@carlonicora/nestjs-neo4jsonapi 6.6.1 → 6.7.0

package/dist/agents/operator/controllers/operator.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator.controller.d.ts","sourceRoot":"","sources":["../../../../src/agents/operator/controllers/operator.controller.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAoB,wBAAwB,EAAgC,MAAM,wBAAwB,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAIhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0DAA0D,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAC;AAI1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAE7F,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,6DAA6D,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAEa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;OAKG;IACmC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAGvE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAd9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAG3C,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,cAAc;IACxC;;;;;OAKG;IACoD,eAAe,CAAC,EAAE,wBAAwB,EAGhF,0BAA0B,CAAC,EAAE,wBAAwB;IAGxE,4FAA4F;IAC5F,OAAO,KAAK,IAAI,GAEf;IAED;;;;;;;OAOG;IAEG,MAAM,CAAS,IAAI,EAAE,gBAAgB,EAAS,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8C9G;;;;;OAKG;IAEG,MAAM,CACY,WAAW,EAAE,MAAM,EACjC,IAAI,EAAE,kBAAkB,EACzB,GAAG,EAAE,oBAAoB,GAC/B,OAAO,CAAC,mBAAmB,CAAC;CAkChC"}
+{"version":3,"file":"operator.controller.d.ts","sourceRoot":"","sources":["../../../../src/agents/operator/controllers/operator.controller.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAoB,wBAAwB,EAAgC,MAAM,wBAAwB,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAIhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0DAA0D,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAC;AAI1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAE7F,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,6DAA6D,CAAC;AAIrE;;;;;;;;GAQG;AACH,qBAGa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;OAKG;IACmC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAGvE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAd9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAG3C,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,cAAc;IACxC;;;;;OAKG;IACoD,eAAe,CAAC,EAAE,wBAAwB,EAGhF,0BAA0B,CAAC,EAAE,wBAAwB;IAGxE,4FAA4F;IAC5F,OAAO,KAAK,IAAI,GAEf;IAED;;;;;;;OAOG;IAEG,MAAM,CAAS,IAAI,EAAE,gBAAgB,EAAS,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8C9G;;;;;OAKG;IAEG,MAAM,CACY,WAAW,EAAE,MAAM,EACjC,IAAI,EAAE,kBAAkB,EACzB,GAAG,EAAE,oBAAoB,GAC/B,OAAO,CAAC,mBAAmB,CAAC;CAkChC"}

package/dist/agents/operator/controllers/operator.controller.js

@@ -30,6 +30,8 @@ const assistant_meta_1 = require("../../../foundations/assistant/entities/assist
 const assistant_controller_1 = require("../../../foundations/assistant/controllers/assistant.controller");
 const assistant_service_1 = require("../../../foundations/assistant/services/assistant.service");
 const operator_meta_1 = require("../entities/operator.meta");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const core_module_ids_1 = require("../../../common/constants/core-module.ids");
 /**
  * Standalone HTTP surface for the checkpointed operator engine.
  *
@@ -159,6 +161,7 @@ __decorate([
 ], OperatorController.prototype, "append", null);
 exports.OperatorController = OperatorController = OperatorController_1 = __decorate([
     (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, module_decorator_1.ModuleACL)({ module: core_module_ids_1.CoreModuleId.Assistant }),
     (0, common_1.Controller)(),
     __param(2, (0, common_1.Optional)()),
     __param(2, (0, common_1.Inject)(tokens_1.CREDIT_VALIDATOR)),

