_permissions_json_1 = require("./to-permissions-json");
+/**
+ * Compute the canonical edge JSON for a given (role, module) pair.
+ * Union of module defaults and role-specific tokens, serialised.
+ * Returns undefined if the role or module is not declared.
+ */
+function resolveForRole(matrix, roleId, moduleId) {
+    const block = matrix[moduleId];
+    if (!block)
+        return undefined;
+    const roleTokens = block[roleId];
+    if (roleTokens === undefined)
+        return undefined;
+    return (0, to_permissions_json_1.toPermissionsJson)([...block.default, ...roleTokens]);
+}
+/**
+ * Compute the canonical defaults JSON for a module.
+ * Returns undefined if the module is not declared.
+ */
+function resolveDefault(matrix, moduleId) {
+    const block = matrix[moduleId];
+    if (!block)
+        return undefined;
+    return (0, to_permissions_json_1.toPermissionsJson)(block.default);
+}
+/**
+ * Yield every (role, module) pair declared in the matrix.
+ */
+function* iterateDeclaredEdges(matrix) {
+    for (const [moduleId, block] of Object.entries(matrix)) {
+        if (!block)
+            continue;
+        for (const key of Object.keys(block)) {
+            if (key === "default")
+                continue;
+            yield { roleId: key, moduleId };
+        }
+    }
+}
+/**
+ * Yield every module declared in the matrix.
+ */
+function* iterateDeclaredModules(matrix) {
+    for (const moduleId of Object.keys(matrix)) {
+        if (matrix[moduleId])
+            yield moduleId;
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/foundations/rbac/dsl/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/resolver.ts"],"names":[],"mappings":";;AAQA,wCAMC;AAMD,wCAIC;AAKD,oDAQC;AAKD,wDAIC;AA7CD,+DAA0D;AAE1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAkB,EAAE,MAAc,EAAE,QAAgB;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,IAAA,uCAAiB,EAAC,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAkB,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,IAAA,uCAAiB,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,QAAe,CAAC,CAAC,oBAAoB,CAAC,MAAkB;IACtD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,QAAe,CAAC,CAAC,sBAAsB,CAAC,MAAkB;IACxD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,QAAQ,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/foundations/rbac/dsl/to-permissions-json.d.ts

@@ -0,0 +1,13 @@
+import { PermToken } from "./types";
+/**
+ * Serialise a PermToken[] to the JSON-string shape stored on
+ * `Module.permissions` and `HAS_PERMISSIONS.permissions` edges.
+ *
+ * Format: a JSON-stringified array of `{ type: Action, value: boolean | string }`
+ * in fixed action order (read, create, update, delete).
+ *
+ * Merge rule within the input: unconditional `true` beats scoped path string;
+ * scoped path string beats default `false`. (Matches auth.repository merge.)
+ */
+export declare function toPermissionsJson(tokens: PermToken[]): string;
+//# sourceMappingURL=to-permissions-json.d.ts.map

package/dist/foundations/rbac/dsl/to-permissions-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-permissions-json.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/to-permissions-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,SAAS,EAAE,MAAM,SAAS,CAAC;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CA4B7D"}

package/dist/foundations/rbac/dsl/to-permissions-json.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPermissionsJson = toPermissionsJson;
+const types_1 = require("./types");
+/**
+ * Serialise a PermToken[] to the JSON-string shape stored on
+ * `Module.permissions` and `HAS_PERMISSIONS.permissions` edges.
+ *
+ * Format: a JSON-stringified array of `{ type: Action, value: boolean | string }`
+ * in fixed action order (read, create, update, delete).
+ *
+ * Merge rule within the input: unconditional `true` beats scoped path string;
+ * scoped path string beats default `false`. (Matches auth.repository merge.)
+ */
+function toPermissionsJson(tokens) {
+    const perAction = {
+        read: false,
+        create: false,
+        update: false,
+        delete: false,
+    };
+    for (const token of tokens) {
+        const existing = perAction[token.action];
+        const incoming = token.scope;
+        // Precedence: true > string > false
+        if (existing === true)
+            continue;
+        if (incoming === true) {
+            perAction[token.action] = true;
+            continue;
+        }
+        if (typeof existing === "string")
+            continue; // keep earlier string
+        if (typeof incoming === "string") {
+            perAction[token.action] = incoming;
+            continue;
+        }
+        // both false — no change
+    }
+    const array = types_1.ACTION_ORDER.map((action) => ({ type: action, value: perAction[action] }));
+    return JSON.stringify(array);
+}
+//# sourceMappingURL=to-permissions-json.js.map

