@dudousxd/nestjs-authz-mikro-orm 0.7.1 → 0.9.0

package/dist/mikro-orm-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mikro-orm-authz.store.d.ts","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AAM/D,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa,EAClC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM;IAGnC,gGAAgG;IAChG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAoBvC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWpD;;;;;OAKG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAe9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAuCzF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAY1F;;;;;OAKG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAchB,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAalE;;;;;;;OAOG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAmC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;;;;OAQG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyC7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
+{"version":3,"file":"mikro-orm-authz.store.d.ts","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AAY/D,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa,EAClC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM;IAGnC,gGAAgG;IAChG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,wFAAwF;IACxF,OAAO,CAAC,YAAY;IAIpB,8EAA8E;IAC9E,OAAO,CAAC,WAAW;IAQnB,4FAA4F;IAC5F,OAAO,CAAC,WAAW;IAQnB,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,SAAS;IAMxB;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAoBvC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWpD;;;;;OAKG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAe9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAuCzF;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1F;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB1F;;;;;;;OAOG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;OAGG;IACG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IA0BvF;;;;;;;;OAQG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAsC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,gFAAgF;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc5E;;;;;;;;OAQG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwDlF,6EAA6E;IACvE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAQ1E,2FAA2F;IACrF,iBAAiB,CACrB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC;CAIpB"}

package/dist/mikro-orm-authz.store.js

@@ -1,7 +1,10 @@
 import { randomUUID } from 'node:crypto';
 import { DEFAULT_ROLE_SOURCE, compareUserRoleAssignments, normalizeUserRef, roleFilterNames, } from '@dudousxd/nestjs-authz/store-kit';
-import { PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity } from './entities.js';
+import { GLOBAL_TENANT, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
 import { ensureAuthzSchema } from './schema.js';
+const TENANT_COLUMN_MISSING = 'MikroOrmAuthzStore: a tenant-scoped role assignment needs the tenantId column. Build the ' +
+    'entities with createAuthzEntitySchemas(names, { tenantScoped: true }) and widen the ' +
+    "user-role primary key (see the package README, 'Tenant-scoped roles').";
 /**
  * MikroORM-backed RBAC store. A plain POJO that receives the `EntityManager` in its
  * constructor — NOT `@Injectable`, no internal connection token (the app owns the
@@ -22,6 +25,33 @@ export class MikroOrmAuthzStore {
     ensureSchema() {
         return ensureAuthzSchema(this.em);
     }
+    // --- tenant scoping ---
+    /** True when the user-role entity maps `tenantId` (built with `tenantScoped: true`). */
+    tenantScoped(em) {
+        return em.getMetadata().find(UserRoleEntity.name)?.properties.tenantId !== undefined;
+    }
+    /** The `tenantId` value of a written assignment (`{}` without the column). */
+    tenantValue(em, tenantId) {
+        if (this.tenantScoped(em))
+            return { tenantId: tenantId ?? GLOBAL_TENANT };
+        if (tenantId !== undefined && tenantId !== GLOBAL_TENANT) {
+            throw new Error(TENANT_COLUMN_MISSING);
+        }
+        return {};
+    }
+    /** Assignments visible in a scope: global ones, plus the tenant's own when one is given. */
+    tenantWhere(em, scope) {
+        if (!this.tenantScoped(em))
+            return {};
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        return tenantId === GLOBAL_TENANT
+            ? { tenantId: GLOBAL_TENANT }
+            : { tenantId: { $in: [GLOBAL_TENANT, tenantId] } };
+    }
+    /** The public `tenantId` of a stored row: `null` for a global assignment. */
+    static rowTenant(row) {
+        return row.tenantId === undefined || row.tenantId === GLOBAL_TENANT ? null : row.tenantId;
+    }
     // --- roles & permissions (idempotent upserts by name) ---
     /**
      * Create the role if absent; returns its id. Idempotent and race-tolerant: it re-reads
@@ -180,37 +210,47 @@ export class MikroOrmAuthzStore {
     // --- user ↔ role ---
     /**
      * Assign a role to a user (creating the role by name if needed). Idempotent. `{ source }`
-     * (default `'manual'`) records where the assignment came from.