package/dist/agents/operator/controllers/operator.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator.controller.js","sourceRoot":"","sources":["../../../../src/agents/operator/controllers/operator.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,0EAAqE;AACrE,yEAA4E;AAC5E,qEAA+F;AAE/F,mDAAkH;AAClH,oFAAgF;AAChF,sGAA4G;AAC5G,yGAA+G;AAC/G,mHAA8G;AAC9G,mGAA8F;AAC9F,+FAA0F;AAC1F,iFAAwF;AACxF,2FAAuF;AACvF,0GAAgG;AAChG,iGAA6F;AAC7F,6DAAyD;AAMzD;;;;;;;;GAQG;AAGI,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAG7B,YACmB,UAA4B,EAC5B,OAAuB,EAOF,eAA2D,EAGjG,0BAAsE;QAXrD,eAAU,GAAV,UAAU,CAAkB;QAC5B,YAAO,GAAP,OAAO,CAAgB;QAOe,oBAAe,GAAf,eAAe,CAA2B;QAGhF,+BAA0B,GAA1B,0BAA0B,CAA2B;QAdvD,WAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAe3D,CAAC;IAEJ,4FAA4F;IAC5F,IAAY,IAAI;QACd,OAAO,IAAA,sCAAwB,EAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAsB,EAAS,GAAyB;QAC3E,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,IAAA,4BAAc,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEzG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAA,mCAAmB,EAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,kBAAkB,GAAG,CAAC,IAAI,CAAC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,SAAS,oBAAoB,OAAO,CAAC,MAAM,EAAE;YACnG,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,GACnE,MAAM,IAAI,CAAC,UAAU,CAAC,8BAA8B,CAAC;YACnD,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACvB,YAAY,EAAE,OAAO;YACrB,KAAK;YACL,SAAS;YACT,cAAc;YACd,YAAY;SACb,CAAC,CAAC;QACL,MAAM,QAAQ,GAA0B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,+BAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7G,MAAM,WAAW,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,8CAA0B,CAAC,KAAK,EAAE;YACtG,WAAW;YACX,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAc,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5F,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA0B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4CAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjH,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,QAAQ,GAAG,IAAA,oCAAa,EAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE;YAC9D,IAAI,EAAE,8BAAa,CAAC,IAAI;YACxB,EAAE,EAAE,SAAS,CAAC,EAAE;SACjB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,MAAM,CACY,WAAmB,EACjC,IAAwB,EACzB,GAAyB;QAEhC,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,IAAA,4BAAc,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEzG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,WAAW,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7G,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACvG,WAAW;YACX,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACvB,UAAU,EAAE,OAAO;YACnB,SAAS;YACT,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,8CAA0B,CAAC,KAAK,EAAE;YACnG,WAAW;YACX,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA0B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4CAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjH,wDAAwD;YACxD,wEAAwE;YACxE,QAAQ,CAAC,QAAQ,GAAG,IAAA,oCAAa,EAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACrE,IAAI,EAAE,8BAAa,CAAC,IAAI;gBACxB,EAAE,EAAE,WAAW;aAChB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAA;AA3HY,gDAAkB;AAgCvB;IADL,IAAA,aAAI,EAAC,4BAAY,CAAC,QAAQ,CAAC;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;IAA0B,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAAxB,qCAAgB;;gDA4C1C;AASK;IADL,IAAA,aAAI,EAAC,GAAG,4BAAY,CAAC,QAAQ,iBAAiB,6CAAoB,CAAC,QAAQ,EAAE,CAAC;IAE5E,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,yCAAkB;;gDAmCjC;6BA1HU,kBAAkB;IAF9B,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,mBAAU,GAAE;IAaR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,yBAAgB,CAAC,CAAA;IACpC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qCAA4B,CAAC,CAAA;qCAVR,oCAAgB;QACnB,gCAAc;GAL/B,kBAAkB,CA2H9B"}
+{"version":3,"file":"operator.controller.js","sourceRoot":"","sources":["../../../../src/agents/operator/controllers/operator.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,0EAAqE;AACrE,yEAA4E;AAC5E,qEAA+F;AAE/F,mDAAkH;AAClH,oFAAgF;AAChF,sGAA4G;AAC5G,yGAA+G;AAC/G,mHAA8G;AAC9G,mGAA8F;AAC9F,+FAA0F;AAC1F,iFAAwF;AACxF,2FAAuF;AACvF,0GAAgG;AAChG,iGAA6F;AAC7F,6DAAyD;AAKzD,kFAAwE;AACxE,+EAAyE;AAEzE;;;;;;;;GAQG;AAII,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAG7B,YACmB,UAA4B,EAC5B,OAAuB,EAOF,eAA2D,EAGjG,0BAAsE;QAXrD,eAAU,GAAV,UAAU,CAAkB;QAC5B,YAAO,GAAP,OAAO,CAAgB;QAOe,oBAAe,GAAf,eAAe,CAA2B;QAGhF,+BAA0B,GAA1B,0BAA0B,CAA2B;QAdvD,WAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAe3D,CAAC;IAEJ,4FAA4F;IAC5F,IAAY,IAAI;QACd,OAAO,IAAA,sCAAwB,EAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAsB,EAAS,GAAyB;QAC3E,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,IAAA,4BAAc,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEzG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAA,mCAAmB,EAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,kBAAkB,GAAG,CAAC,IAAI,CAAC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,SAAS,oBAAoB,OAAO,CAAC,MAAM,EAAE;YACnG,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,GACnE,MAAM,IAAI,CAAC,UAAU,CAAC,8BAA8B,CAAC;YACnD,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACvB,YAAY,EAAE,OAAO;YACrB,KAAK;YACL,SAAS;YACT,cAAc;YACd,YAAY;SACb,CAAC,CAAC;QACL,MAAM,QAAQ,GAA0B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,+BAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7G,MAAM,WAAW,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,8CAA0B,CAAC,KAAK,EAAE;YACtG,WAAW;YACX,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAc,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5F,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA0B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4CAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjH,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,QAAQ,GAAG,IAAA,oCAAa,EAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE;YAC9D,IAAI,EAAE,8BAAa,CAAC,IAAI;YACxB,EAAE,EAAE,SAAS,CAAC,EAAE;SACjB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,MAAM,CACY,WAAmB,EACjC,IAAwB,EACzB,GAAyB;QAEhC,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,IAAA,4BAAc,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEzG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,WAAW,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7G,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACvG,WAAW;YACX,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACvB,UAAU,EAAE,OAAO;YACnB,SAAS;YACT,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,8CAA0B,CAAC,KAAK,EAAE;YACnG,WAAW;YACX,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAA0B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4CAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjH,wDAAwD;YACxD,wEAAwE;YACxE,QAAQ,CAAC,QAAQ,GAAG,IAAA,oCAAa,EAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACrE,IAAI,EAAE,8BAAa,CAAC,IAAI;gBACxB,EAAE,EAAE,WAAW;aAChB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAA;AA3HY,gDAAkB;AAgCvB;IADL,IAAA,aAAI,EAAC,4BAAY,CAAC,QAAQ,CAAC;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;IAA0B,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAAxB,qCAAgB;;gDA4C1C;AASK;IADL,IAAA,aAAI,EAAC,GAAG,4BAAY,CAAC,QAAQ,iBAAiB,6CAAoB,CAAC,QAAQ,EAAE,CAAC;IAE5E,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,yCAAkB;;gDAmCjC;6BA1HU,kBAAkB;IAH9B,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,4BAAS,EAAC,EAAE,MAAM,EAAE,8BAAY,CAAC,SAAS,EAAE,CAAC;IAC7C,IAAA,mBAAU,GAAE;IAaR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,yBAAgB,CAAC,CAAA;IACpC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qCAA4B,CAAC,CAAA;qCAVR,oCAAgB;QACnB,gCAAc;GAL/B,kBAAkB,CA2H9B"}

package/dist/bootstrap/app.module.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.module.factory.d.ts","sourceRoot":"","sources":["../../src/bootstrap/app.module.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAsB7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAwJpE"}
+{"version":3,"file":"app.module.factory.d.ts","sourceRoot":"","sources":["../../src/bootstrap/app.module.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAwB7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAgKpE"}

package/dist/bootstrap/app.module.factory.js

@@ -59,6 +59,8 @@ const app_mode_module_1 = require("../core/appmode/app.mode.module");
 const core_module_1 = require("../core/core.module");
 const foundations_modules_1 = require("../foundations/foundations.modules");
 const mcp_module_1 = require("../mcp/mcp.module");
+const rbac_permission_module_1 = require("../foundations/rbac/rbac-permission.module");
+const rbac_tokens_1 = require("../foundations/rbac/rbac.tokens");
 const openapi_module_1 = require("../openapi/module/openapi.module");
 /**
  * Creates a dynamic AppModule based on bootstrap options.
@@ -168,6 +170,9 @@ function createAppModule(options) {
                                 exclude: options.foundations?.exclude ?? [],
                             }),
                         ]),
+                    // Permission resolution + request gate + boot audit (global: the session
+                    // guards inject the gate). Inert while `permissions.enforce` is off.
+                    rbac_permission_module_1.RbacPermissionModule,
                     // Library's AI agents (prompts configured via baseConfig.prompts)
                     ...(options.agents === false ? [] : [agents_modules_1.AgentsModule]),
                     // MCP (Model Context Protocol) server (opt-in, default off)
@@ -206,7 +211,11 @@ function createAppModule(options) {
                     // Global rate-limit enforcement (adds X-RateLimit-* headers). Only
                     // registered when rateLimit.enabled — apps no longer wire this themselves.
                     ...(rateLimitEnabled ? [{ provide: core_1.APP_GUARD, useClass: custom_throttler_guard_1.CustomThrottlerGuard }] : []),
+                    // Bootstrap option `permissions.enforce`, read by the gate, the boot
+                    // audit, RbacPermissionService and RbacReconcilerService.
+                    { provide: rbac_tokens_1.PERMISSIONS_ENFORCE, useValue: options.permissions?.enforce === true },
                 ],
+                exports: [rbac_tokens_1.PERMISSIONS_ENFORCE],
             };
         }
     };

