@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/migrations/2026-08-04-120000-config-panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-04-120000-config-panel.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-08-04-120000-config-panel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAUjE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/2026-09-04-120000-idp-disable-local-authentication.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-09-04-120000-idp-disable-local-authentication.d.ts.map

package/dist/types/migrations/2026-09-04-120000-idp-disable-local-authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-04-120000-idp-disable-local-authentication.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAejE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/2026-09-11-120000-custom-role.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-09-11-120000-custom-role.d.ts.map

package/dist/types/migrations/2026-09-11-120000-custom-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-11-120000-custom-role.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-09-11-120000-custom-role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAgBjE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/index.d.ts

@@ -1,3 +1,3 @@
-export * from './types';
-export * from './runner';
+export * from './types.js';
+export * from './runner.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA"}

package/dist/types/migrations/runner.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseConfig } from '@contember/database';
-import { Providers } from '../model';
+import { Providers } from '../model/index.js';
 import { Logger } from '@contember/logger';
 export interface TenantCredentials {
     loginToken?: string;
@@ -7,6 +7,17 @@ export interface TenantCredentials {
     rootToken?: string;
     rootTokenHash?: string;
     rootPassword?: string;
+    /**
+     * Unpersisted root tokens (plain values). When set, these tokens are
+     * verified at runtime and resolve to a super-admin identity without being
+     * stored in the database. Useful for easy rotation.
+     */
+    rootTokens?: readonly string[];
+    /**
+     * Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but
+     * the plain token never needs to be passed to the engine.
+     */
+    rootTokenHashes?: readonly string[];
 }
 export declare class TenantMigrationsRunner {
     private readonly db;

package/dist/types/migrations/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/migrations/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,cAAc,EAAgB,MAAM,qBAAqB,CAAA;AA2CzG,OAAO,EAAoB,SAAS,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,MAAM,WAAW,iBAAiB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACrB;AA4CD,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAHT,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,EACpC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC;IAIlD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAqB7D"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/migrations/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,cAAc,EAAgB,MAAM,qBAAqB,CAAA;AAsEzG,OAAO,EAAoB,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,MAAM,WAAW,iBAAiB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAuED,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ3B,YACkB,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,EACpC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC,EAE9D;IAEY,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAoB5D;CACD"}

package/dist/types/migrations/snapshot-factory.d.ts

@@ -1,5 +1,5 @@
 import { MigrationArgs, MigrationBuilder } from '@contember/database-migrations';
-import { TenantMigrationArgs } from './types';
+import { TenantMigrationArgs } from './types.js';
 declare const _default: (sqlFactory: () => string) => Promise<(builder: MigrationBuilder, args: MigrationArgs<TenantMigrationArgs>) => Promise<void>>;
 export default _default;
 //# sourceMappingURL=snapshot-factory.d.ts.map

package/dist/types/migrations/snapshot-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot-factory.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;yBAGvB,YAAY,MAAM,MAAM,uBACtB,gBAAgB,QAAQ,aAAa,CAAC,mBAAmB,CAAC;AADlF,wBAeC"}
+{"version":3,"file":"snapshot-factory.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;qCAGd,MAAM,MAAM,uBACtB,gBAAgB,QAAQ,aAAa,CAAC,mBAAmB,CAAC"}

package/dist/types/migrations/snapshot.d.ts

@@ -1,4 +1,4 @@
 import { MigrationBuilder } from '@contember/database-migrations';
-import { TenantMigrationArgs } from './types';
+import { TenantMigrationArgs } from './types.js';
 export default function (builder: MigrationBuilder, args: TenantMigrationArgs): Promise<void>;
 //# sourceMappingURL=snapshot.d.ts.map

package/dist/types/migrations/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAG7C,yBAA8B,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,iBA2RjF"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhD,yBAA8B,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,iBAudjF"}

package/dist/types/migrations/tenantCredentials.d.ts

@@ -1,4 +1,4 @@
 import { MigrationBuilder } from '@contember/database-migrations';
-import { TenantMigrationArgs } from './types';
+import { TenantMigrationArgs } from './types.js';
 export declare const createCredentials: (builder: MigrationBuilder, args: TenantMigrationArgs) => Promise<void>;
 //# sourceMappingURL=tenantCredentials.d.ts.map

