@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/types/model/authorization/PermissionActions.d.ts

@@ -1,5 +1,40 @@
 import { Authorizator } from '@contember/authorization';
 import { Acl } from '@contember/schema';
+export type TargetIdentityPermissionTarget = {
+    readonly id: string;
+    readonly globalRoles: readonly string[];
+    readonly hasProjectMemberships: boolean;
+};
+export type TargetIdentityPermissionMeta = {
+    readonly target: TargetIdentityPermissionTarget | null;
+};
+export type ProfileField = 'name' | 'email';
+export type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {
+    readonly fields: readonly ProfileField[];
+};
+export type CreateSessionTokenPermissionMeta = {
+    readonly phase: 'preflight' | 'target';
+    readonly target?: TargetIdentityPermissionTarget;
+    readonly requestedExpirationMinutes?: number | null;
+    readonly trustForwardedClientInfo?: boolean;
+};
+export type GlobalRoleMutationPermissionMeta = {
+    readonly requestedRoles: readonly string[];
+    readonly target: TargetIdentityPermissionTarget;
+    readonly self: boolean;
+};
+export type GlobalApiKeyPermissionMeta = {
+    readonly requestedRoles: readonly string[];
+    readonly trustForwardedClientInfo: boolean;
+};
+export type ApiKeyPermissionMeta = {
+    readonly trustForwardedClientInfo: boolean;
+};
+export type MailTemplatePermissionMeta = {
+    readonly kind: 'global' | 'project';
+    readonly projectSlug: string | null;
+    readonly type: string;
+};
 declare namespace PermissionActions {
     enum Resources {
         system = "system",
@@ -9,7 +44,8 @@ declare namespace PermissionActions {
         project = "project",
         apiKey = "apiKey",
         mailTemplate = "mailTemplate",
-        idp = "idp"
+        idp = "idp",
+        customRole = "customRole"
     }
     const CONFIGURE: {
         resource: Authorizator.Resource;
@@ -31,39 +67,43 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const IDENTITY_ADD_GLOBAL_ROLES: (roles?: readonly string[]) => {
+    const IDENTITY_ADD_GLOBAL_ROLES: (meta?: GlobalRoleMutationPermissionMeta) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
-        meta: {
-            roles: readonly string[] | undefined;
-        };
+        meta: GlobalRoleMutationPermissionMeta;
+    } | {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
     };
-    const IDENTITY_REMOVE_GLOBAL_ROLES: (roles?: readonly string[]) => {
+    const IDENTITY_REMOVE_GLOBAL_ROLES: (meta?: GlobalRoleMutationPermissionMeta) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
-        meta: {
-            roles: readonly string[] | undefined;
-        };
+        meta: GlobalRoleMutationPermissionMeta;
+    } | {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
     };
-    const PERSON_DISABLE: (roles?: readonly string[]) => {
+    const PERSON_DISABLE: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
-    const PERSON_FORCE_SIGN_OUT: (roles?: readonly string[]) => {
+    const PERSON_FORCE_SIGN_OUT: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
-    const PERSON_RESET_MFA: (roles?: readonly string[]) => {
+    const PERSON_RESET_MFA: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
     const PERSON_REVOKE_SESSION: {
@@ -71,11 +111,11 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_VIEW_SESSIONS: (roles?: readonly string[]) => {
+    const PERSON_VIEW_SESSIONS: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
     const PERSON_VIEW: {
@@ -93,11 +133,11 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_SIGN_UP: (roles?: readonly string[]) => {
+    const PERSON_SIGN_UP: (requestedRoles?: readonly string[]) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            requestedRoles: readonly string[] | undefined;
         };
     };
     const PERSON_SIGN_OUT: {
@@ -110,11 +150,12 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_CHANGE_PROFILE: (roles?: readonly string[]) => {
+    const PERSON_CHANGE_PROFILE: (target: TargetIdentityPermissionTarget | null, fields: readonly ProfileField[]) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
+            fields: readonly ProfileField[];
         };
     };
     const PERSON_CHANGE_MY_PROFILE: {
@@ -127,11 +168,11 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_CHANGE_PASSWORD: (roles?: readonly string[]) => {
+    const PERSON_CHANGE_PASSWORD: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
     const PERSON_CHANGE_MY_PASSWORD: {
@@ -154,11 +195,11 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_VIEW_IDP: (roles?: readonly string[]) => {
+    const PERSON_VIEW_IDP: (target: TargetIdentityPermissionTarget | null) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta: {
-            roles: readonly string[] | undefined;
+            target: TargetIdentityPermissionTarget | null;
         };
     };
     const PERSON_DISCONNECT_MY_IDP: {
@@ -176,12 +217,10 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const PERSON_CREATE_SESSION_KEY: (roles?: readonly string[]) => {
+    const PERSON_CREATE_SESSION_KEY: (meta: CreateSessionTokenPermissionMeta) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
-        meta: {
-            roles: readonly string[] | undefined;
-        };
+        meta: CreateSessionTokenPermissionMeta;
     };
     const PERSON_INVITE: (memberships: readonly Acl.Membership[]) => {
         resource: Authorizator.Resource;
@@ -255,17 +294,23 @@ declare namespace PermissionActions {
             memberships: readonly Acl.Membership[];
         };
     };
-    const API_KEY_CREATE: {
+    const API_KEY_CREATE: (meta?: ApiKeyPermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: ApiKeyPermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const API_KEY_CREATE_GLOBAL: (roles?: readonly string[]) => {
+    const API_KEY_CREATE_GLOBAL: (meta?: GlobalApiKeyPermissionMeta) => {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
-        meta: {
-            roles: readonly string[] | undefined;
-        };
+        meta: GlobalApiKeyPermissionMeta;
+    } | {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
     };
     const API_KEY_DISABLE: {
         resource: Authorizator.Resource;
@@ -277,17 +322,29 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const MAIL_TEMPLATE_ADD: {
+    const MAIL_TEMPLATE_ADD: (meta?: MailTemplatePermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: MailTemplatePermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const MAIL_TEMPLATE_REMOVE: {
+    const MAIL_TEMPLATE_REMOVE: (meta?: MailTemplatePermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: MailTemplatePermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
-    const MAIL_TEMPLATE_LIST: {
+    const MAIL_TEMPLATE_LIST: (meta?: MailTemplatePermissionMeta) => {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta: MailTemplatePermissionMeta;
+    } | {
         resource: Authorizator.Resource;
         privilege: Authorizator.Privilege;
         meta?: undefined;
@@ -317,6 +374,16 @@ declare namespace PermissionActions {
         privilege: Authorizator.Privilege;
         meta?: undefined;
     };
+    const CUSTOM_ROLE_MANAGE: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
+    const CUSTOM_ROLE_VIEW: {
+        resource: Authorizator.Resource;
+        privilege: Authorizator.Privilege;
+        meta?: undefined;
+    };
 }
 export { PermissionActions };
 //# sourceMappingURL=PermissionActions.d.ts.map