package/dist/foundations/rbac/dsl/to-permissions-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-permissions-json.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/to-permissions-json.ts"],"names":[],"mappings":";;AAYA,8CA4BC;AAxCD,mCAA0D;AAE1D;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,MAAmB;IACnD,MAAM,SAAS,GAAqC;QAClD,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;KACd,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QAE7B,oCAAoC;QACpC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS,CAAC,sBAAsB;QAClE,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;YACnC,SAAS;QACX,CAAC;QACD,yBAAyB;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,oBAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/foundations/rbac/dsl/types.d.ts

@@ -0,0 +1,55 @@
+export type Action = "read" | "create" | "update" | "delete";
+/**
+ * A single permission token. Either unconditional (`scope: true`) or scoped to
+ * a dotted path into the frontend model (`scope: "warehouse.managedBy"`).
+ *
+ * The `M` type parameter constrains scoped paths to those valid for the
+ * module the token is declared under. Unconditional tokens are any-module
+ * (scope: true) so they have no module constraint.
+ */
+export type PermToken<PathSet extends string = string> = {
+    action: Action;
+    scope: true;
+} | {
+    action: Action;
+    scope: PathSet;
+};
+/**
+ * Permissions block for a single module in the matrix.
+ *
+ * `default` applies to every role for this module (the floor).
+ * Each role key declares *additions* on top of defaults.
+ */
+export type ModuleBlock<PathSet extends string = string> = {
+    default: PermToken<PathSet>[];
+} & Record<string, PermToken<PathSet>[]>;
+/**
+ * The full RBAC matrix.
+ *
+ * Keys are module UUIDs (values of `ModuleId`). The `ModuleUserPaths` generic
+ * constrains the key set to known modules; scoped paths are typed as `string`
+ * (not narrowed per-module), because:
+ *   1. Many modules legitimately have no BFS-discovered relationship paths, so
+ *      per-module narrowing would collapse their scope type to `never` and
+ *      reject any scoped token.
+ *   2. Self-scope paths (e.g. `"id"` on User) and attribute paths are not part
+ *      of the relationship-based `MODULE_USER_PATHS` set, but are valid at
+ *      runtime.
+ * Action names remain strictly typed.
+ */
+export type RbacMatrix<ModuleUserPaths extends Record<string, readonly string[]> = Record<string, readonly string[]>> = {
+    [M in keyof ModuleUserPaths]?: ModuleBlock<string>;
+};
+/**
+ * Effective permissions for a single role on a single module, after union of
+ * default and role-specific tokens. Matches the shape that the existing
+ * permissionQuery writes to Neo4j.
+ */
+export interface ResolvedPermissions {
+    create: boolean | string;
+    read: boolean | string;
+    update: boolean | string;
+    delete: boolean | string;
+}
+export declare const ACTION_ORDER: readonly Action[];
+//# sourceMappingURL=types.d.ts.map

package/dist/foundations/rbac/dsl/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/types.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IACjD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,UAAU,CAAC,eAAe,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,IAClH;KACG,CAAC,IAAI,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;CACnD,CAAC;AAEJ;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAAoD,CAAC"}

package/dist/foundations/rbac/dsl/types.js

@@ -0,0 +1,6 @@
+"use strict";
+// packages/nestjs-neo4jsonapi/src/foundations/rbac/dsl/types.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTION_ORDER = void 0;
+exports.ACTION_ORDER = ["read", "create", "update", "delete"];
+//# sourceMappingURL=types.js.map