package/dist/types/migrations/tenantCredentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenantCredentials.d.ts","sourceRoot":"","sources":["../../../src/migrations/tenantCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAE7C,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,EAAE,MAAM,mBAAmB,kBAsD3F,CAAA"}
+{"version":3,"file":"tenantCredentials.d.ts","sourceRoot":"","sources":["../../../src/migrations/tenantCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,eAAO,MAAM,iBAAiB,YAAmB,gBAAgB,QAAQ,mBAAmB,kBAsD3F,CAAA"}

package/dist/types/migrations/types.d.ts

@@ -1,4 +1,4 @@
-import { Providers } from '../model';
+import { Providers } from '../model/index.js';
 export interface TenantMigrationArgs {
     getCredentials: () => Promise<{
         loginTokenHash?: string;

package/dist/types/migrations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/migrations/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEpC,MAAM,WAAW,mBAAmB;IACnC,cAAc,EAAE,MAAM,OAAO,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAC,CAAA;IACF,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/migrations/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,MAAM,WAAW,mBAAmB;IACnC,cAAc,EAAE,MAAM,OAAO,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAC,CAAA;IACF,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;CAClC"}

package/dist/types/model/authorization/AclSchemaAccessNodeFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/AclSchemaAccessNodeFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,qBAAa,0BAA0B;IACtC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,UAAU;CAwC9E"}
+{"version":3,"file":"AclSchemaAccessNodeFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/AclSchemaAccessNodeFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,qBAAa,0BAA0B;IACtC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,UAAU,CAuC7E;CACD"}

package/dist/types/model/authorization/CustomRoleAuthorizator.d.ts

@@ -0,0 +1,29 @@
+import { Authorizator, Permissions } from '@contember/authorization';
+import { DatabaseContext } from '../utils/index.js';
+import { Identity } from './Identity.js';
+export declare class CustomRolePermissionCache {
+    private readonly db;
+    private loading;
+    constructor(db: DatabaseContext);
+    /**
+     * One query, two maps. `projectScoped` holds only the grants that carry their own project
+     * filter, because the scope itself is not passed down to `Permissions.isAllowed`.
+     */
+    load(): Promise<{
+        readonly global: Permissions;
+        readonly projectScoped: Permissions;
+    }>;
+}
+export declare class CustomRoleAuthorizator implements Authorizator<Identity> {
+    private readonly inner;
+    readonly customRoleCache: CustomRolePermissionCache;
+    constructor(inner: Authorizator<Identity>, db: DatabaseContext, customRoleCache?: CustomRolePermissionCache);
+    /**
+     * Loads the definitions up front so no later check has to query mid-transaction —
+     * that would need a second pooled connection while the first one is pinned. No-op
+     * for identities carrying only built-in roles.
+     */
+    preload(roles: readonly string[]): Promise<void>;
+    isAllowed(identity: Identity, scope: Parameters<Authorizator<Identity>['isAllowed']>[1], action: Authorizator.Action): Promise<boolean>;
+}
+//# sourceMappingURL=CustomRoleAuthorizator.d.ts.map

package/dist/types/model/authorization/CustomRoleAuthorizator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleAuthorizator.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/CustomRoleAuthorizator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAIxC,qBAAa,yBAAyB;IAGzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAF/B,OAAO,CAAC,OAAO,CAA4F;IAE3G,YAA6B,EAAE,EAAE,eAAe,EAAI;IAEpD;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAA;KAAE,CAAC,CAMrF;CACD;AAWD,qBAAa,sBAAuB,YAAW,YAAY,CAAC,QAAQ,CAAC;IAEnE,OAAO,CAAC,QAAQ,CAAC,KAAK;aAEN,eAAe;IAHhC,YACkB,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9C,EAAE,EAAE,eAAe,EACH,eAAe,4BAAoC,EAEnE;IAED;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrD;IAEK,SAAS,CACd,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EACzD,MAAM,EAAE,YAAY,CAAC,MAAM,GACzB,OAAO,CAAC,OAAO,CAAC,CAalB;CACD"}