package/dist/types/model/authorization/PermissionActions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionActions.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,kBAAU,iBAAiB,CAAC;IAC3B,KAAY,SAAS;QACpB,MAAM,WAAW;QACjB,UAAU,eAAe;QACzB,MAAM,WAAW;QACjB,QAAQ,aAAa;QACrB,OAAO,YAAY;QACnB,MAAM,WAAW;QACjB,YAAY,iBAAiB;QAC7B,GAAG,QAAQ;KACX;IAEM,MAAM,SAAS;;;;KAA2D,CAAA;IAC1E,MAAM,WAAW;;;;KAA4D,CAAA;IAC7E,MAAM,aAAa;;;;KAA6D,CAAA;IAEhF,MAAM,yBAAyB;;;;KAAmE,CAAA;IAClG,MAAM,yBAAyB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA+E,CAAA;IAC3I,MAAM,4BAA4B,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KACQ,CAAA;IAEvE,MAAM,cAAc,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAsE,CAAA;IACvH,MAAM,qBAAqB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA2E,CAAA;IACnI,MAAM,gBAAgB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAuE,CAAA;IAC1H,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,oBAAoB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA2E,CAAA;IAElI,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,cAAc;;;;KAAwD,CAAA;IAC5E,MAAM,cAAc,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAqE,CAAA;IACtH,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,gBAAgB;;;;KAA0D,CAAA;IAChF,MAAM,qBAAqB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA4E,CAAA;IACpI,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,0BAA0B;;;;KAAoE,CAAA;IACpG,MAAM,sBAAsB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA6E,CAAA;IACtI,MAAM,yBAAyB;;;;KAAkE,CAAA;IACjG,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,qBAAqB;;;;KAA8D,CAAA;IACzF,MAAM,kBAAkB;;;;KAA2D,CAAA;IACnF,MAAM,eAAe,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAsE,CAAA;IACxH,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,mCAAmC;;;;KAA2E,CAAA;IACpH,MAAM,2BAA2B;;;;KAAoE,CAAA;IACrG,MAAM,yBAAyB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAAiF,CAAA;IAE7I,MAAM,aAAa,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KAA2E,CAAA;IACxI,MAAM,uBAAuB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IAE1E,MAAM,YAAY;;;;KAAuD,CAAA;IACzE,MAAM,kBAAkB;;;;KAA4D,CAAA;IACpF,MAAM,oBAAoB;;;;KAA8D,CAAA;IACxF,MAAM,cAAc;;;;KAAyD,CAAA;IAE7E,MAAM,cAAc;;;;KAAyD,CAAA;IAC7E,MAAM,iBAAiB;;;;KAAsE,CAAA;IAE7F,MAAM,mBAAmB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IACtE,MAAM,kBAAkB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACpE,MAAM,qBAAqB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACvE,MAAM,qBAAqB,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IAEvE,MAAM,cAAc;;;;KAAwD,CAAA;IAC5E,MAAM,qBAAqB,GAAI,QAAQ,SAAS,MAAM,EAAE;;;;;;KAA2E,CAAA;IACnI,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,YAAY;;;;KAAsD,CAAA;IAExE,MAAM,iBAAiB;;;;KAA2D,CAAA;IAClF,MAAM,oBAAoB;;;;KAA8D,CAAA;IACxF,MAAM,kBAAkB;;;;KAA4D,CAAA;IAEpF,MAAM,OAAO;;;;KAAkD,CAAA;IAC/D,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,QAAQ;;;;KAAmD,CAAA;CACxE;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"PermissionActions.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,GAAG,IAAI,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,CAAA;AAE3C,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAA;IAChD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC9C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,kBAAU,iBAAiB,CAAC;IAC3B,KAAY,SAAS;QACpB,MAAM,WAAW;QACjB,UAAU,eAAe;QACzB,MAAM,WAAW;QACjB,QAAQ,aAAa;QACrB,OAAO,YAAY;QACnB,MAAM,WAAW;QACjB,YAAY,iBAAiB;QAC7B,GAAG,QAAQ;QACX,UAAU,eAAe;KACzB;IAEM,MAAM,SAAS;;;;KAA2D,CAAA;IAC1E,MAAM,WAAW;;;;KAA4D,CAAA;IAC7E,MAAM,aAAa;;;;KAA6D,CAAA;IAEhF,MAAM,yBAAyB;;;;KAAmE,CAAA;IAClG,MAAM,yBAAyB,UAAW,gCAAgC;;;;;;;;KACX,CAAA;IAC/D,MAAM,4BAA4B,UAAW,gCAAgC;;;;;;;;KACX,CAAA;IAElE,MAAM,cAAc,WAAY,8BAA8B,GAAG,IAAI;;;;;;KAAuE,CAAA;IAC5I,MAAM,qBAAqB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACX,CAAA;IACjE,MAAM,gBAAgB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACV,CAAA;IAC7D,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