package/dist/foundations/rbac/dsl/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/dsl/types.ts"],"names":[],"mappings":";AAAA,gEAAgE;;;AAyDnD,QAAA,YAAY,GAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC"}

package/dist/foundations/rbac/dump.d.ts

@@ -0,0 +1,116 @@
+import type { Driver } from "neo4j-driver";
+/**
+ * Options for {@link dumpRbacMatrix}.
+ */
+export interface DumpRbacMatrixOptions {
+    /**
+     * A connected `neo4j-driver` Driver. The function opens a single session
+     * and closes it on exit, but does NOT close the driver — the caller owns
+     * the driver lifecycle.
+     */
+    driver: Driver;
+    /**
+     * Optional database name. If omitted, the driver's default database is
+     * used. Pass this when your deployment uses a non-default database
+     * (e.g. `process.env.NEO4J_DATABASE`).
+     */
+    database?: string;
+    /**
+     * UUID → PascalCase name map for roles. The serializer emits
+     * `RoleId.<Name>` references using these names; without them, the
+     * generated file contains raw UUIDs.
+     *
+     * Typical construction from a `RoleId` enum:
+     * ```ts
+     * Object.fromEntries(Object.entries(RoleId).map(([k, v]) => [v, k]))
+     * ```
+     */
+    roleNames: Record<string, string>;
+    /**
+     * UUID → PascalCase name map for modules. Same shape and purpose as
+     * `roleNames`, applied to `ModuleId.<Name>` references in the output.
+     */
+    moduleNames: Record<string, string>;
+    /**
+     * UUID of the Administrator role. The dump writes
+     * `[RoleId.Administrator]: perm.full` for every declared module so the
+     * file matches the convention enforced by `RbacReconcilerService`
+     * (which deliberately skips Administrator edges — Admin is hardwired in
+     * code, not represented as `HAS_PERMISSIONS` edges in the DB).
+     */
+    administratorRoleId: string;
+    /**
+     * Output path for the emitted TypeScript file. Absolute, or relative to
+     * `process.cwd()`. Parent directories are created if missing.
+     *
+     * Convention: place the file under your API app's `src/rbac/` directory
+     * (e.g. `"src/rbac/permissions.ts"` when running from the api package
+     * cwd, or `"apps/api/src/rbac/permissions.ts"` from the monorepo root).
+     */
+    outputPath: string;
+}
+/**
+ * Result of {@link dumpRbacMatrix}.
+ */
+export interface DumpRbacMatrixResult {
+    /** Number of bytes written to the output file. */
+    bytesWritten: number;
+    /** Resolved absolute path that was written. */
+    path: string;
+}
+/**
+ * Read the current RBAC state from Neo4j and emit a declarative-matrix
+ * `permissions.ts` source file for the consuming app to commit.
+ *
+ * **Developer-only.** This is meant to run as a one-shot CLI step when
+ * bootstrapping a new project (or re-dumping after manual DB edits during
+ * development). Do not expose this from a runtime endpoint — production
+ * servers should never write source files.
+ *
+ * The emitted file imports `RoleId` / `ModuleId` from `@neural-erp/shared`
+ * (or whichever package you've wired into `serializeMatrixToTs`), and
+ * `perm` / `defineRbac` from `@carlonicora/nestjs-neo4jsonapi`.
+ *
+ * @example
+ * ```ts
+ * // apps/api/scripts/rbac-dump.ts
+ * import * as dotenv from "dotenv";
+ * import * as path from "path";
+ * dotenv.config({ path: path.resolve(__dirname, "../../../.env") });
+ *
+ * import neo4j from "neo4j-driver";
+ * import { RoleId, ModuleId } from "@neural-erp/shared";
+ * import { dumpRbacMatrix } from "@carlonicora/nestjs-neo4jsonapi";
+ *
+ * async function main() {
+ *   const driver = neo4j.driver(
+ *     process.env.NEO4J_URI!,
+ *     neo4j.auth.basic(process.env.NEO4J_USER!, process.env.NEO4J_PASSWORD!),
+ *   );
+ *   try {
+ *     const result = await dumpRbacMatrix({
+ *       driver,
+ *       database: process.env.NEO4J_DATABASE,
+ *       roleNames: Object.fromEntries(
+ *         Object.entries(RoleId).map(([k, v]) => [v, k]),
+ *       ),
+ *       moduleNames: Object.fromEntries(
+ *         Object.entries(ModuleId).map(([k, v]) => [v, k]),
+ *       ),
+ *       administratorRoleId: RoleId.Administrator,
+ *       outputPath: path.resolve(__dirname, "../src/rbac/permissions.ts"),
+ *     });
+ *     console.log(`Wrote ${result.bytesWritten} bytes to ${result.path}`);
+ *   } finally {
+ *     await driver.close();
+ *   }
+ * }
+ *
+ * main().catch((err) => {
+ *   console.error(err);
+ *   process.exit(1);
+ * });
+ * ```
+ */
+export declare function dumpRbacMatrix(opts: DumpRbacMatrixOptions): Promise<DumpRbacMatrixResult>;
+//# sourceMappingURL=dump.d.ts.map