package/dist/types/model/authorization/CustomRolePermissions.d.ts

@@ -0,0 +1,45 @@
+import { Permissions } from '@contember/authorization';
+import * as Typesafe from '@contember/typesafe';
+import { CustomRoleRow } from '../type/CustomRole.js';
+export type CustomRoleConfigurationKind = 'NONE' | 'ROLE_INPUT' | 'TARGET_IDENTITY' | 'ROLE_MUTATION' | 'GLOBAL_API_KEY' | 'CHANGE_PROFILE' | 'CREATE_SESSION_TOKEN' | 'MAIL_TEMPLATE_SCOPE';
+export type CustomRolePermissionDefinition = {
+    readonly name: string;
+    readonly configurationKind: CustomRoleConfigurationKind;
+    readonly defaultConfig: Typesafe.Json;
+    readonly decode: (raw: Typesafe.Json, path: PropertyKey[]) => DecodedGrant;
+};
+export type CanonicalCustomRoleGrant = {
+    readonly permission: string;
+    readonly config: Typesafe.Json;
+};
+export type ParsedCustomRoleGrants = {
+    readonly grants: readonly CanonicalCustomRoleGrant[];
+    readonly referencedRoles: readonly string[];
+    readonly referencedProjects: readonly string[];
+};
+type DecodedGrant = {
+    readonly canonicalConfig: Typesafe.Json;
+    readonly referencedRoles: readonly string[];
+    readonly referencedProjects: readonly string[];
+    readonly install: (permissions: Permissions, role: string) => void;
+};
+export declare const BUILTIN_TENANT_ROLES: ReadonlySet<string>;
+export declare const GLOBALLY_ASSIGNABLE_BUILTIN_ROLES: ReadonlySet<string>;
+export declare const getGrantablePermissions: () => ReadonlyMap<string, CustomRolePermissionDefinition>;
+export type CustomRoleGrantValidationErrorCode = 'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION';
+export declare class CustomRoleGrantValidationError extends Error {
+    readonly code: CustomRoleGrantValidationErrorCode;
+    constructor(code: CustomRoleGrantValidationErrorCode, message: string);
+}
+export declare const parseCustomRoleGrants: (raw: unknown) => ParsedCustomRoleGrants;
+/** Fail-closed view of a persisted row, shared by evaluation and by the read API. */
+export declare const parsePersistedCustomRoleGrants: (raw: unknown) => readonly CanonicalCustomRoleGrant[];
+/** Role slugs a persisted row's configuration names. An undecodable row is wholly inert, so it references nothing. */
+export declare const parsePersistedCustomRoleReferences: (raw: unknown) => readonly string[];
+export declare const buildCustomRolePermissions: (rows: readonly CustomRoleRow[], { projectScoped }?: {
+    readonly projectScoped?: boolean;
+}) => Permissions;
+/** Every kind but `NONE` carries a required config object; there is nothing else to store. */
+export declare const isConfigurationRequired: (definition: CustomRolePermissionDefinition) => boolean;
+export {};
+//# sourceMappingURL=CustomRolePermissions.d.ts.map

package/dist/types/model/authorization/CustomRolePermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRolePermissions.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/CustomRolePermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAW/C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGrD,MAAM,MAAM,2BAA2B,GACpC,MAAM,GACN,YAAY,GACZ,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,qBAAqB,CAAA;AAExB,MAAM,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;IACvD,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,YAAY,CAAA;CAC1E,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACpD,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9C,CAAA;AAED,KAAK,YAAY,GAAG;IACnB,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAClE,CAAA;AAiBD,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAA;AAE3F,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAOhE,CAAA;AAoWF,eAAO,MAAM,uBAAuB,QAAO,WAAW,CAAC,MAAM,EAAE,8BAA8B,CAAY,CAAA;AAEzG,MAAM,MAAM,kCAAkC,GAC3C,oBAAoB,GACpB,sBAAsB,GACtB,kCAAkC,CAAA;AAErC,qBAAa,8BAA+B,SAAQ,KAAK;aAEvC,IAAI,EAAE,kCAAkC;IADzD,YACiB,IAAI,EAAE,kCAAkC,EACxD,OAAO,EAAE,MAAM,EAGf;CACD;AA8DD,eAAO,MAAM,qBAAqB,QAAS,OAAO,KAAG,sBAOpD,CAAA;AAWD,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,QAAS,OAAO,KAAG,SAAS,wBAAwB,EACe,CAAA;AAE9G,sHAAsH;AACtH,eAAO,MAAM,kCAAkC,QAAS,OAAO,KAAG,SAAS,MAAM,EACW,CAAA;AAU5F,eAAO,MAAM,0BAA0B,SAChC,SAAS,aAAa,EAAE,sBACH;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,KAC7D,WAWF,CAAA;AAED,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,eAAgB,8BAA8B,KAAG,OAAkD,CAAA"}