,oBAAoB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACV,CAAA;IAEjE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,cAAc;;;;KAAwD,CAAA;IAC5E,MAAM,cAAc,oBAAqB,SAAS,MAAM,EAAE;;;;;;KAA8E,CAAA;IACxI,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,gBAAgB;;;;KAA0D,CAAA;IAChF,MAAM,qBAAqB,WAAY,8BAA8B,GAAG,IAAI,UAAU,SAAS,YAAY,EAAE;;;;;;;KACnC,CAAA;IAC1E,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,0BAA0B;;;;KAAoE,CAAA;IACpG,MAAM,sBAAsB,WAAY,8BAA8B,GAAG,IAAI;;;;;;KACV,CAAA;IACnE,MAAM,yBAAyB;;;;KAAkE,CAAA;IACjG,MAAM,qBAAqB;;;;KAA+D,CAAA;IAC1F,MAAM,qBAAqB;;;;KAA8D,CAAA;IACzF,MAAM,kBAAkB;;;;KAA2D,CAAA;IACnF,MAAM,eAAe,WAAY,8BAA8B,GAAG,IAAI;;;;;;KAAuE,CAAA;IAC7I,MAAM,wBAAwB;;;;KAAiE,CAAA;IAC/F,MAAM,mCAAmC;;;;KAA2E,CAAA;IACpH,MAAM,2BAA2B;;;;KAAoE,CAAA;IACrG,MAAM,yBAAyB,SAAU,gCAAgC;;;;KACR,CAAA;IAEjE,MAAM,aAAa,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KAA2E,CAAA;IACxI,MAAM,uBAAuB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IAE1E,MAAM,YAAY;;;;KAAuD,CAAA;IACzE,MAAM,kBAAkB;;;;KAA4D,CAAA;IACpF,MAAM,oBAAoB;;;;KAA8D,CAAA;IACxF,MAAM,cAAc;;;;KAAyD,CAAA;IAE7E,MAAM,cAAc;;;;KAAyD,CAAA;IAC7E,MAAM,iBAAiB;;;;KAAsE,CAAA;IAE7F,MAAM,mBAAmB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACG,CAAA;IACtE,MAAM,kBAAkB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACpE,MAAM,qBAAqB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IACvE,MAAM,qBAAqB,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE;;;;;;KACE,CAAA;IAEvE,MAAM,cAAc,UAAW,oBAAoB;;;;;;;;KAAgE,CAAA;IACnH,MAAM,qBAAqB,UAAW,0BAA0B;;;;;;;;KAAsE,CAAA;IACtI,MAAM,eAAe;;;;KAAyD,CAAA;IAC9E,MAAM,YAAY;;;;KAAsD,CAAA;IAIxE,MAAM,iBAAiB,UAAW,0BAA0B;;;;;;;;KAAmE,CAAA;IAC/H,MAAM,oBAAoB,UAAW,0BAA0B;;;;;;;;KAAsE,CAAA;IACrI,MAAM,kBAAkB,UAAW,0BAA0B;;;;;;;;KAAoE,CAAA;IAEjI,MAAM,OAAO;;;;KAAkD,CAAA;IAC/D,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,WAAW;;;;KAAsD,CAAA;IACvE,MAAM,UAAU;;;;KAAqD,CAAA;IACrE,MAAM,QAAQ;;;;KAAmD,CAAA;IAEjE,MAAM,kBAAkB;;;;KAA4D,CAAA;IACpF,MAAM,gBAAgB;;;;KAA0D,CAAA;CACvF;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/types/model/authorization/PermissionContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionContext.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,kBAAkB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAI9E,qBAAa,iBAAiB;aAIZ,QAAQ,EAAE,QAAQ;aAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANhC,OAAO,CAAC,aAAa,CAAmD;gBAGvD,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,EACnC,mBAAmB,EAAE,mBAAmB,EACxC,cAAc,EAAE,qBAAqB;IAG1C,SAAS,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACnD,KAAK,EACL,MAAM,GACN,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAIb,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAAG,cAAc;IAInE,aAAa,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACvD,KAAK,EACL,MAAM,EACN,OAAO,GACP,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjC,OAAO,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMJ,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CAS7G"}
+{"version":3,"file":"PermissionContext.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,kBAAkB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAI9E,qBAAa,iBAAiB;aAIZ,QAAQ,EAAE,QAAQ;aAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANhC,OAAO,CAAC,aAAa,CAAmD;IAExE,YACiB,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,EACnC,mBAAmB,EAAE,mBAAmB,EACxC,cAAc,EAAE,qBAAqB,EACnD;IAES,SAAS,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACnD,KAAK,EACL,MAAM,GACN,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnB;IAEM,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAAG,cAAc,CAE/E;IAEY,aAAa,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,EAAE,EACvD,KAAK,EACL,MAAM,EACN,OAAO,GACP,EAAE;QACF,KAAK,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjC,OAAO,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;IAEY,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAQ5G;CACD"}