package/dist/bootstrap/app.module.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.module.factory.js","sourceRoot":"","sources":["../../src/bootstrap/app.module.factory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,0CAwJC;AAjMD,2CAA6D;AAC7D,2CAA6D;AAC7D,uCAAyC;AACzC,yDAA2D;AAC3D,+CAAkD;AAClD,iDAAoD;AACpD,2CAA+C;AAC/C,mCAAsC;AACtC,2CAAuC;AACvC,6CAAgG;AAChG,2CAA6B;AAE7B,6DAAwD;AACxD,oFAA+E;AAC/E,sCAA8G;AAC9G,0EAAsE;AACtE,qEAAgE;AAEhE,qDAAiD;AACjD,4EAAuE;AACvE,kDAA8C;AAC9C,qEAAiE;AAGjE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,eAAe,CAAC,OAAyB;;IAEvD,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;QACtB,MAAM,CAAC,OAAO,CAAC,UAAyB;YACtC,6EAA6E;YAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;YAEvD,8EAA8E;YAC9E,8EAA8E;YAC9E,yEAAyE;YACzE,MAAM,gBAAgB,GAAI,EAAE,GAAG,mBAAU,EAAE,GAAG,SAAS,EAA0B,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC;YAE9G,+CAA+C;YAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,mBAAU,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,mBAAU,CAAC;YAEjG,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI;gBACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;oBACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;YAE1C,OAAO;gBACL,MAAM,EAAE,oBAAkB;gBAC1B,OAAO,EAAE;oBACP,iCAAiC;oBACjC,kCAAkB,CAAC,OAAO,EAAE;oBAE5B,yCAAyC;oBACzC,+BAAa,CAAC,OAAO,CAAC,UAAU,CAAC;oBAEjC,8BAA8B;oBAC9B,qBAAY,CAAC,OAAO,CAAC;wBACnB,IAAI,EAAE,CAAC,YAAY,CAAC;wBACpB,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,IAAI;qBACZ,CAAC;oBAEF,kDAAkD;oBAClD,2BAAe,CAAC,YAAY,CAAC;wBAC3B,OAAO,EAAE,CAAC,qBAAY,CAAC;wBACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;wBACvB,UAAU,EAAE,CAAC,MAA0C,EAAE,EAAE;4BACzD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAA2B,WAAW,CAAC,CAAC;4BACpE,OAAO;gCACL,UAAU,EAAE;oCACV,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;oCAC/D,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE;iCAC7D;6BACF,CAAC;wBACJ,CAAC;qBACF,CAAC;oBAEF,0BAA0B;oBAC1B,sBAAS,CAAC,OAAO,CAAC;wBAChB,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE;qBACpD,CAAC;oBAEF,gCAAgC;oBAChC,wBAAU,CAAC,OAAO,CAAC;wBACjB,gBAAgB,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,IAAI,IAAI;wBACxD,OAAO,EAAE,KAAK;wBACd,aAAa,EAAE;4BACb,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,IAAI;yBACZ;wBACD,SAAS,EAAE;4BACT,EAAE,GAAG,EAAE,2BAAa,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;4BACxD,IAAI,4BAAc,CAAC,CAAC,YAAY,CAAC,CAAC;4BAClC,oCAAsB;yBACvB;qBACF,CAAC;oBAEF,sDAAsD;oBACtD,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,yBAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAEhE,wCAAwC;oBACxC,wBAAU,CAAC,OAAO,CAAC;wBACjB,QAAQ;wBACR,eAAe,EAAE,OAAO,CAAC,eAAe;wBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC,CAAC;oBAEF,qFAAqF;oBACrF,mFAAmF;oBACnF,4FAA4F;oBAC5F,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ;wBAC/B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,uCAAiB,CAAC,OAAO,CAAC;gCACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gCAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gCAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gCAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gCAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gCACpB,eAAe,EAAE,OAAO,CAAC,eAAe;gCACxC,SAAS,EAAE,OAAO,CAAC,SAAS;gCAC5B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE;6BAC5C,CAAC;yBACH,CAAC;oBAEN,kEAAkE;oBAClE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,6BAAY,CAAC,CAAC;oBAEnD,4DAA4D;oBAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAE5C,iDAAiD;oBACjD,8BAAa;oBAEb,4FAA4F;oBAC5F,GAAG,OAAO,CAAC,UAAU;oBAErB,6DAA6D;oBAC7D,gFAAgF;oBAChF,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,mBAAU,CAAC,OAAO,CAAC,KAAK;wBACvD,CAAC,CAAC;4BACE,qBAAY,CAAC,YAAY,CAAC;gCACxB,OAAO,EAAE,CAAC,qBAAY,CAAC;gCACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;gCACvB,UAAU,EAAE,CAAC,MAA0C,EAAE,EAAE;oCACzD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAyB,SAAS,CAAC,CAAC;oCAC9D,OAAO;wCACL,KAAK,EAAE,OAAO,CAAC,KAAK;wCACpB,OAAO,EAAE;4CACP,8BAAiB,CAAC,MAAM;4CACxB,8BAAiB,CAAC,aAAa;4CAC/B,8BAAiB,CAAC,gBAAgB;yCACnC;wCACD,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK;qCAC/D,CAAC;gCACJ,CAAC;6BACF,CAAC;4BACF,8BAAa;yBACd;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,EAAE;gBACf,SAAS,EAAE;oBACT,mEAAmE;oBACnE,2EAA2E;oBAC3E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,6CAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF;aACF,CAAC;QACJ,CAAC;KACF,CAAA;IAnJK,kBAAkB;QADvB,IAAA,eAAM,EAAC,EAAE,CAAC;OACL,kBAAkB,CAmJvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"app.module.factory.js","sourceRoot":"","sources":["../../src/bootstrap/app.module.factory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,0CAgKC;AA3MD,2CAA6D;AAC7D,2CAA6D;AAC7D,uCAAyC;AACzC,yDAA2D;AAC3D,+CAAkD;AAClD,iDAAoD;AACpD,2CAA+C;AAC/C,mCAAsC;AACtC,2CAAuC;AACvC,6CAAgG;AAChG,2CAA6B;AAE7B,6DAAwD;AACxD,oFAA+E;AAC/E,sCAA8G;AAC9G,0EAAsE;AACtE,qEAAgE;AAEhE,qDAAiD;AACjD,4EAAuE;AACvE,kDAA8C;AAC9C,uFAAkF;AAClF,iEAAsE;AACtE,qEAAiE;AAGjE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,eAAe,CAAC,OAAyB;;IAEvD,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;QACtB,MAAM,CAAC,OAAO,CAAC,UAAyB;YACtC,6EAA6E;YAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;YAEvD,8EAA8E;YAC9E,8EAA8E;YAC9E,yEAAyE;YACzE,MAAM,gBAAgB,GAAI,EAAE,GAAG,mBAAU,EAAE,GAAG,SAAS,EAA0B,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC;YAE9G,+CAA+C;YAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,mBAAU,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,mBAAU,CAAC;YAEjG,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI;gBACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;oBACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;YAE1C,OAAO;gBACL,MAAM,EAAE,oBAAkB;gBAC1B,OAAO,EAAE;oBACP,iCAAiC;oBACjC,kCAAkB,CAAC,OAAO,EAAE;oBAE5B,yCAAyC;oBACzC,+BAAa,CAAC,OAAO,CAAC,UAAU,CAAC;oBAEjC,8BAA8B;oBAC9B,qBAAY,CAAC,OAAO,CAAC;wBACnB,IAAI,EAAE,CAAC,YAAY,CAAC;wBACpB,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,IAAI;qBACZ,CAAC;oBAEF,kDAAkD;oBAClD,2BAAe,CAAC,YAAY,CAAC;wBAC3B,OAAO,EAAE,CAAC,qBAAY,CAAC;wBACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;wBACvB,UAAU,EAAE,CAAC,MAA0C,EAAE,EAAE;4BACzD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAA2B,WAAW,CAAC,CAAC;4BACpE,OAAO;gCACL,UAAU,EAAE;oCACV,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;oCAC/D,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE;iCAC7D;6BACF,CAAC;wBACJ,CAAC;qBACF,CAAC;oBAEF,0BAA0B;oBAC1B,sBAAS,CAAC,OAAO,CAAC;wBAChB,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE;qBACpD,CAAC;oBAEF,gCAAgC;oBAChC,wBAAU,CAAC,OAAO,CAAC;wBACjB,gBAAgB,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,IAAI,IAAI;wBACxD,OAAO,EAAE,KAAK;wBACd,aAAa,EAAE;4BACb,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,IAAI;yBACZ;wBACD,SAAS,EAAE;4BACT,EAAE,GAAG,EAAE,2BAAa,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;4BACxD,IAAI,4BAAc,CAAC,CAAC,YAAY,CAAC,CAAC;4BAClC,oCAAsB;yBACvB;qBACF,CAAC;oBAEF,sDAAsD;oBACtD,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,yBAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAEhE,wCAAwC;oBACxC,wBAAU,CAAC,OAAO,CAAC;wBACjB,QAAQ;wBACR,eAAe,EAAE,OAAO,CAAC,eAAe;wBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC,CAAC;oBAEF,qFAAqF;oBACrF,mFAAmF;oBACnF,4FAA4F;oBAC5F,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ;wBAC/B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,uCAAiB,CAAC,OAAO,CAAC;gCACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gCAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gCAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gCAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gCAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gCACpB,eAAe,EAAE,OAAO,CAAC,eAAe;gCACxC,SAAS,EAAE,OAAO,CAAC,SAAS;gCAC5B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE;6BAC5C,CAAC;yBACH,CAAC;oBAEN,yEAAyE;oBACzE,qEAAqE;oBACrE,6CAAoB;oBAEpB,kEAAkE;oBAClE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,6BAAY,CAAC,CAAC;oBAEnD,4DAA4D;oBAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAE5C,iDAAiD;oBACjD,8BAAa;oBAEb,4FAA4F;oBAC5F,GAAG,OAAO,CAAC,UAAU;oBAErB,6DAA6D;oBAC7D,gFAAgF;oBAChF,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,mBAAU,CAAC,OAAO,CAAC,KAAK;wBACvD,CAAC,CAAC;4BACE,qBAAY,CAAC,YAAY,CAAC;gCACxB,OAAO,EAAE,CAAC,qBAAY,CAAC;gCACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;gCACvB,UAAU,EAAE,CAAC,MAA0C,EAAE,EAAE;oCACzD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAyB,SAAS,CAAC,CAAC;oCAC9D,OAAO;wCACL,KAAK,EAAE,OAAO,CAAC,KAAK;wCACpB,OAAO,EAAE;4CACP,8BAAiB,CAAC,MAAM;4CACxB,8BAAiB,CAAC,aAAa;4CAC/B,8BAAiB,CAAC,gBAAgB;yCACnC;wCACD,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK;qCAC/D,CAAC;gCACJ,CAAC;6BACF,CAAC;4BACF,8BAAa;yBACd;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,EAAE;gBACf,SAAS,EAAE;oBACT,mEAAmE;oBACnE,2EAA2E;oBAC3E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,6CAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrF,qEAAqE;oBACrE,0DAA0D;oBAC1D,EAAE,OAAO,EAAE,iCAAmB,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,EAAE;iBAClF;gBACD,OAAO,EAAE,CAAC,iCAAmB,CAAC;aAC/B,CAAC;QACJ,CAAC;KACF,CAAA;IA3JK,kBAAkB;QADvB,IAAA,eAAM,EAAC,EAAE,CAAC;OACL,kBAAkB,CA2JvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC"}