package/dist/types/model/authorization/DirectPermissionsAccessNode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DirectPermissionsAccessNode.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/DirectPermissionsAccessNode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQpF,qBAAa,2BAA4B,YAAW,UAAU;IAC7D,OAAO,CAAC,WAAW,CAAqB;IAEjC,KAAK,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,EACnD,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,QAAQ,GAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAoB;IAM/C,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGjH"}
+{"version":3,"file":"DirectPermissionsAccessNode.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/DirectPermissionsAccessNode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQpF,qBAAa,2BAA4B,YAAW,UAAU;IAC7D,OAAO,CAAC,WAAW,CAAqB;IAEjC,KAAK,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,EACnD,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,QAAQ,GAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAoB,QAI9C;IAED,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhH;CACD"}

package/dist/types/model/authorization/Identity.d.ts

@@ -1,5 +1,5 @@
-import { ProjectMemberManager } from '../service';
-import { DatabaseContext } from '../utils';
+import { ProjectMemberManager } from '../service/index.js';
+import { DatabaseContext } from '../utils/index.js';
 import { Acl } from '@contember/schema';
 export interface Identity {
     readonly id: string;

package/dist/types/model/authorization/Identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Identity.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/Identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IAEjC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;CAC9E;AAED,qBAAa,cAAe,YAAW,QAAQ;aAE7B,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,MAAM,EAAE;IAC/B,OAAO,CAAC,kBAAkB;gBAFV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EAAE,EACvB,kBAAkB,GAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAM;IAG3E,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;CAG9E;AAED,qBAAa,oBAAqB,YAAW,QAAQ;aAInC,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,SAAS,MAAM,EAAE;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAN/B,OAAO,CAAC,sBAAsB,CAAyD;gBAGtE,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,oBAAoB;IAG/C,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;CAIpF"}
+{"version":3,"file":"Identity.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/Identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IAEjC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;CAC9E;AAED,qBAAa,cAAe,YAAW,QAAQ;aAE7B,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,MAAM,EAAE;IAC/B,OAAO,CAAC,kBAAkB;IAH3B,YACiB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EAAE,EACvB,kBAAkB,GAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAM,EACvE;IAEJ,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAE7E;CACD;AAED,qBAAa,oBAAqB,YAAW,QAAQ;aAInC,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,SAAS,MAAM,EAAE;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAN/B,OAAO,CAAC,sBAAsB,CAAyD;IAEvF,YACiB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,oBAAoB,EACjD;IAEE,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAGnF;CACD"}

package/dist/types/model/authorization/IdentityFactory.d.ts

@@ -1,6 +1,6 @@
-import { ProjectMemberManager } from '../service';
-import { Identity } from './Identity';
-import { DatabaseContext } from '../utils';
+import { ProjectMemberManager } from '../service/index.js';
+import { Identity } from './Identity.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class IdentityFactory {
     private readonly projectMemberManager;
     constructor(projectMemberManager: ProjectMemberManager);

package/dist/types/model/authorization/IdentityFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAwB,MAAM,YAAY,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,eAAe;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAEhE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,QAAQ;CAGnG"}
+{"version":3,"file":"IdentityFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,eAAe;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAAjD,YAA6B,oBAAoB,EAAE,oBAAoB,EAAI;IAEpE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,QAAQ,CAElG;CACD"}

package/dist/types/model/authorization/IdentityScope.d.ts

@@ -1,5 +1,5 @@
 import { AccessNode, AuthorizationScope } from '@contember/authorization';
-import { Identity } from './Identity';
+import { Identity } from './Identity.js';
 declare class IdentityScope implements AuthorizationScope<Identity> {
     private readonly identityId;
     constructor(identityId: string);