package/dist/foundations/rbac/dump.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dump.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/dump.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkD/F"}

package/dist/foundations/rbac/dump.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dumpRbacMatrix = dumpRbacMatrix;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const matrix_to_ts_1 = require("./serializer/matrix-to-ts");
+/**
+ * Read the current RBAC state from Neo4j and emit a declarative-matrix
+ * `permissions.ts` source file for the consuming app to commit.
+ *
+ * **Developer-only.** This is meant to run as a one-shot CLI step when
+ * bootstrapping a new project (or re-dumping after manual DB edits during
+ * development). Do not expose this from a runtime endpoint — production
+ * servers should never write source files.
+ *
+ * The emitted file imports `RoleId` / `ModuleId` from `@neural-erp/shared`
+ * (or whichever package you've wired into `serializeMatrixToTs`), and
+ * `perm` / `defineRbac` from `@carlonicora/nestjs-neo4jsonapi`.
+ *
+ * @example
+ * ```ts
+ * // apps/api/scripts/rbac-dump.ts
+ * import * as dotenv from "dotenv";
+ * import * as path from "path";
+ * dotenv.config({ path: path.resolve(__dirname, "../../../.env") });
+ *
+ * import neo4j from "neo4j-driver";
+ * import { RoleId, ModuleId } from "@neural-erp/shared";
+ * import { dumpRbacMatrix } from "@carlonicora/nestjs-neo4jsonapi";
+ *
+ * async function main() {
+ *   const driver = neo4j.driver(
+ *     process.env.NEO4J_URI!,
+ *     neo4j.auth.basic(process.env.NEO4J_USER!, process.env.NEO4J_PASSWORD!),
+ *   );
+ *   try {
+ *     const result = await dumpRbacMatrix({
+ *       driver,
+ *       database: process.env.NEO4J_DATABASE,
+ *       roleNames: Object.fromEntries(
+ *         Object.entries(RoleId).map(([k, v]) => [v, k]),
+ *       ),
+ *       moduleNames: Object.fromEntries(
+ *         Object.entries(ModuleId).map(([k, v]) => [v, k]),
+ *       ),
+ *       administratorRoleId: RoleId.Administrator,
+ *       outputPath: path.resolve(__dirname, "../src/rbac/permissions.ts"),
+ *     });
+ *     console.log(`Wrote ${result.bytesWritten} bytes to ${result.path}`);
+ *   } finally {
+ *     await driver.close();
+ *   }
+ * }
+ *
+ * main().catch((err) => {
+ *   console.error(err);
+ *   process.exit(1);
+ * });
+ * ```
+ */
+async function dumpRbacMatrix(opts) {
+    const session = opts.driver.session(opts.database ? { database: opts.database } : undefined);
+    try {
+        const modulesResult = await session.run(`MATCH (m:Module) RETURN m.id AS id, m.permissions AS permissions`);
+        const edgesResult = await session.run(`MATCH (r:Role)-[p:HAS_PERMISSIONS]->(m:Module) RETURN r.id AS roleId, m.id AS moduleId, p.permissions AS permissions`);
+        const matrix = {};
+        for (const rec of modulesResult.records) {
+            const moduleId = rec.get("id");
+            const permissions = rec.get("permissions");
+            if (!moduleId)
+                continue;
+            matrix[moduleId] = { default: deserialize(permissions), ...(matrix[moduleId] ?? {}) };
+        }
+        for (const rec of edgesResult.records) {
+            const roleId = rec.get("roleId");
+            const moduleId = rec.get("moduleId");
+            const permissions = rec.get("permissions");
+            if (!matrix[moduleId])
+                matrix[moduleId] = { default: [] };
+            matrix[moduleId][roleId] = deltaFromDefault(deserialize(permissions), matrix[moduleId].default);
+        }
+        // Administrator gets perm.full on every declared module — matches the
+        // reconciler's "Administrator edges are never managed" convention.
+        for (const moduleId of Object.keys(matrix)) {
+            matrix[moduleId][opts.administratorRoleId] = [
+                { action: "read", scope: true },
+                { action: "create", scope: true },
+                { action: "update", scope: true },
+                { action: "delete", scope: true },
+            ];
+        }
+        const source = await (0, matrix_to_ts_1.serializeMatrixToTs)(matrix, {
+            roleNames: opts.roleNames,
+            moduleNames: opts.moduleNames,
+        });
+        const outPath = path.isAbsolute(opts.outputPath) ? opts.outputPath : path.resolve(process.cwd(), opts.outputPath);
+        fs.mkdirSync(path.dirname(outPath), { recursive: true });
+        fs.writeFileSync(outPath, source);
+        return { bytesWritten: Buffer.byteLength(source), path: outPath };
+    }
+    finally {
+        await session.close();
+    }
+}
+function deserialize(raw) {
+    if (!raw)
+        return [];
+    const arr = JSON.parse(raw);
+    return arr
+        .filter((e) => e.value !== false)
+        .map((e) => ({
+        action: e.type,
+        scope: e.value === true ? true : e.value,
+    }));
+}
+function deltaFromDefault(effective, defaults) {
+    // Naive shallow comparison — sufficient because tokens are flat
+    // {action, scope} records.
+    return effective.filter((e) => !defaults.some((d) => d.action === e.action && d.scope === e.scope));
+}
+//# sourceMappingURL=dump.js.map