package/dist/types/model/authorization/PermissionContextFactory.d.ts

@@ -4,15 +4,26 @@ import { PermissionContext } from './PermissionContext.js';
 import { ProjectScopeFactory } from './ProjectScopeFactory.js';
 import { ProjectSchemaResolver } from '../type/index.js';
 import { DatabaseContext } from '../utils/index.js';
+import { Identity } from './Identity.js';
 export declare class PermissionContextFactory {
     private readonly authorizator;
     private readonly identityFactory;
     private readonly projectScopeFactory;
     private readonly schemaResolver;
-    constructor(authorizator: Authorizator, identityFactory: IdentityFactory, projectScopeFactory: ProjectScopeFactory, schemaResolver: ProjectSchemaResolver);
+    constructor(authorizator: Authorizator<Identity>, identityFactory: IdentityFactory, projectScopeFactory: ProjectScopeFactory, schemaResolver: ProjectSchemaResolver);
     create(db: DatabaseContext, args: {
         id: string;
         roles: readonly string[];
-    }): PermissionContext;
+    }, requestAuthorizator?: Authorizator<Identity>): PermissionContext;
+    /**
+     * Same as `create`, but resolves the custom-role definitions before returning, so
+     * the request never has to query for them while holding a transaction open.
+     */
+    createPreloaded(db: DatabaseContext, args: {
+        id: string;
+        roles: readonly string[];
+    }, requestAuthorizator?: Authorizator<Identity>): Promise<PermissionContext>;
+    private createAuthorizator;
+    private buildContext;
 }
 //# sourceMappingURL=PermissionContextFactory.d.ts.map

package/dist/types/model/authorization/PermissionContextFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionContextFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionContextFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAHd,YAAY,EAAE,YAAY,EAC1B,eAAe,EAAE,eAAe,EAChC,mBAAmB,EAAE,mBAAmB,EACxC,cAAc,EAAE,qBAAqB;IAGhD,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,iBAAiB;CAIrG"}
+{"version":3,"file":"PermissionContextFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionContextFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAJhC,YACkB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,EACpC,eAAe,EAAE,eAAe,EAChC,mBAAmB,EAAE,mBAAmB,EACxC,cAAc,EAAE,qBAAqB,EACnD;IAEG,MAAM,CACZ,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAC9C,mBAAmB,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,GAC1C,iBAAiB,CAGnB;IAED;;;OAGG;IACU,eAAe,CAC3B,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAC9C,mBAAmB,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAI5B;IAED,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,YAAY;CAQpB"}

package/dist/types/model/authorization/PermissionsFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionsFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionsFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAgBtD,cAAM,kBAAkB;IAChB,MAAM,IAAI,WAAW;CAsE5B;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}
+{"version":3,"file":"PermissionsFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/PermissionsFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AA0CtD,cAAM,kBAAkB;IAChB,MAAM,IAAI,WAAW,CA6E3B;CACD;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}

package/dist/types/model/authorization/ProjectScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScope.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/ProjectScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE1C,OAAO,EAAE,GAAG,EAAe,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,qBAAa,YAAa,YAAW,kBAAkB,CAAC,QAAQ,CAAC;IAE/D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,0BAA0B;gBAF1B,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,EACrB,0BAA0B,EAAE,0BAA0B;IAGlE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;CAgBhE"}
+{"version":3,"file":"ProjectScope.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/ProjectScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE1C,OAAO,EAAE,GAAG,EAAe,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,qBAAa,YAAa,YAAW,kBAAkB,CAAC,QAAQ,CAAC;IAE/D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAH5C,YACkB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,EACrB,0BAA0B,EAAE,0BAA0B,EACpE;IAEE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAe/D;CACD"}