package/dist/types/model/authorization/IdentityScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityScope.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,cAAM,aAAc,YAAW,kBAAkB,CAAC,QAAQ,CAAC;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEzC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;CAGhE;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"IdentityScope.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,cAAM,aAAc,YAAW,kBAAkB,CAAC,QAAQ,CAAC;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,MAAM,EAAI;IAE7C,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/D;CACD;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/types/model/authorization/MembershipMatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipMatcher.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/MembershipMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,MAAM,qCAAqC,GAC9C,GAAG,CAAC,UAAU,GACd;IACD,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAA;CAClC,CAAA;AAEF,qBAAa,iBAAiB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,SAAS,qCAAqC,EAAE;IAG1F,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,OAAO;CAoC5C"}
+{"version":3,"file":"MembershipMatcher.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/MembershipMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,MAAM,qCAAqC,GAC9C,GAAG,CAAC,UAAU,GACd;IACD,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAA;CAClC,CAAA;AAEF,qBAAa,iBAAiB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,SAAS,qCAAqC,EAAE,EACzF;IAED,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,OAAO,CAmC3C;CACD"}

package/dist/types/model/authorization/PermissionActions.d.ts

@@ -1,5 +1,40 @@
 import { Authorizator } from '@contember/authorization';
 import { Acl } from '@contember/schema';
+export type TargetIdentityPermissionTarget = {
+    readonly id: string;
+    readonly globalRoles: readonly string[];
+    readonly hasProjectMemberships: boolean;
+};
+export type TargetIdentityPermissionMeta = {
+    readonly target: TargetIdentityPermissionTarget | null;
+};
+export type ProfileField = 'name' | 'email';
+export type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {
+    readonly fields: readonly ProfileField[];
+};
+export type CreateSessionTokenPermissionMeta = {
+    readonly phase: 'preflight' | 'target';
+    readonly target?: TargetIdentityPermissionTarget;
+    readonly requestedExpirationMinutes?: number | null;
+    readonly trustForwardedClientInfo?: boolean;
+};
+export type GlobalRoleMutationPermissionMeta = {
+    readonly requestedRoles: readonly string[];
+    readonly target: TargetIdentityPermissionTarget;
+    readonly self: boolean;
+};
+export type GlobalApiKeyPermissionMeta = {
+    readonly requestedRoles: readonly string[];
+    readonly trustForwardedClientInfo: boolean;
+};
+export type ApiKeyPermissionMeta = {
+    readonly trustForwardedClientInfo: boolean;
+};
+export type MailTemplatePermissionMeta = {
+    readonly kind: 'global' | 'project';
+    readonly projectSlug: string | null;
+    readonly type: string;
+};
 declare namespace PermissionActions {
     enum Resources {
         system = "system",
@@ -9,7 +44,8 @@ declare namespace PermissionActions {
         project = "project",
         apiKey = "apiKey",
         mailTemplate = "mailTemplate",
-        idp = "idp"
+        idp = "idp",
+        customRole = "customRole"
     }
     const CONFIGURE: {
         resource: Authorizator.Resource;
@@ -21,30 +57,65 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
+    const AUTH_LOG_VIEW: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
     const IDENTITY_VIEW_PERMISSIONS: {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const IDENTITY_ADD_GLOBAL_ROLES: (roles?: readonly string[]) => {
+    const IDENTITY_ADD_GLOBAL_ROLES: (meta?: GlobalRoleMutationPermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: GlobalRoleMutationPermissionMeta;
+    } | {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
+    const IDENTITY_REMOVE_GLOBAL_ROLES: (meta?: GlobalRoleMutationPermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: GlobalRoleMutationPermissionMeta;
+    } | {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
+    const PERSON_DISABLE: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
-    const IDENTITY_REMOVE_GLOBAL_ROLES: (roles?: readonly string[]) => {
+    const PERSON_FORCE_SIGN_OUT: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
-    const PERSON_DISABLE: (roles?: readonly string[]) => {
+    const PERSON_RESET_MFA: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