package/dist/bootstrap/bootstrap.options.d.ts

@@ -188,6 +188,25 @@ export interface BootstrapOptions {
      * on application bootstrap. See docs for `defineRbac()`.
      */
     rbac?: RbacMatrix;
+    /**
+     * Request-level permission gate. Default undefined = off: no new query, no
+     * new refusal, no new reconcile writes.
+     *
+     * With `enforce: true`:
+     * - every request that passes `JwtAuthGuard`, `AdminJwtAuthGuard` or
+     *   `OptionalJwtAuthGuard` (with a user) is checked against the section its
+     *   controller/handler declares with `@ModuleACL({ module })` and the action
+     *   of its HTTP method (or `@ModuleACL({ action })`); a refusal is 403;
+     * - permissions resolve in the token's company only (plus platform
+     *   memberships); a record-path value allows at the section level;
+     * - there is no administrator bypass, and `RbacReconcilerService` writes the
+     *   Administrator's grants from the matrix like any other role's;
+     * - the boot audit refuses to start when a session-guarded write route has
+     *   no section, or a referenced section has no `(:Module)` node.
+     */
+    permissions?: {
+        enforce: boolean;
+    };
     /**
      * Optional custom SecurityService subclass to inject into the package engine.
      * The subclass must extend the package SecurityService.