package/dist/types/model/authorization/ProjectScopeFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScopeFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/ProjectScopeFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBAAvB,uBAAuB,EAAE,0BAA0B;IAG/D,MAAM,CAAC,cAAc,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;CAOjI"}
+{"version":3,"file":"ProjectScopeFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/ProjectScopeFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IADzC,YACkB,uBAAuB,EAAE,0BAA0B,EACjE;IAEE,MAAM,CAAC,cAAc,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAMhI;CACD"}

package/dist/types/model/authorization/Roles.d.ts

@@ -8,4 +8,12 @@ export declare enum TenantRole {
     PROJECT_ADMIN = "project_admin",
     ENTRYPOINT_DEPLOYER = "entrypoint_deployer"
 }
+/**
+ * Roles no delegated authority may ever grant, hold as a target, or impersonate.
+ * Enforced by the static PROJECT_ADMIN verifiers and by custom-role grants alike —
+ * keep it the single source, so a newly protected role cannot be added to one path only.
+ */
+export declare const NON_DELEGABLE_TENANT_ROLES: ReadonlySet<string>;
+/** Shared by custom-role slug validation and by role references inside grant configuration. */
+export declare const ROLE_SLUG_PATTERN: RegExp;
 //# sourceMappingURL=Roles.d.ts.map

package/dist/types/model/authorization/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/Roles.ts"],"names":[],"mappings":"AAAA,oBAAY,UAAU;IACrB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,mBAAmB,wBAAwB;CAC3C"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/Roles.ts"],"names":[],"mappings":"AAAA,oBAAY,UAAU;IACrB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,mBAAmB,wBAAwB;CAC3C;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAGzD,CAAA;AAEF,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,QAAsB,CAAA"}

package/dist/types/model/authorization/TargetIdentityPermission.d.ts

@@ -0,0 +1,15 @@
+import { DatabaseContext } from '../utils/index.js';
+import { IdentityQueryResult } from '../queries/index.js';
+import { TargetIdentityPermissionTarget } from './PermissionActions.js';
+/** Batches the identity lookup that precedes a target-identity permission check. */
+export declare const targetIdentityLoader: import("../../utils/batchQuery.js").BatchLoaderArgs<string, Record<string, IdentityQueryResult>, IdentityQueryResult | undefined>;
+export declare const createTargetIdentityPermissionTarget: (db: DatabaseContext, identity: {
+    readonly id: string;
+    readonly roles: readonly string[];
+}) => Promise<TargetIdentityPermissionTarget>;
+/** Convenience for the common case where the caller already holds the target's person row. */
+export declare const createPersonPermissionTarget: (db: DatabaseContext, person: {
+    readonly identity_id: string;
+    readonly roles: readonly string[];
+} | null) => Promise<TargetIdentityPermissionTarget | null>;
+//# sourceMappingURL=TargetIdentityPermission.d.ts.map

package/dist/types/model/authorization/TargetIdentityPermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TargetIdentityPermission.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/TargetIdentityPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAqD,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC5G,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAA;AASvE,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,mIAMhC,CAAA;AAED,eAAO,MAAM,oCAAoC,OAC5C,eAAe,YACT;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAClE,OAAO,CAAC,8BAA8B,CAMvC,CAAA;AAEF,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,OACpC,eAAe,UACX;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,KAChF,OAAO,CAAC,8BAA8B,GAAG,IAAI,CACyE,CAAA"}

package/dist/types/model/authorization/index.d.ts

@@ -3,9 +3,12 @@ export * from './Identity.js';
 export * from './IdentityFactory.js';
 export * from './IdentityScope.js';
 export * from './MembershipMatcher.js';
+export * from './CustomRoleAuthorizator.js';
+export * from './CustomRolePermissions.js';
 export * from './PermissionActions.js';
 export * from './PermissionContext.js';
 export * from './PermissionContextFactory.js';
+export * from './TargetIdentityPermission.js';
 export * from './PermissionsFactory.js';
 export * from './ProjectScope.js';
 export * from './ProjectScopeFactory.js';

package/dist/types/model/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAA;AAC/C,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAA;AAC/C,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,YAAY,CAAA"}

package/dist/types/model/commands/CommandBus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CommandBus.d.ts","sourceRoot":"","sources":["../../../../src/model/commands/CommandBus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,qBAAa,UAAU,CAAC,cAAc,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aACvE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAA1D,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAmB,SAAS,EAAE,SAAS;IAEpF,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,WAAW,CAAC,CAAC,EAClB,gBAAgB,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GACnF,OAAO,CAAC,CAAC,CAAC;CAGb"}
+{"version":3,"file":"CommandBus.d.ts","sourceRoot":"","sources":["../../../../src/model/commands/CommandBus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,qBAAa,UAAU,CAAC,cAAc,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aACvE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtF,YAA4B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAmB,SAAS,EAAE,SAAS,EAAI;IAExF,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEvD;IAEK,WAAW,CAAC,CAAC,EAClB,gBAAgB,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GACnF,OAAO,CAAC,CAAC,CAAC,CAEZ;CACD"}