+        };
+    };
+    const PERSON_REVOKE_SESSION: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
+    const PERSON_VIEW_SESSIONS: (target: TargetIdentityPermissionTarget | null) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: {
+            target: TargetIdentityPermissionTarget | null;
         };
     };
     const PERSON_VIEW: {
@@ -52,16 +123,21 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
+    const PERSON_LIST: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
     const PERSON_SIGN_IN: {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_SIGN_UP: (roles?: readonly string[]) => {
+    const PERSON_SIGN_UP: (requestedRoles?: readonly string[]) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            requestedRoles: readonly string[] | undefined;
         };
     };
     const PERSON_SIGN_OUT: {
@@ -74,11 +150,12 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_CHANGE_PROFILE: (roles?: readonly string[]) => {
+    const PERSON_CHANGE_PROFILE: (target: TargetIdentityPermissionTarget | null, fields: readonly ProfileField[]) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
+            fields: readonly ProfileField[];
         };
     };
     const PERSON_CHANGE_MY_PROFILE: {
@@ -91,11 +168,11 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_CHANGE_PASSWORD: (roles?: readonly string[]) => {
+    const PERSON_CHANGE_PASSWORD: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
     const PERSON_CHANGE_MY_PASSWORD: {
@@ -118,6 +195,18 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
+    const PERSON_VIEW_IDP: (target: TargetIdentityPermissionTarget | null) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: {
+            target: TargetIdentityPermissionTarget | null;
+        };
+    };
+    const PERSON_DISCONNECT_MY_IDP: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
     const PERSON_REQUEST_PASSWORDLESS_SIGN_IN: {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
@@ -128,12 +217,10 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_CREATE_SESSION_KEY: (roles?: readonly string[]) => {
+    const PERSON_CREATE_SESSION_KEY: (meta: CreateSessionTokenPermissionMeta) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
-        meta: {
-            roles: readonly string[] | undefined;
-        };
+        meta: CreateSessionTokenPermissionMeta;
     };
     const PERSON_INVITE: (memberships: readonly Acl.Membership[]) => {
         resource: Authorizator.Resource;
@@ -159,6 +246,11 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
+    const PROJECT_VIEW_SECRETS: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
     const PROJECT_UPDATE: {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
@@ -202,34 +294,57 @@ declare namespace PermissionActions {
             memberships: readonly Acl.Membership[];
         };
     };
-    const API_KEY_CREATE: {
+    const API_KEY_CREATE: (meta?: ApiKeyPermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: ApiKeyPermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const API_KEY_CREATE_GLOBAL: (roles?: readonly string[]) => {
+    const API_KEY_CREATE_GLOBAL: (meta?: GlobalApiKeyPermissionMeta) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
-        meta: {
-            roles: readonly string[] | undefined;
-        };
+        meta: GlobalApiKeyPermissionMeta;
+    } | {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
     };
     const API_KEY_DISABLE: {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const MAIL_TEMPLATE_ADD: {
+    const API_KEY_LIST: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
+    const MAIL_TEMPLATE_ADD: (meta?: MailTemplatePermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: MailTemplatePermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const MAIL_TEMPLATE_REMOVE: {
+    const MAIL_TEMPLATE_REMOVE: (meta?: MailTemplatePermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: MailTemplatePermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const MAIL_TEMPLATE_LIST: {
+    const MAIL_TEMPLATE_LIST: (meta?: MailTemplatePermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: MailTemplatePermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
@@ -259,6 +374,16 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
+    const CUSTOM_ROLE_MANAGE: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
+    const CUSTOM_ROLE_VIEW: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
 }
 export { PermissionActions };
 //# sourceMappingURL=PermissionActions.d.ts.map