package/dist/foundations/rbac/dump.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dump.js","sourceRoot":"","sources":["../../../src/foundations/rbac/dump.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8HA,wCAkDC;AAhLD,uCAAyB;AACzB,2CAA6B;AAG7B,4DAAgE;AAoEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACI,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAC5G,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,sHAAsH,CACvH,CAAC;QAEF,MAAM,MAAM,GAAe,EAAE,CAAC;QAE9B,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,WAAW,GAAkB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxF,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,WAAW,GAAkB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC1D,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAE,CAAC,OAAO,CAAC,CAAC;QACpG,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG;gBAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC/B,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;gBACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;gBACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;aAClC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAmB,EAAC,MAAM,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAElH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAElC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAC;IAChF,OAAO,GAAG;SACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,IAAc;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,KAAgB;KACrD,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAsB,EAAE,QAAqB;IACrE,gEAAgE;IAChE,2BAA2B;IAC3B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACtG,CAAC"}

package/dist/foundations/rbac/index.d.ts

@@ -4,4 +4,10 @@ export { permissionMappingMeta } from "./entities/permission-mapping.meta";
 export { modulePathsMeta } from "./entities/module-paths.meta";
 export type { PermissionMapping } from "./entities/permission-mapping.entity";
 export type { ModuleRelationshipPaths } from "./entities/module-paths.entity";
+export { perm, defineRbac, toPermissionsJson } from "./dsl";
+export { resolveForRole, resolveDefault, iterateDeclaredEdges, iterateDeclaredModules } from "./dsl";
+export { ACTION_ORDER } from "./dsl";
+export type { PermToken, ModuleBlock, RbacMatrix, ResolvedPermissions } from "./dsl";
+export { dumpRbacMatrix } from "./dump";
+export type { DumpRbacMatrixOptions, DumpRbacMatrixResult } from "./dump";
 //# sourceMappingURL=index.d.ts.map