package/dist/types/model/commands/apiKey/ApiKeyHelper.d.ts

@@ -1,6 +1,21 @@
 import { ApiKey } from '../../type/index.js';
 import { Providers } from '../../providers.js';
+import { Literal } from '@contember/database';
 export declare class ApiKeyHelper {
+    /**
+     * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance
+     * throttle (a write-rate optimization, not an auth gate). The value actually
+     * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.
+     */
     static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null;
+    /** Lifetime of a session key in seconds (`expiration` minutes, default 30). */
+    static getSessionExpirationSeconds(expiration?: number | null): number;
+    /**
+     * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the
+     * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares
+     * against the same clock and cannot be weakened by app/DB skew. NULL for
+     * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.
+     */
+    static getExpirationLiteral(type: ApiKey.Type, expiration?: number | null): Literal | null;
 }
 //# sourceMappingURL=ApiKeyHelper.d.ts.map

package/dist/types/model/commands/apiKey/ApiKeyHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/ApiKeyHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAI9C,qBAAa,YAAY;WACV,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;CAY7G"}
+{"version":3,"file":"ApiKeyHelper.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/ApiKeyHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAG7C,qBAAa,YAAY;IACxB;;;;OAIG;IACH,OAAc,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAW5G;IAED,+EAA+E;IAC/E,OAAc,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE5E;IAED;;;;;OAKG;IACH,OAAc,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,CAIhG;CACD"}

package/dist/types/model/commands/apiKey/CreateApiKeyCommand.d.ts

@@ -15,7 +15,11 @@ interface CreateSessionApiKeyArgs {
      * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).
      */
     idleTimeout?: string | null;
-    maxExpiresAt?: Date | null;
+    /**
+     * Absolute lifetime cap in seconds (A19). Written as `now() + interval` on the DB
+     * clock so the cap is compared against the same clock. NULL = uncapped.
+     */
+    maxExpirationSeconds?: number | null;
 }
 interface CreatePermanentApiKeyArgs {
     type: ApiKey.Type.PERMANENT;

package/dist/types/model/commands/apiKey/CreateApiKeyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/CreateApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAG5C,OAAO,EAAmC,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,UAAU,uBAAuB;IAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAC1B;AAED,UAAU,yBAAyB;IAClC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,UAAU,CAAC,EAAE,SAAS,CAAA;IACtB,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,MAAM,gBAAgB,GACzB,uBAAuB,GACvB,yBAAyB,CAAA;AAE5B,qBAAa,mBAAoB,YAAW,OAAO,CAAC,yBAAyB,CAAC;IACjE,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,gBAAgB;IAEpC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAyClF;AAED,qBAAa,yBAAyB;aACT,EAAE,EAAE,MAAM;aAAkB,KAAK,CAAC,EAAE,MAAM;gBAA1C,EAAE,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,MAAM,YAAA;CAEtE"}
+{"version":3,"file":"CreateApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/CreateApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAG5C,OAAO,EAAmC,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,UAAU,uBAAuB;IAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,UAAU,yBAAyB;IAClC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,UAAU,CAAC,EAAE,SAAS,CAAA;IACtB,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,MAAM,gBAAgB,GACzB,uBAAuB,GACvB,yBAAyB,CAAA;AAE5B,qBAAa,mBAAoB,YAAW,OAAO,CAAC,yBAAyB,CAAC;IACjE,OAAO,CAAC,IAAI;IAAxB,YAAoB,IAAI,EAAE,gBAAgB,EAAI;IAExC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA2CjF;CACD;AAED,qBAAa,yBAAyB;aACT,EAAE,EAAE,MAAM;aAAkB,KAAK,CAAC,EAAE,MAAM;IAAtE,YAA4B,EAAE,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,MAAM,YAAA,EACrE;CACD"}

package/dist/types/model/commands/apiKey/DisableApiKeyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/DisableApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,qBAAa,oBAAqB,YAAW,OAAO,CAAC,OAAO,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAUrD"}
+{"version":3,"file":"DisableApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/DisableApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,qBAAa,oBAAqB,YAAW,OAAO,CAAC,OAAO,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAArC,YAA6B,QAAQ,EAAE,MAAM,EAAI;IAE3C,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CASpD;CACD"}

package/dist/types/model/commands/apiKey/DisableIdentityApiKeysCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIdentityApiKeysCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,qBAAa,6BAA8B,YAAW,OAAO,CAAC,IAAI,CAAC;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEzC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlD"}
+{"version":3,"file":"DisableIdentityApiKeysCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,qBAAa,6BAA8B,YAAW,OAAO,CAAC,IAAI,CAAC;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,MAAM,EAAI;IAE7C,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CASjD;CACD"}