package/dist/types/model/authorization/PermissionActions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionActions.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,kBAAU,iBAAiB,CAAC;IAC3B,KAAY,SAAS;QACpB,MAAM,WAAW;QACjB,UAAU,eAAe;QACzB,MAAM,WAAW;QACjB,QAAQ,aAAa;QACrB,OAAO,YAAY;QACnB,MAAM,WAAW;QACjB,YAAY,iBAAiB;QAC7B,GAAG,QAAQ;KACX;IAEM,MAAM,SAAS;;;;KAA2D,CAAA;IAC1E,MAAM,WAAW;;;;KAA4D,CAAA;IAE7E,MAAM,yBAAyB;;;;KAAmE,CAAA;IAClG,MAAM,yBAAyB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA+E,CAAA;IAC3I,MAAM,4BAA4B,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KACQ,CAAA;IAEvE,MAAM,cAAc,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAsE,CAAA;IAEvH,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,cAAc;;;;KAAwD,CAAA;IAC5E,MAAM,cAAc,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAqE,CAAA;IACtH,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,gBAAgB;;;;KAA0D,CAAA;IAChF,MAAM,qBAAqB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA4E,CAAA;IACpI,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,0BAA0B;;;;KAAoE,CAAA;IACpG,MAAM,sBAAsB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA6E,CAAA;IACtI,MAAM,yBAAyB;;;;KAAkE,CAAA;IACjG,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,qBAAqB;;;;KAA8D,CAAA;IACzF,MAAM,kBAAkB;;;;KAA2D,CAAA;IACnF,MAAM,mCAAmC;;;;KAA2E,CAAA;IACpH,MAAM,2BAA2B;;;;KAAoE,CAAA;IACrG,MAAM,yBAAyB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAiF,CAAA;IAE7I,MAAM,aAAa,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KAA2E,CAAA;IACxI,MAAM,uBAAuB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IAE1E,MAAM,YAAY;;;;KAAuD,CAAA;IACzE,MAAM,kBAAkB;;;;KAA4D,CAAA;IACpF,MAAM,cAAc;;;;KAAyD,CAAA;IAE7E,MAAM,cAAc;;;;KAAyD,CAAA;IAC7E,MAAM,iBAAiB;;;;KAAsE,CAAA;IAE7F,MAAM,mBAAmB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IACtE,MAAM,kBAAkB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACpE,MAAM,qBAAqB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACvE,MAAM,qBAAqB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IAEvE,MAAM,cAAc;;;;KAAwD,CAAA;IAC5E,MAAM,qBAAqB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA2E,CAAA;IACnI,MAAM,eAAe;;;;KAAyD,CAAA;IAE9E,MAAM,iBAAiB;;;;KAA2D,CAAA;IAClF,MAAM,oBAAoB;;;;KAA8D,CAAA;IACxF,MAAM,kBAAkB;;;;KAA4D,CAAA;IAEpF,MAAM,OAAO;;;;KAAkD,CAAA;IAC/D,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,QAAQ;;;;KAAmD,CAAA;CACxE;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"PermissionActions.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,GAAG,IAAI,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,CAAA;AAE3C,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAA;IAChD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC9C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,kBAAU,iBAAiB,CAAC;IAC3B,KAAY,SAAS;QACpB,MAAM,WAAW;QACjB,UAAU,eAAe;QACzB,MAAM,WAAW;QACjB,QAAQ,aAAa;QACrB,OAAO,YAAY;QACnB,MAAM,WAAW;QACjB,YAAY,iBAAiB;QAC7B,GAAG,QAAQ;QACX,UAAU,eAAe;KACzB;IAEM,MAAM,SAAS;;;;KAA2D,CAAA;IAC1E,MAAM,WAAW;;;;KAA4D,CAAA;IAC7E,MAAM,aAAa;;;;KAA6D,CAAA;IAEhF,MAAM,yBAAyB;;;;KAAmE,CAAA;IAClG,MAAM,yBAAyB,UAAW,gCAAgC;;;;;;;;KACX,CAAA;IAC/D,MAAM,4BAA4B,UAAW,gCAAgC;;;;;;;;KACX,CAAA;IAElE,MAAM,cAAc,WAAY,8BAA8B,GAAG,IAAI;;;;;;KAAuE,CAAA;IAC5I,MAAM,qBAAqB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACX,CAAA;IACjE,MAAM,gBAAgB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACV,CAAA;IAC7D,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,oBAAoB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACV,CAAA;IAEjE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,cAAc;;;;KAAwD,CAAA;IAC5E,MAAM,cAAc,oBAAqB,SAAS,MAAM,EAAE;;;;;;KAA8E,CAAA;IACxI,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,gBAAgB;;;;KAA0D,CAAA;IAChF,MAAM,qBAAqB,WAAY,8BAA8B,GAAG,IAAI,UAAU,SAAS,YAAY,EAAE;;;;;;;KACnC,CAAA;IAC1E,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,0BAA0B;;;;KAAoE,CAAA;IACpG,MAAM,sBAAsB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACV,CAAA;IACnE,MAAM,yBAAyB;;;;KAAkE,CAAA;IACjG,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,qBAAqB;;;;KAA8D,CAAA;IACzF,MAAM,kBAAkB;;;;KAA2D,CAAA;IACnF,MAAM,eAAe,WAAY,8BAA8B,GAAG,IAAI;;;;;;KAAuE,CAAA;IAC7I,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,mCAAmC;;;;KAA2E,CAAA;IACpH,MAAM,2BAA2B;;;;KAAoE,CAAA;IACrG,MAAM,yBAAyB,SAAU,gCAAgC;;;;KACR,CAAA;IAEjE,MAAM,aAAa,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KAA2E,CAAA;IACxI,MAAM,uBAAuB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IAE1E,MAAM,YAAY;;;;KAAuD,CAAA;IACzE,MAAM,kBAAkB;;;;KAA4D,CAAA;IACpF,MAAM,oBAAoB;;;;KAA8D,CAAA;IACxF,MAAM,cAAc;;;;KAAyD,CAAA;IAE7E,MAAM,cAAc;;;;KAAyD,CAAA;IAC7E,MAAM,iBAAiB;;;;KAAsE,CAAA;IAE7F,MAAM,mBAAmB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IACtE,MAAM,kBAAkB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACpE,MAAM,qBAAqB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACvE,MAAM,qBAAqB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IAEvE,MAAM,cAAc,UAAW,oBAAoB;;;;;;;;KAAgE,CAAA;IACnH,MAAM,qBAAqB,UAAW,0BAA0B;;;;;;;;KAAsE,CAAA;IACtI,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,YAAY;;;;KAAsD,CAAA;IAIxE,MAAM,iBAAiB,UAAW,0BAA0B;;;;;;;;KAAmE,CAAA;IAC/H,MAAM,oBAAoB,UAAW,0BAA0B;;;;;;;;KAAsE,CAAA;IACrI,MAAM,kBAAkB,UAAW,0BAA0B;;;;;;;;KAAoE,CAAA;IAEjI,MAAM,OAAO;;;;KAAkD,CAAA;IAC/D,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,QAAQ;;;;KAAmD,CAAA;IAEjE,MAAM,kBAAkB;;;;KAA4D,CAAA;IACpF,MAAM,gBAAgB;;;;KAA0D,CAAA;CACvF;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/types/model/authorization/PermissionContext.d.ts