package/dist/foundations/rbac/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAI9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAKrF,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC"}

package/dist/foundations/rbac/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.modulePathsMeta = exports.permissionMappingMeta = exports.MODULE_USER_PATHS_TOKEN = exports.RbacModule = void 0;
+exports.dumpRbacMatrix = exports.ACTION_ORDER = exports.iterateDeclaredModules = exports.iterateDeclaredEdges = exports.resolveDefault = exports.resolveForRole = exports.toPermissionsJson = exports.defineRbac = exports.perm = exports.modulePathsMeta = exports.permissionMappingMeta = exports.MODULE_USER_PATHS_TOKEN = exports.RbacModule = void 0;
 var rbac_module_1 = require("./rbac.module");
 Object.defineProperty(exports, "RbacModule", { enumerable: true, get: function () { return rbac_module_1.RbacModule; } });
 var rbac_constants_1 = require("./rbac.constants");
@@ -9,4 +9,26 @@ var permission_mapping_meta_1 = require("./entities/permission-mapping.meta");
 Object.defineProperty(exports, "permissionMappingMeta", { enumerable: true, get: function () { return permission_mapping_meta_1.permissionMappingMeta; } });
 var module_paths_meta_1 = require("./entities/module-paths.meta");
 Object.defineProperty(exports, "modulePathsMeta", { enumerable: true, get: function () { return module_paths_meta_1.modulePathsMeta; } });
+// RBAC DSL — re-export explicitly to avoid `Action` collision with
+// `common/enums/action.ts` at the library root.
+var dsl_1 = require("./dsl");
+Object.defineProperty(exports, "perm", { enumerable: true, get: function () { return dsl_1.perm; } });
+Object.defineProperty(exports, "defineRbac", { enumerable: true, get: function () { return dsl_1.defineRbac; } });
+Object.defineProperty(exports, "toPermissionsJson", { enumerable: true, get: function () { return dsl_1.toPermissionsJson; } });
+var dsl_2 = require("./dsl");
+Object.defineProperty(exports, "resolveForRole", { enumerable: true, get: function () { return dsl_2.resolveForRole; } });
+Object.defineProperty(exports, "resolveDefault", { enumerable: true, get: function () { return dsl_2.resolveDefault; } });
+Object.defineProperty(exports, "iterateDeclaredEdges", { enumerable: true, get: function () { return dsl_2.iterateDeclaredEdges; } });
+Object.defineProperty(exports, "iterateDeclaredModules", { enumerable: true, get: function () { return dsl_2.iterateDeclaredModules; } });
+var dsl_3 = require("./dsl");
+Object.defineProperty(exports, "ACTION_ORDER", { enumerable: true, get: function () { return dsl_3.ACTION_ORDER; } });
+// Developer-only one-shot tool to read the current DB state and emit a
+// declarative `permissions.ts` source file. CLI use only — see the JSDoc
+// on `dumpRbacMatrix` for the canonical script template.
+var dump_1 = require("./dump");
+Object.defineProperty(exports, "dumpRbacMatrix", { enumerable: true, get: function () { return dump_1.dumpRbacMatrix; } });
+// Note: the DSL's `Action` string-literal union is intentionally not re-exported
+// from the library root; `common/enums/action.ts` already exports an `Action`
+// enum with the same string values. Deep consumers can import it via
+// `@carlonicora/nestjs-neo4jsonapi/foundations/rbac/dsl` if needed.
 //# sourceMappingURL=index.js.map