package/dist/types/model/commands/apiKey/DisableOneOffApiKeyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DisableOneOffApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAIvC,qBAAa,0BAA2B,YAAW,OAAO,CAAC,IAAI,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAWlD"}
+{"version":3,"file":"DisableOneOffApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAIvC,qBAAa,0BAA2B,YAAW,OAAO,CAAC,IAAI,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAArC,YAA6B,QAAQ,EAAE,MAAM,EAAI;IAE3C,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjD;CACD"}

package/dist/types/model/commands/apiKey/ProlongApiKeyCommand.d.ts

@@ -1,9 +1,11 @@
 import { Command } from '../Command.js';
 import { ApiKey } from '../../type/index.js';
 /**
- * Tracking writes (`last_used_at`) are throttled to at most once per this window, so
- * an idle check must add this slack to avoid prematurely expiring an active session
- * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
+ * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per
+ * this window, even when the IP or User-Agent changes: a key shared by several service replicas
+ * alternates between their addresses, and writing every change makes its row a lock hotspot.
+ * An idle check must add this slack to avoid prematurely expiring an active session whose
+ * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
  */
 export declare const PROLONG_THROTTLE_MS = 60000;
 export interface ApiKeyRequestInfo {
@@ -23,7 +25,7 @@ export declare class ProlongApiKeyCommand implements Command<void> {
     private readonly requestInfo?;
     private readonly tracking?;
     private readonly maxExpiresAt?;
-    constructor(id: string, type: ApiKey.Type, expiration: number | null, currentExpiration: Date | null, requestInfo?: ApiKeyRequestInfo | undefined, tracking?: ApiKeyTrackingState | undefined, maxExpiresAt?: (Date | null) | undefined);
+    constructor(id: string, type: ApiKey.Type, expiration: number | null, currentExpiration: Date | null, requestInfo?: ApiKeyRequestInfo | undefined, tracking?: ApiKeyTrackingState | undefined, maxExpiresAt?: Date | null | undefined);
     execute({ db, providers }: Command.Args): Promise<void>;
     private shouldUpdateTracking;
 }

package/dist/types/model/commands/apiKey/ProlongApiKeyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAI5C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,MAAM,WAAW,iBAAiB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB;AAED,qBAAa,oBAAqB,YAAW,OAAO,CAAC,IAAI,CAAC;IAExD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBANb,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,IAAI,EACjB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,iBAAiB,EAAE,IAAI,GAAG,IAAI,EAC9B,WAAW,CAAC,EAAE,iBAAiB,YAAA,EAC/B,QAAQ,CAAC,EAAE,mBAAmB,YAAA,EAC9B,YAAY,CAAC,GAAE,IAAI,GAAG,IAAI,aAAA;IAGtC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IA0C7D,OAAO,CAAC,oBAAoB;CAa5B"}
+{"version":3,"file":"ProlongApiKeyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAI5C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,MAAM,WAAW,iBAAiB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB;AAED,qBAAa,oBAAqB,YAAW,OAAO,CAAC,IAAI,CAAC;IAExD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAP/B,YACkB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,IAAI,EACjB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,iBAAiB,EAAE,IAAI,GAAG,IAAI,EAC9B,WAAW,CAAC,EAAE,iBAAiB,YAAA,EAC/B,QAAQ,CAAC,EAAE,mBAAmB,YAAA,EAC9B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,YAAA,EACxC;IAEE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD5D;IAED,OAAO,CAAC,oBAAoB;CAU5B"}

package/dist/types/model/commands/authLog/CreateAuthLogEntryCommand.d.ts

@@ -13,6 +13,7 @@ declare namespace CreateAuthLogEntryCommand {
         invokedById?: string;
         personInputIdentifier?: string;
         personId?: string;
+        /** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */
         personTokenId?: string;
         success: boolean;
         errorCode?: string;

package/dist/types/model/commands/authLog/CreateAuthLogEntryCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,qBAAa,yBAA0B,YAAW,OAAO,CAAC,IAAI,CAAC;IAE7D,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,yBAAyB,CAAC,KAAK;IAIjD,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAwB7D;AAED,kBAAU,yBAAyB,CAAC;IACnC,KAAY,KAAK,GAAG;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,yIAAyI;QACzI,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,qBAAqB,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,OAAO,EAAE,OAAO,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,EAAE,SAAS,CAAA;QACpB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,SAAS,CAAC,EAAE,SAAS,CAAA;QACrB,oFAAoF;QACpF,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,6DAA6D;QAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACD"}
+{"version":3,"file":"CreateAuthLogEntryCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,qBAAa,yBAA0B,YAAW,OAAO,CAAC,IAAI,CAAC;IAE7D,OAAO,CAAC,QAAQ,CAAC,IAAI;IADtB,YACkB,IAAI,EAAE,yBAAyB,CAAC,KAAK,EAEtD;IAEK,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5D;CACD;AAED,kBAAU,yBAAyB,CAAC;IACnC,KAAY,KAAK,GAAG;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,yIAAyI;QACzI,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,qBAAqB,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,8IAA8I;QAC9I,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,OAAO,EAAE,OAAO,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,EAAE,SAAS,CAAA;QACpB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,SAAS,CAAC,EAAE,SAAS,CAAA;QACrB,oFAAoF;QACpF,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,6DAA6D;QAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACD"}