package/dist/bootstrap/bootstrap.options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.options.d.ts","sourceRoot":"","sources":["../../src/bootstrap/bootstrap.options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AAEvG;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;IAE1C;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEnC;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;IAExC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAE1B;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAE9C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAElC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IAEzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;OAIG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACxC,2FAA2F;IAC3F,aAAa,CAAC,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ;;;WAGG;QACH,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB;;;WAGG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IAEF;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP;;;WAGG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;KACtC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;CAC9E"}
+{"version":3,"file":"bootstrap.options.d.ts","sourceRoot":"","sources":["../../src/bootstrap/bootstrap.options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AAEvG;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;IAE1C;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEnC;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;IAExC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAE1B;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAE9C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAElC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IAEzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAEnC;;;;OAIG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACxC,2FAA2F;IAC3F,aAAa,CAAC,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ;;;WAGG;QACH,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB;;;WAGG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IAEF;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP;;;WAGG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;KACtC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;CAC9E"}

package/dist/common/constants/core-module.ids.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Permission section ids for the library's own controllers (`@ModuleACL`).
+ *
+ * The first eight are the ids the apps already seed (same values as the
+ * `ModuleId` enum in `foundations/module/enums/module.id.ts`, plus HowTo).
+ * The rest were generated once for the permission gate.
+ *
+ * NEVER change a value: apps seed `(Module)` nodes and grants against them.
+ * An app that switches `permissions.enforce` on must seed a `(Module)` node
+ * for every id its mounted controllers reference, or the boot audit refuses
+ * to start.
+ */
+export declare const CoreModuleId: {
+    readonly Auth: "035fe8a6-d467-40c0-9d1d-6a87f0dd286e";
+    readonly Company: "f9e77c8f-bfd1-4fd4-80b0-e1d891ab7113";
+    readonly Feature: "025fdd23-2803-4360-9fd9-eaa3612c2e23";
+    readonly HowTo: "6f975207-0df3-4c0d-b541-ed5dc04487b2";
+    readonly Notification: "9259d704-c670-4e77-a3a1-a728ffc5be3d";
+    readonly Role: "9f6416e6-7b9b-4e1a-a99f-833191eca8a9";
+    readonly S3: "db41ba46-e171-4324-8845-99353eba8568";
+    readonly User: "04cfc677-0fd2-4f5e-adf4-2483a00c0277";
+    readonly Assistant: "1d30b63e-c5e9-46a4-b26e-91ad397c75af";
+    readonly Billing: "8db0b573-9ba3-48c9-8a2d-6f093d339048";
+    readonly Analytics: "a057a946-f835-4b7e-bf11-226308d230b5";
+    readonly Waitlist: "ceed89c9-54ee-4168-9a41-045ccabbe822";
+    readonly EmailAutomation: "ac29ede6-6c80-4e99-9e88-732cc3efb946";
+    readonly TokenUsage: "15fba3d5-4637-4fa4-8d30-b33227ddba43";
+    readonly AiConnection: "73960c40-4501-4aae-a3f1-c187b6a6af8c";
+    readonly Audit: "445cf50b-2a5c-4c73-83a1-2f23e9989a59";
+    readonly Push: "b7abe58f-908d-4fb7-893e-9584dff17c70";
+    readonly Referral: "d792daf3-2296-46ae-9408-daf9c122029a";
+    readonly Content: "bd6d9360-c816-4e8a-aabe-d5ca03408067";
+    readonly Chunk: "3b60a9ff-e511-4683-9411-f1a11a80b498";
+    readonly KeyConcept: "f69f5384-d4aa-4001-920d-95d8fa572198";
+    readonly Handbook: "7b04d088-3512-4554-852a-c26804e618ec";
+    readonly OAuthClient: "f7812e20-16d6-44a0-bcd5-2b47a44808e9";
+};
+export type CoreModuleIdKey = keyof typeof CoreModuleId;
+//# sourceMappingURL=core-module.ids.d.ts.map

package/dist/common/constants/core-module.ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-module.ids.d.ts","sourceRoot":"","sources":["../../../src/common/constants/core-module.ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;CAwBf,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,YAAY,CAAC"}

package/dist/common/constants/core-module.ids.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreModuleId = void 0;
+/**
+ * Permission section ids for the library's own controllers (`@ModuleACL`).
+ *
+ * The first eight are the ids the apps already seed (same values as the
+ * `ModuleId` enum in `foundations/module/enums/module.id.ts`, plus HowTo).
+ * The rest were generated once for the permission gate.
+ *
+ * NEVER change a value: apps seed `(Module)` nodes and grants against them.
+ * An app that switches `permissions.enforce` on must seed a `(Module)` node
+ * for every id its mounted controllers reference, or the boot audit refuses
+ * to start.
+ */
+exports.CoreModuleId = {
+    Auth: "035fe8a6-d467-40c0-9d1d-6a87f0dd286e",
+    Company: "f9e77c8f-bfd1-4fd4-80b0-e1d891ab7113",
+    Feature: "025fdd23-2803-4360-9fd9-eaa3612c2e23",
+    HowTo: "6f975207-0df3-4c0d-b541-ed5dc04487b2",
+    Notification: "9259d704-c670-4e77-a3a1-a728ffc5be3d",
+    Role: "9f6416e6-7b9b-4e1a-a99f-833191eca8a9",
+    S3: "db41ba46-e171-4324-8845-99353eba8568",
+    User: "04cfc677-0fd2-4f5e-adf4-2483a00c0277",
+    Assistant: "1d30b63e-c5e9-46a4-b26e-91ad397c75af",
+    Billing: "8db0b573-9ba3-48c9-8a2d-6f093d339048",
+    Analytics: "a057a946-f835-4b7e-bf11-226308d230b5",
+    Waitlist: "ceed89c9-54ee-4168-9a41-045ccabbe822",
+    EmailAutomation: "ac29ede6-6c80-4e99-9e88-732cc3efb946",
+    TokenUsage: "15fba3d5-4637-4fa4-8d30-b33227ddba43",
+    AiConnection: "73960c40-4501-4aae-a3f1-c187b6a6af8c",
+    Audit: "445cf50b-2a5c-4c73-83a1-2f23e9989a59",
+    Push: "b7abe58f-908d-4fb7-893e-9584dff17c70",
+    Referral: "d792daf3-2296-46ae-9408-daf9c122029a",
+    Content: "bd6d9360-c816-4e8a-aabe-d5ca03408067",
+    Chunk: "3b60a9ff-e511-4683-9411-f1a11a80b498",
+    KeyConcept: "f69f5384-d4aa-4001-920d-95d8fa572198",
+    Handbook: "7b04d088-3512-4554-852a-c26804e618ec",
+    OAuthClient: "f7812e20-16d6-44a0-bcd5-2b47a44808e9",
+};
+//# sourceMappingURL=core-module.ids.js.map