+     * (default `'manual'`) records where the assignment came from. `{ tenantId }` scopes it to that
+     * tenant; omitted, the assignment is global (applies in every tenant).
      */
     async assignRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
+        const em = this.em.fork();
+        const tenant = this.tenantValue(em, opts?.tenantId);
         const roleId = await this.createRole(roleName);
         const source = opts?.source ?? DEFAULT_ROLE_SOURCE;
-        const em = this.em.fork();
         const existing = await em.findOne(UserRoleEntity, {
             userType: type,
             userId: id,
             roleId,
             source,
+            ...tenant,
         });
         if (existing)
             return;
-        em.create(UserRoleEntity, { userType: type, userId: id, roleId, source });
+        em.create(UserRoleEntity, { userType: type, userId: id, roleId, source, ...tenant });
         await em.flush();
     }
     /**
      * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
-     * that source's assignment goes; without it, the role is removed from every source.
+     * that source's assignment goes; without it, the role is removed from every source. With
+     * tenant-scoped entities, `{ tenantId }` removes the assignment in that tenant and omitting it
+     * removes the global one.
      */
     async removeRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
+        const em = this.em.fork();
+        if (!this.tenantScoped(em) && opts?.tenantId !== undefined && opts.tenantId !== GLOBAL_TENANT) {
+            return; // no tenant column: there is no tenant-scoped assignment to remove
+        }
         const roleId = await this.findRoleId(roleName);
         if (!roleId)
             return;
-        await this.em.fork().nativeDelete(UserRoleEntity, {
+        await em.nativeDelete(UserRoleEntity, {
             userType: type,
             userId: id,
             roleId,
+            ...this.tenantValue(em, opts?.tenantId),
             ...(opts?.source !== undefined ? { source: opts.source } : {}),
         });
     }
@@ -219,48 +259,70 @@ export class MikroOrmAuthzStore {
      * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
      * on every login. Other sources' assignments are untouched, so a role held both manually and via
      * SSO survives an SSO sync that drops it. Roles are created by name when missing. Transactional.
+     * With tenant-scoped entities it replaces the assignments of one tenant (`{ tenantId }`), or the
+     * global ones when omitted.
      */
     async setUserRoles(user, roleNames, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = opts?.source ?? DEFAULT_ROLE_SOURCE;
+        const em = this.em.fork();
+        const tenant = this.tenantValue(em, opts?.tenantId);
         const roleIds = [];
         for (const name of new Set(roleNames))
             roleIds.push(await this.createRole(name));
-        await this.em.fork().transactional(async (tx) => {
-            await tx.nativeDelete(UserRoleEntity, { userType: type, userId: id, source });
+        await em.transactional(async (tx) => {
+            await tx.nativeDelete(UserRoleEntity, { userType: type, userId: id, source, ...tenant });
             for (const roleId of roleIds) {
-                tx.create(UserRoleEntity, { userType: type, userId: id, roleId, source });
+                tx.create(UserRoleEntity, { userType: type, userId: id, roleId, source, ...tenant });
             }
             await tx.flush();
         });
     }
-    /** Every role assignment of a user, one entry per `(role, source)`. */
-    async getRoleAssignments(user) {
+    /**
+     * Every role assignment of a user visible in a tenant scope (global ones always; the tenant's
+     * own with `{ tenantId }`), one entry per `(role, source, tenant)`.