package/dist/types/model/commands/authPolicy/CreateAuthPolicyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthPolicyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authPolicy/CreateAuthPolicyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,eAAe,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,OAAO,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjC,CAAA;AAED,iEAAiE;AACjE,qBAAa,uBAAwB,YAAW,OAAO,CAAC,MAAM,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,qBAAqB;IAEpD,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;CAqB/D"}
+{"version":3,"file":"CreateAuthPolicyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authPolicy/CreateAuthPolicyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,eAAe,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,OAAO,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjC,CAAA;AAED,iEAAiE;AACjE,qBAAa,uBAAwB,YAAW,OAAO,CAAC,MAAM,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,qBAAqB,EAAI;IAExD,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB9D;CACD"}

package/dist/types/model/commands/authPolicy/DeleteAuthPolicyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeleteAuthPolicyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,6EAA6E;AAC7E,qBAAa,uBAAwB,YAAW,OAAO,CAAC,OAAO,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,MAAM;IAEjC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAOrD"}
+{"version":3,"file":"DeleteAuthPolicyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,6EAA6E;AAC7E,qBAAa,uBAAwB,YAAW,OAAO,CAAC,OAAO,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,MAAM,EAAI;IAErC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAMpD;CACD"}

package/dist/types/model/commands/authPolicy/UpdateAuthPolicyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateAuthPolicyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,OAAO,CAAC,OAAO,CAAC;IAE9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QACxB,KAAK,CAAC,EAAE,eAAe,CAAA;QACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;QAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAClC;IAGI,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAkBhE"}
+{"version":3,"file":"UpdateAuthPolicyCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,OAAO,CAAC,OAAO,CAAC;IAE9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFxB,YACkB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QACxB,KAAK,CAAC,EAAE,eAAe,CAAA;QACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;QAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAClC,EACE;IAEE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB/D;CACD"}

package/dist/types/model/commands/backupCode/ConsumeBackupCodeCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConsumeBackupCodeCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/backupCode/ConsumeBackupCodeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,OAAO,CAAC,OAAO,CAAC;IAE/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG5B,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAehE"}
+{"version":3,"file":"ConsumeBackupCodeCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/backupCode/ConsumeBackupCodeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,OAAO,CAAC,OAAO,CAAC;IAE/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF1B,YACkB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAC9B;IAEE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAc/D;CACD"}

package/dist/types/model/commands/backupCode/CreateBackupCodeCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateBackupCodeCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/backupCode/CreateBackupCodeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC;;GAEG;AACH,qBAAa,uBAAwB,YAAW,OAAO,CAAC,IAAI,CAAC;IAE3D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG5B,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAW7D"}
+{"version":3,"file":"CreateBackupCodeCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/backupCode/CreateBackupCodeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC;;GAEG;AACH,qBAAa,uBAAwB,YAAW,OAAO,CAAC,IAAI,CAAC;IAE3D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF1B,YACkB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAC9B;IAEE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5D;CACD"}

package/dist/types/model/commands/backupCode/DeleteBackupCodesCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeleteBackupCodesCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/backupCode/DeleteBackupCodesCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC;;GAEG;AACH,qBAAa,wBAAyB,YAAW,OAAO,CAAC,IAAI,CAAC;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlD"}
+{"version":3,"file":"DeleteBackupCodesCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/backupCode/DeleteBackupCodesCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC;;GAEG;AACH,qBAAa,wBAAyB,YAAW,OAAO,CAAC,IAAI,CAAC;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAArC,YAA6B,QAAQ,EAAE,MAAM,EAAI;IAE3C,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjD;CACD"}

package/dist/types/model/commands/configuration/UpdateConfigurationCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/configuration/UpdateConfigurationCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAKtD,qBAAa,0BAA2B,YAAW,OAAO,CAAC,IAAI,CAAC;IAE9D,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,WAAW;IAItC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CA8E7D"}
+{"version":3,"file":"UpdateConfigurationCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/configuration/UpdateConfigurationCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAKtD,qBAAa,0BAA2B,YAAW,OAAO,CAAC,IAAI,CAAC;IAE9D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAD/B,YACkB,aAAa,EAAE,WAAW,EAE3C;IAEK,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E5D;CACD"}

package/dist/types/model/commands/customRole/CreateCustomRoleCommand.d.ts

@@ -0,0 +1,12 @@
+import { Command } from '../Command.js';
+/** Inserts a new `custom_role` row. Returns the generated id. */
+export declare class CreateCustomRoleCommand implements Command<string> {
+    private readonly values;
+    constructor(values: {
+        slug: string;
+        description: string | null;
+        grants: unknown;
+    });
+    execute({ db, providers }: Command.Args): Promise<string>;
+}
+//# sourceMappingURL=CreateCustomRoleCommand.d.ts.map