package/dist/common/constants/core-module.ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-module.ids.js","sourceRoot":"","sources":["../../../src/common/constants/core-module.ids.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACU,QAAA,YAAY,GAAG;IAC1B,IAAI,EAAE,sCAAsC;IAC5C,OAAO,EAAE,sCAAsC;IAC/C,OAAO,EAAE,sCAAsC;IAC/C,KAAK,EAAE,sCAAsC;IAC7C,YAAY,EAAE,sCAAsC;IACpD,IAAI,EAAE,sCAAsC;IAC5C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,sCAAsC;IAC5C,SAAS,EAAE,sCAAsC;IACjD,OAAO,EAAE,sCAAsC;IAC/C,SAAS,EAAE,sCAAsC;IACjD,QAAQ,EAAE,sCAAsC;IAChD,eAAe,EAAE,sCAAsC;IACvD,UAAU,EAAE,sCAAsC;IAClD,YAAY,EAAE,sCAAsC;IACpD,KAAK,EAAE,sCAAsC;IAC7C,IAAI,EAAE,sCAAsC;IAC5C,QAAQ,EAAE,sCAAsC;IAChD,OAAO,EAAE,sCAAsC;IAC/C,KAAK,EAAE,sCAAsC;IAC7C,UAAU,EAAE,sCAAsC;IAClD,QAAQ,EAAE,sCAAsC;IAChD,WAAW,EAAE,sCAAsC;CAC3C,CAAC"}

package/dist/common/decorators/index.d.ts

@@ -5,6 +5,7 @@ export * from "./module.decorator";
 export * from "./oauth.scopes.decorator";
 export * from "./rate-limit.decorator";
 export * from "./roles.decorator";
+export * from "./token-scopes.decorator";
 export * from "./tool.decorator";
 export * from "./validate-id.decorator";
 //# sourceMappingURL=index.d.ts.map

package/dist/common/decorators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}

package/dist/common/decorators/index.js

@@ -21,6 +21,7 @@ __exportStar(require("./module.decorator"), exports);
 __exportStar(require("./oauth.scopes.decorator"), exports);
 __exportStar(require("./rate-limit.decorator"), exports);
 __exportStar(require("./roles.decorator"), exports);
+__exportStar(require("./token-scopes.decorator"), exports);
 __exportStar(require("./tool.decorator"), exports);
 __exportStar(require("./validate-id.decorator"), exports);
 //# sourceMappingURL=index.js.map

package/dist/common/decorators/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,+DAA6C;AAC7C,kEAAgD;AAChD,qDAAmC;AACnC,2DAAyC;AACzC,yDAAuC;AACvC,oDAAkC;AAClC,mDAAiC;AACjC,0DAAwC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,+DAA6C;AAC7C,kEAAgD;AAChD,qDAAmC;AACnC,2DAAyC;AACzC,yDAAuC;AACvC,oDAAkC;AAClC,2DAAyC;AACzC,mDAAiC;AACjC,0DAAwC"}

package/dist/common/decorators/module.decorator.d.ts

@@ -1,6 +1,25 @@
+import type { RbacAction } from "../../foundations/rbac/services/rbac-permission.service";
+/**
+ * The permission section (a `(Module)` id) a route belongs to, and optionally
+ * the action it is checked as.
+ *
+ * - `module`: the section id. Class-level, it covers every route of the
+ *   controller; handler-level, it overrides the class section.
+ * - `action`: overrides the HTTP-method mapping (GET/HEAD read, POST create,
+ *   PUT/PATCH update, DELETE delete). Use it for a POST that only reads
+ *   (search, preview, count): `{ module, action: "read" }`.
+ */
 export type ModuleDefinition = {
     module: string;
+    action?: RbacAction;
+    /** @deprecated Never read by anything; kept so existing callers still compile. */
     allowVisitors?: boolean;
 };
+/** Metadata key read by `ModulePermissionGate` and `ModulePermissionAuditService`. */
+export declare const MODULE_ACL_METADATA = "moduleDefinition";
+/**
+ * Declares the permission section of a controller (class) or a route (handler).
+ * Enforced only when the app bootstraps with `permissions: { enforce: true }`.
+ */
 export declare const ModuleACL: (params: ModuleDefinition) => import("@nestjs/common", { with: { "resolution-mode": "import" } }).CustomDecorator<string>;
 //# sourceMappingURL=module.decorator.d.ts.map

package/dist/common/decorators/module.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/module.decorator.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3E,eAAO,MAAM,SAAS,GAAI,QAAQ,gBAAgB,gGAA4C,CAAC"}
+{"version":3,"file":"module.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/module.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yDAAyD,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,gBAAgB,gGAA6C,CAAC"}

package/dist/common/decorators/module.decorator.js

@@ -1,7 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ModuleACL = void 0;
+exports.ModuleACL = exports.MODULE_ACL_METADATA = void 0;
 const common_1 = require("@nestjs/common");
-const ModuleACL = (params) => (0, common_1.SetMetadata)("moduleDefinition", params);
+/** Metadata key read by `ModulePermissionGate` and `ModulePermissionAuditService`. */
+exports.MODULE_ACL_METADATA = "moduleDefinition";
+/**
+ * Declares the permission section of a controller (class) or a route (handler).
+ * Enforced only when the app bootstraps with `permissions: { enforce: true }`.
+ */
+const ModuleACL = (params) => (0, common_1.SetMetadata)(exports.MODULE_ACL_METADATA, params);
 exports.ModuleACL = ModuleACL;
 //# sourceMappingURL=module.decorator.js.map

package/dist/common/decorators/module.decorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.decorator.js","sourceRoot":"","sources":["../../../src/common/decorators/module.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAItC,MAAM,SAAS,GAAG,CAAC,MAAwB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAAlF,QAAA,SAAS,aAAyE"}
+{"version":3,"file":"module.decorator.js","sourceRoot":"","sources":["../../../src/common/decorators/module.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAoB7C,sFAAsF;AACzE,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AAEtD;;;GAGG;AACI,MAAM,SAAS,GAAG,CAAC,MAAwB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,2BAAmB,EAAE,MAAM,CAAC,CAAC;AAAnF,QAAA,SAAS,aAA0E"}

package/dist/common/decorators/token-scopes.decorator.d.ts

@@ -0,0 +1,14 @@
+import type { TokenScope } from "../guards/session.token";
+/** Metadata key read by `AnyScopeAuthGuard`. */
+export declare const TOKEN_SCOPES_KEY = "token_scopes";
+/**
+ * The selection-token scopes `AnyScopeAuthGuard` admits on a route, besides a full
+ * session. Without this decorator the guard admits a full session only.
+ *
+ * @example
+ * @UseGuards(AnyScopeAuthGuard)
+ * @AllowedTokenScopes("company-selection")
+ * async selectCompany() { ... }
+ */
+export declare const AllowedTokenScopes: (...scopes: TokenScope[]) => import("@nestjs/common", { with: { "resolution-mode": "import" } }).CustomDecorator<string>;
+//# sourceMappingURL=token-scopes.decorator.d.ts.map