@@ -1,7 +1,7 @@
 import { AuthorizationScope, Authorizator } from '@contember/authorization';
-import { ProjectScopeFactory } from './ProjectScopeFactory';
-import { Project, ProjectSchemaResolver } from '../type';
-import { Identity } from './Identity';
+import { ProjectScopeFactory } from './ProjectScopeFactory.js';
+import { Project, ProjectSchemaResolver } from '../type/index.js';
+import { Identity } from './Identity.js';
 export type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>;
 export declare class PermissionContext {
     readonly identity: Identity;

package/dist/types/model/authorization/PermissionContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionContext.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,kBAAkB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAI9E,qBAAa,iBAAiB;aAIZ,QAAQ,EAAE,QAAQ;aAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANhC,OAAO,CAAC,aAAa,CAAmD;gBAGvD,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,EACnC,mBAAmB,EAAE,mBAAmB,EACxC,cAAc,EAAE,qBAAqB;IAG1C,SAAS,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACnD,KAAK,EACL,MAAM,GACN,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAIb,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAAG,cAAc;IAInE,aAAa,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACvD,KAAK,EACL,MAAM,EACN,OAAO,GACP,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjC,OAAO,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMJ,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CAS7G"}
+{"version":3,"file":"PermissionContext.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,kBAAkB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAI9E,qBAAa,iBAAiB;aAIZ,QAAQ,EAAE,QAAQ;aAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANhC,OAAO,CAAC,aAAa,CAAmD;IAExE,YACiB,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,EACnC,mBAAmB,EAAE,mBAAmB,EACxC,cAAc,EAAE,qBAAqB,EACnD;IAES,SAAS,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACnD,KAAK,EACL,MAAM,GACN,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnB;IAEM,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAAG,cAAc,CAE/E;IAEY,aAAa,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACvD,KAAK,EACL,MAAM,EACN,OAAO,GACP,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjC,OAAO,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;IAEY,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAQ5G;CACD"}