package/dist/foundations/rbac/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAC9B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAC9B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAIxB,mEAAmE;AACnE,gDAAgD;AAChD,6BAA4D;AAAnD,2FAAA,IAAI,OAAA;AAAE,iGAAA,UAAU,OAAA;AAAE,wGAAA,iBAAiB,OAAA;AAC5C,6BAAqG;AAA5F,qGAAA,cAAc,OAAA;AAAE,qGAAA,cAAc,OAAA;AAAE,2GAAA,oBAAoB,OAAA;AAAE,6GAAA,sBAAsB,OAAA;AACrF,6BAAqC;AAA5B,mGAAA,YAAY,OAAA;AAGrB,uEAAuE;AACvE,yEAAyE;AACzE,yDAAyD;AACzD,+BAAwC;AAA/B,sGAAA,cAAc,OAAA;AAEvB,iFAAiF;AACjF,8EAA8E;AAC9E,qEAAqE;AACrE,oEAAoE"}

package/dist/foundations/rbac/rbac.module.d.ts

@@ -1,7 +1,10 @@
 import { DynamicModule } from "@nestjs/common";
+import type { RbacMatrix } from "./dsl/types";
 export declare class RbacModule {
     static register(options: {
-        moduleUserPaths: Record<string, string[]>;
+        moduleUserPaths: Record<string, readonly string[]>;
+        rbac?: RbacMatrix;
+        devMode?: boolean;
     }): DynamicModule;
 }
 //# sourceMappingURL=rbac.module.d.ts.map

package/dist/foundations/rbac/rbac.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AASvD,qBACa,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,GAAG,aAAa;CAiBvF"}
+{"version":3,"file":"rbac.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA0B,MAAM,gBAAgB,CAAC;AAUvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,qBACa,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;QACvB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,aAAa;CA6BlB"}

package/dist/foundations/rbac/rbac.module.js

@@ -13,24 +13,38 @@ const rbac_controller_1 = require("./controllers/rbac.controller");
 const rbac_module_paths_controller_1 = require("./controllers/rbac-module-paths.controller");
 const rbac_repository_1 = require("./repositories/rbac.repository");
 const rbac_service_1 = require("./services/rbac.service");
+const rbac_reconciler_service_1 = require("./services/rbac-reconciler.service");
 const permission_mapping_serialiser_1 = require("./serialisers/permission-mapping.serialiser");
 const module_paths_serialiser_1 = require("./serialisers/module-paths.serialiser");
 const rbac_constants_1 = require("./rbac.constants");
+const rbac_tokens_1 = require("./rbac.tokens");
+const rbac_dev_controller_1 = require("./controllers/rbac-dev.controller");
+const conditional_service_decorator_1 = require("../../common/decorators/conditional-service.decorator");
 let RbacModule = RbacModule_1 = class RbacModule {
     static register(options) {
+        const providers = [
+            rbac_repository_1.RbacRepository,
+            rbac_service_1.RbacService,
+            permission_mapping_serialiser_1.PermissionMappingSerialiser,
+            module_paths_serialiser_1.ModulePathsSerialiser,
+            (0, conditional_service_decorator_1.createWorkerProvider)(rbac_reconciler_service_1.RbacReconcilerService),
+            {
+                provide: rbac_constants_1.MODULE_USER_PATHS_TOKEN,
+                useValue: options.moduleUserPaths,
+            },
+            {
+                provide: rbac_tokens_1.RBAC_MATRIX_TOKEN,
+                useValue: options.rbac ?? null,
+            },
+        ];
+        const controllers = [rbac_controller_1.RbacController, rbac_module_paths_controller_1.RbacModulePathsController];
+        if (options.devMode) {
+            controllers.push(rbac_dev_controller_1.RbacDevController);
+        }
         return {
             module: RbacModule_1,
-            controllers: [rbac_controller_1.RbacController, rbac_module_paths_controller_1.RbacModulePathsController],
-            providers: [
-                rbac_repository_1.RbacRepository,
-                rbac_service_1.RbacService,
-                permission_mapping_serialiser_1.PermissionMappingSerialiser,
-                module_paths_serialiser_1.ModulePathsSerialiser,
-                {
-                    provide: rbac_constants_1.MODULE_USER_PATHS_TOKEN,
-                    useValue: options.moduleUserPaths,
-                },
-            ],
+            controllers,
+            providers,
             exports: [rbac_service_1.RbacService],
         };
     }