package/dist/common/decorators/token-scopes.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-scopes.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/token-scopes.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,QAAQ,UAAU,EAAE,gGAA0C,CAAC"}

package/dist/common/decorators/token-scopes.decorator.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowedTokenScopes = exports.TOKEN_SCOPES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/** Metadata key read by `AnyScopeAuthGuard`. */
+exports.TOKEN_SCOPES_KEY = "token_scopes";
+/**
+ * The selection-token scopes `AnyScopeAuthGuard` admits on a route, besides a full
+ * session. Without this decorator the guard admits a full session only.
+ *
+ * @example
+ * @UseGuards(AnyScopeAuthGuard)
+ * @AllowedTokenScopes("company-selection")
+ * async selectCompany() { ... }
+ */
+const AllowedTokenScopes = (...scopes) => (0, common_1.SetMetadata)(exports.TOKEN_SCOPES_KEY, scopes);
+exports.AllowedTokenScopes = AllowedTokenScopes;
+//# sourceMappingURL=token-scopes.decorator.js.map

package/dist/common/decorators/token-scopes.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-scopes.decorator.js","sourceRoot":"","sources":["../../../src/common/decorators/token-scopes.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAG7C,gDAAgD;AACnC,QAAA,gBAAgB,GAAG,cAAc,CAAC;AAE/C;;;;;;;;GAQG;AACI,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAoB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAgB,EAAE,MAAM,CAAC,CAAC;AAAxF,QAAA,kBAAkB,sBAAsE"}

package/dist/common/guards/index.d.ts

@@ -4,4 +4,5 @@ export * from "./jwt.auth.any-scope.guard";
 export * from "./jwt.auth.guard";
 export * from "./jwt.auth.optional.guard";
 export * from "./jwt.or.oauth.guard";
+export * from "./session.token";
 //# sourceMappingURL=index.d.ts.map

package/dist/common/guards/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}

package/dist/common/guards/index.js

@@ -20,4 +20,5 @@ __exportStar(require("./jwt.auth.any-scope.guard"), exports);
 __exportStar(require("./jwt.auth.guard"), exports);
 __exportStar(require("./jwt.auth.optional.guard"), exports);
 __exportStar(require("./jwt.or.oauth.guard"), exports);
+__exportStar(require("./session.token"), exports);
 //# sourceMappingURL=index.js.map

package/dist/common/guards/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,yDAAuC;AACvC,6DAA2C;AAC3C,mDAAiC;AACjC,4DAA0C;AAC1C,uDAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,yDAAuC;AACvC,6DAA2C;AAC3C,mDAAiC;AACjC,4DAA0C;AAC1C,uDAAqC;AACrC,kDAAgC"}

package/dist/common/guards/jwt.auth.admin.guard.d.ts

@@ -2,6 +2,7 @@ import { CanActivate, ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
 import { ClsService } from "nestjs-cls";
 import { Neo4jService } from "../../core/neo4j/services/neo4j.service";
+import { ModulePermissionGate } from "../../foundations/rbac/services/module-permission.gate";
 import { AuthContextHookInterface, SystemRolesInterface } from "../tokens";
 declare const AdminJwtAuthGuard_base: import("@nestjs/passport", { with: { "resolution-mode": "import" } }).Type<import("@nestjs/passport", { with: { "resolution-mode": "import" } }).IAuthGuard>;
 export declare class AdminJwtAuthGuard extends AdminJwtAuthGuard_base implements CanActivate {
@@ -10,7 +11,8 @@ export declare class AdminJwtAuthGuard extends AdminJwtAuthGuard_base implements
     private readonly neo4j;
     private readonly systemRoles?;
     private readonly authContextHook?;
-    constructor(cls: ClsService, reflector: Reflector, neo4j: Neo4jService, systemRoles?: SystemRolesInterface, authContextHook?: AuthContextHookInterface);
+    private readonly permissionGate?;
+    constructor(cls: ClsService, reflector: Reflector, neo4j: Neo4jService, systemRoles?: SystemRolesInterface, authContextHook?: AuthContextHookInterface, permissionGate?: ModulePermissionGate);
     canActivate(context: ExecutionContext): Promise<boolean>;
     handleRequest(err: any, user: any, info: any, context: ExecutionContext): any;
     private _validateRoles;

package/dist/common/guards/jwt.auth.admin.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.admin.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAE5G,qBACa,iBAAkB,SAAQ,sBAAiB,YAAW,WAAW;IAE1E,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAGtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAQ7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAbhB,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAGnB,WAAW,CAAC,EAAE,oBAAoB,EAQlC,eAAe,CAAC,EAAE,wBAAwB;IAKvD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAmCvE,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"jwt.auth.admin.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AAC9F,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAG5G,qBACa,iBAAkB,SAAQ,sBAAiB,YAAW,WAAW;IAE1E,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAGtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAQ7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAjBf,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAGnB,WAAW,CAAC,EAAE,oBAAoB,EAQlC,eAAe,CAAC,EAAE,wBAAwB,EAI1C,cAAc,CAAC,EAAE,oBAAoB;IAKlD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAgDvE,OAAO,CAAC,cAAc;CAWvB"}