+     */
+    async getRoleAssignments(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const em = this.em.fork();
-        const assignments = await em.find(UserRoleEntity, { userType: type, userId: id });
+        const assignments = await em.find(UserRoleEntity, {
+            userType: type,
+            userId: id,
+            ...this.tenantWhere(em, scope),
+        });
         if (assignments.length === 0)
             return [];
         const roles = await em.find(RoleEntity, { id: { $in: assignments.map((a) => a.roleId) } });
         const nameById = new Map(roles.map((r) => [r.id, r.name]));
         return assignments
             .filter((a) => nameById.has(a.roleId))
-            .map((a) => ({ role: nameById.get(a.roleId), source: a.source, tenantId: null }))
-            .sort((a, b) => a.role.localeCompare(b.role) || a.source.localeCompare(b.source));
+            .map((a) => ({
+            role: nameById.get(a.roleId),
+            source: a.source,
+            tenantId: MikroOrmAuthzStore.rowTenant(a),
+        }))
+            .sort((a, b) => a.role.localeCompare(b.role) ||
+            a.source.localeCompare(b.source) ||
+            (a.tenantId ?? '').localeCompare(b.tenantId ?? ''));
     }
     /**
      * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
      * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
      * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
      *
-     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
-     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     * `tenantId`: omitted = no tenant filter; `null` = global assignments only; a string = exactly
+     * that tenant's scoped assignments. Without tenant-scoped entities every row is global
+     * (`tenantId: null`), so a tenant id string matches nothing.
      */
     async listRoleAssignments(filter = {}) {
-        if (typeof filter.tenantId === 'string')
-            return [];
         const em = this.em.fork();
         const where = {};
+        if (filter.tenantId !== undefined) {
+            if (this.tenantScoped(em))
+                where.tenantId = filter.tenantId ?? GLOBAL_TENANT;
+            else if (filter.tenantId !== null)
+                return [];
+        }
         const roleNames = roleFilterNames(filter.role);
         if (roleNames !== undefined) {
             if (roleNames.length === 0)
@@ -291,7 +353,7 @@ export class MikroOrmAuthzStore {
             userId: a.userId,
             role: nameById.get(a.roleId),
             source: a.source,
-            tenantId: null,
+            tenantId: MikroOrmAuthzStore.rowTenant(a),
         }))
             .sort(compareUserRoleAssignments);
     }
@@ -304,14 +366,18 @@ export class MikroOrmAuthzStore {
         await this.em.fork().nativeDelete(UserRoleEntity, { userType: type, userId: id });
     }
     // --- queries ---
-    /** The role names a user holds. */
-    async getRolesForUser(user) {
+    /** The role names a user holds, in a tenant scope (see {@link TenantScope}). */
+    async getRolesForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const em = this.em.fork();
-        const assignments = await em.find(UserRoleEntity, { userType: type, userId: id });
+        const assignments = await em.find(UserRoleEntity, {
+            userType: type,
+            userId: id,
+            ...this.tenantWhere(em, scope),
+        });
         if (assignments.length === 0)
             return [];
-        const roleIds = assignments.map((a) => a.roleId);
+        const roleIds = [...new Set(assignments.map((a) => a.roleId))];
         const roles = await em.find(RoleEntity, { id: { $in: roleIds } });
         return roles.map((r) => r.name);
     }
@@ -324,7 +390,7 @@ export class MikroOrmAuthzStore {
      * returned set is the FULL granted permission name set, deduped — callers (incl. the
      * wildcard matcher) rely on getting every granted name (e.g. a granted `posts.*`).
      */
-    async getPermissionsForUser(user) {
+    async getPermissionsForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const em = this.em.fork();
         // Derive physical table + column names from metadata so we honor re-decorated entities.
@@ -349,27 +415,42 @@ export class MikroOrmAuthzStore {
         const urRoleId = col(userRole, 'roleId');
         const urUserType = col(userRole, 'userType');
         const urUserId = col(userRole, 'userId');
+        // Tenant scope: global assignments, plus the tenant's own when one is given.