package/dist/common/guards/jwt.auth.admin.guard.js

@@ -18,15 +18,18 @@ const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
 const neo4j_service_1 = require("../../core/neo4j/services/neo4j.service");
+const module_permission_gate_1 = require("../../foundations/rbac/services/module-permission.gate");
 const tokens_1 = require("../tokens");
+const session_token_1 = require("./session.token");
 let AdminJwtAuthGuard = class AdminJwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
-    constructor(cls, reflector, neo4j, systemRoles, authContextHook) {
+    constructor(cls, reflector, neo4j, systemRoles, authContextHook, permissionGate) {
         super();
         this.cls = cls;
         this.reflector = reflector;
         this.neo4j = neo4j;
         this.systemRoles = systemRoles;
         this.authContextHook = authContextHook;
+        this.permissionGate = permissionGate;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
@@ -37,6 +40,8 @@ let AdminJwtAuthGuard = class AdminJwtAuthGuard extends (0, passport_1.AuthGuard
         // Mirrors JwtAuthGuard.canActivate — same ordering, same guard conditions.
         if (isAuthenticated && request.user && this.authContextHook)
             await this.authContextHook.onAuthenticated({ request, context });
+        if (isAuthenticated && request.user && this.permissionGate)
+            await this.permissionGate.assert({ request, context });
         return isAuthenticated;
     }
     handleRequest(err, user, info, context) {
@@ -63,15 +68,29 @@ let AdminJwtAuthGuard = class AdminJwtAuthGuard extends (0, passport_1.AuthGuard
             // package's own rbac, feature, company, waitlist and stripe-* controllers.
             throw new common_1.HttpException("Unauthorised", 401);
         }
-        this._validateRoles(user, context);
-        this.cls.set("userId", user.userId);
-        this.cls.set("companyId", user.companyId ?? request.headers["x-companyid"]);
+        // Only a full session passes: pending-2FA, selection and portal tokens are signed
+        // with the same secret and verify, but must never act as a session.
+        // Asserted on a local copy: narrowing `user` itself would change the return type
+        // away from IAuthGuard's generic `TUser`.
+        const session = user;
+        (0, session_token_1.assertSessionPayload)(session);
+        this._validateRoles(session, context);
+        const companyId = (0, session_token_1.resolveSessionCompanyId)({
+            payload: session,
+            headerCompanyId: request.headers["x-companyid"],
+            administratorRole: this.systemRoles?.Administrator,
+        });
+        this.cls.set("userId", session.userId);
+        this.cls.set("companyId", companyId);
         this.cls.set("language", request.headers["x-language"]);
-        this.cls.set("roles", user.roles);
+        this.cls.set("roles", session.roles);
         return user;
     }
     _validateRoles(user, context) {
-        const requiredRoles = this.reflector.get("roles", context.getHandler()) ?? [];
+        // Handler AND class, copied so pushing the admin role never mutates the metadata.
+        const requiredRoles = [
+            ...(this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()]) ?? []),
+        ];
         const adminRole = this.systemRoles?.Administrator ?? "administrator";
         if (!requiredRoles.includes(adminRole))
             requiredRoles.push(adminRole);
@@ -86,8 +105,10 @@ exports.AdminJwtAuthGuard = AdminJwtAuthGuard = __decorate([
     __param(3, (0, common_1.Inject)(tokens_1.SYSTEM_ROLES)),
     __param(4, (0, common_1.Optional)()),
     __param(4, (0, common_1.Inject)(tokens_1.AUTH_CONTEXT_HOOK)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(module_permission_gate_1.ModulePermissionGate)),
     __metadata("design:paramtypes", [nestjs_cls_1.ClsService,
         core_1.Reflector,
-        neo4j_service_1.Neo4jService, Object, Object])
+        neo4j_service_1.Neo4jService, Object, Object, module_permission_gate_1.ModulePermissionGate])
 ], AdminJwtAuthGuard);
 //# sourceMappingURL=jwt.auth.admin.guard.js.map

package/dist/common/guards/jwt.auth.admin.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.admin.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,sCAA4G;AAGrG,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAGnB,WAAkC,EAQlC,eAA0C;QAE3D,KAAK,EAAE,CAAC;QAfS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAGnB,gBAAW,GAAX,WAAW,CAAuB;QAQlC,oBAAe,GAAf,eAAe,CAA2B;IAG7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,2EAA2E;QAC3E,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,6CAA6C;YAC7C,EAAE;YACF,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,2EAA2E;YAC3E,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAS,EAAE,OAAY;QAC5C,MAAM,aAAa,GAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAElG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7G,CAAC;CACF,CAAA;AA9EY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAOpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;qCAZJ,uBAAU;QACb,gBAAS;QACJ,4BAAY;GAJ3B,iBAAiB,CA8E7B"}
+{"version":3,"file":"jwt.auth.admin.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,mGAA8F;AAC9F,sCAA4G;AAC5G,mDAAgG;AAGzF,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAGnB,WAAkC,EAQlC,eAA0C,EAI1C,cAAqC;QAEtD,KAAK,EAAE,CAAC;QAnBS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAGnB,gBAAW,GAAX,WAAW,CAAuB;QAQlC,oBAAe,GAAf,eAAe,CAA2B;QAI1C,mBAAc,GAAd,cAAc,CAAuB;IAGxD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,2EAA2E;QAC3E,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnH,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,6CAA6C;YAC7C,EAAE;YACF,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,2EAA2E;YAC3E,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,oEAAoE;QACpE,iFAAiF;QACjF,0CAA0C;QAC1C,MAAM,OAAO,GAAY,IAAI,CAAC;QAC9B,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC;YACxC,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAoB,EAAE,OAAyB;QACpE,kFAAkF;QAClF,MAAM,aAAa,GAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC3G,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7G,CAAC;CACF,CAAA;AApGY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAOpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;IAGzB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,6CAAoB,CAAC,CAAA;qCAhBP,uBAAU;QACb,gBAAS;QACJ,4BAAY,kBAeF,6CAAoB;GAnB7C,iBAAiB,CAoG7B"}

package/dist/common/guards/jwt.auth.any-scope.guard.d.ts

@@ -1,18 +1,25 @@
 import { ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
 import { ClsService } from "nestjs-cls";
 declare const AnyScopeAuthGuard_base: import("@nestjs/passport", { with: { "resolution-mode": "import" } }).Type<import("@nestjs/passport", { with: { "resolution-mode": "import" } }).IAuthGuard>;
 /**
- * Admits BOTH a full session JWT and a scoped selection JWT (e.g. the
- * short-lived "company-selection" token issued at login).
+ * Admits a full session JWT, or a selection JWT whose scope the route lists with
+ * `@AllowedTokenScopes(...)` (handler or class). Without that decorator only a full
+ * session passes.
  *
  * The company-selection routes are legitimately reachable by either: a user
  * who belongs to more than one company arrives from the login screen holding
  * only a selection token, while a user switching company from inside the app
  * arrives holding a full token.
+ *
+ * Always refused: a pending-2FA token (it would otherwise mint a full session through
+ * POST /auth/company-selection with a password only), a portal token, and a selection
+ * token of a scope the route does not list.
  */
 export declare class AnyScopeAuthGuard extends AnyScopeAuthGuard_base {
     private readonly cls;
-    constructor(cls: ClsService);
+    private readonly reflector;
+    constructor(cls: ClsService, reflector: Reflector);
     canActivate(context: ExecutionContext): Promise<boolean>;
     handleRequest(err: any, user: any, info: any, context: any): any;
 }

package/dist/common/guards/jwt.auth.any-scope.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.any-scope.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA6B,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;;AAExC;;;;;;;;GAQG;AACH,qBACa,iBAAkB,SAAQ,sBAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU;IAItC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAU9D,aAAa,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,IAAI,KAAA,EAAE,OAAO,KAAA;CAiBvC"}
+{"version":3,"file":"jwt.auth.any-scope.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA6B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;;AAIxC;;;;;;;;;;;;;GAaG;AACH,qBACa,iBAAkB,SAAQ,sBAAgB;IAEnD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,SAAS;IAKjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAU9D,aAAa,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,IAAI,KAAA,EAAE,OAAO,KAAA;CAsBvC"}