+        const params = [type, id];
+        let tenantSql = '';
+        if (this.tenantScoped(em)) {
+            const urTenant = col(userRole, 'tenantId');
+            const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+            if (tenantId === GLOBAL_TENANT) {
+                tenantSql = ` and ur.${urTenant} = ?`;
+                params.push(GLOBAL_TENANT);
+            }
+            else {
+                tenantSql = ` and ur.${urTenant} in (?, ?)`;
+                params.push(GLOBAL_TENANT, tenantId);
+            }
+        }
         // Single round-trip: permission ← rolePermission ← userRole. Identifiers come from
         // entity metadata (trusted), values are bound as parameters (no SQL injection surface).
         const sql = `select distinct p.${permName} as name ` +
             `from ${permTable} p ` +
             `inner join ${rpTable} rp on rp.${rpPermId} = p.${permId} ` +
             `inner join ${urTable} ur on ur.${urRoleId} = rp.${rpRoleId} ` +
-            `where ur.${urUserType} = ? and ur.${urUserId} = ?`;
-        const rows = (await em.getConnection().execute(sql, [type, id]));
+            `where ur.${urUserType} = ? and ur.${urUserId} = ?${tenantSql}`;
+        const rows = (await em.getConnection().execute(sql, params));
         return [...new Set(rows.map((r) => r.name))];
     }
-    /** A user's roles + effective permissions in one shot. */
-    async getUserAuthz(user) {
+    /** A user's roles + effective permissions in one shot, in a tenant scope. */
+    async getUserAuthz(user, scope) {
         const [roles, permissions] = await Promise.all([
-            this.getRolesForUser(user),
-            this.getPermissionsForUser(user),
+            this.getRolesForUser(user, scope),
+            this.getPermissionsForUser(user, scope),
         ]);
         return { roles, permissions };
     }
-    /** True when the user holds `permission` through any of their roles. */
-    async userHasPermission(user, permission) {
-        const permissions = await this.getPermissionsForUser(user);
+    /** True when the user holds `permission` through any of their roles, in a tenant scope. */
+    async userHasPermission(user, permission, scope) {
+        const permissions = await this.getPermissionsForUser(user, scope);
         return permissions.includes(permission);
     }
 }

package/dist/mikro-orm-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"mikro-orm-authz.store.js","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAWhD;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAIV;IAHnB,2FAA2F;IAC3F,qFAAqF;IACrF,YACmB,EAAiB,EAClC,QAA+B,EAAE;QADhB,OAAE,GAAF,EAAE,CAAe;IAEjC,CAAC;IAEJ,gGAAgG;IAChG,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,2DAA2D;IAE3D;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;YACnC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACzC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxB,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,oFAAoF;QACpF,MAAM,GAAG,GACP,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB;YAC9E,QAAQ,IAAI,CAAC,SAAS,KAAK;YAC3B,aAAa,QAAQ,CAAC,SAAS,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YAC7F,aAAa,IAAI,CAAC,SAAS,WAAW,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG;YAC9F,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAGxD,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM;YACN,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC;QACnD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,IAAa;QACpC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;aAC1F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE;YACtC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE1B,wFAAwF;QACxF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEzC,mFAAmF;QACnF,wFAAwF;QACxF,MAAM,GAAG,GACP,qBAAqB,QAAQ,WAAW;YACxC,QAAQ,SAAS,KAAK;YACtB,cAAc,OAAO,aAAa,QAAQ,QAAQ,MAAM,GAAG;YAC3D,cAAc,OAAO,aAAa,QAAQ,SAAS,QAAQ,GAAG;YAC9D,YAAY,UAAU,eAAe,QAAQ,MAAM,CAAC;QAEtD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC5F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"mikro-orm-authz.store.js","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAyBhD,MAAM,qBAAqB,GACzB,2FAA2F;IAC3F,sFAAsF;IACtF,wEAAwE,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAIV;IAHnB,2FAA2F;IAC3F,qFAAqF;IACrF,YACmB,EAAiB,EAClC,QAA+B,EAAE;QADhB,OAAE,GAAF,EAAE,CAAe;IAEjC,CAAC;IAEJ,gGAAgG;IAChG,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,yBAAyB;IAEzB,wFAAwF;IAChF,YAAY,CAAC,EAAiB;QACpC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;IACvF,CAAC;IAED,8EAA8E;IACtE,WAAW,CAAC,EAAiB,EAAE,QAA4B;QACjE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,aAAa,EAAE,CAAC;QAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,4FAA4F;IACpF,WAAW,CAAC,EAAiB,EAAE,KAA8B;QACnE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,OAAO,QAAQ,KAAK,aAAa;YAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,6EAA6E;IACrE,MAAM,CAAC,SAAS,CAAC,GAA2C;QAClE,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5F,CAAC;IAED,2DAA2D;IAE3D;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;YACnC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACzC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxB,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,oFAAoF;QACpF,MAAM,GAAG,GACP,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB;YAC9E,QAAQ,IAAI,CAAC,SAAS,KAAK;YAC3B,aAAa,QAAQ,CAAC,SAAS,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YAC7F,aAAa,IAAI,CAAC,SAAS,WAAW,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG;YAC9F,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAGxD,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM;YACN,MAAM;YACN,GAAG,MAAM;SACV,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrF,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC9F,OAAO,CAAC,mEAAmE;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM;YACN,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;YACvC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAClC,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACzF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAa,EAAE,KAAmB;QACzD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;SAC1C,CAAC,CAAC;aACF,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CACrD,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,aAAa,CAAC;iBACxE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE;YACtC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;SAC1C,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,kBAAkB;IAElB,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,KAAmB;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa,EAAE,KAAmB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE1B,wFAAwF;QACxF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEzC,6EAA6E;QAC7E,MAAM,MAAM,GAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;YAClD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/B,SAAS,GAAG,WAAW,QAAQ,MAAM,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,WAAW,QAAQ,YAAY,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,mFAAmF;QACnF,wFAAwF;QACxF,MAAM,GAAG,GACP,qBAAqB,QAAQ,WAAW;YACxC,QAAQ,SAAS,KAAK;YACtB,cAAc,OAAO,aAAa,QAAQ,QAAQ,MAAM,GAAG;YAC3D,cAAc,OAAO,aAAa,QAAQ,SAAS,QAAQ,GAAG;YAC9D,YAAY,UAAU,eAAe,QAAQ,OAAO,SAAS,EAAE,CAAC;QAElE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAA4B,CAAC;QACxF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,KAAmB;QACnD,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,iBAAiB,CACrB,IAAa,EACb,UAAkB,EAClB,KAAmB;QAEnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/tenancy.d.ts

@@ -0,0 +1,100 @@
+import { type UserRef } from '@dudousxd/nestjs-authz/store-kit';
+import type { ModuleRef } from '@nestjs/core';
+/** A tenant as published by `@dudousxd/nestjs-context` (`Context.tenant()`). */
+export interface TenantRef {
+    id: string;
+    kind: string;
+    source: string;
+    slug?: string;
+    role?: string;
+}
+/** How the context says a lib must scope data right now (`Context.tenantFilter()`). */
+export type TenantFilter = {
+    mode: 'system';
+} | {
+    mode: 'all';
+} | {
+    mode: 'tenantless';
+} | {
+    mode: 'tenant';
+    tenant: TenantRef;
+};
+/**
+ * The RBAC module's `tenancy` option. `'inherit'` (default) follows `ContextModule`'s
+ * `tenancy.enabled`; `false` keeps this module out of tenancy.
+ */
+export type AuthzTenancyOption = 'inherit' | false | {
+    /** `'inherit'` (default) follows the context switch; a boolean overrides it. */
+    enabled?: 'inherit' | boolean;
+    /** Tenant kinds this module honours, instead of the context's `kinds`. */
+    kinds?: string[];
+    /**
+     * Accepted for the shared shape. It changes nothing here: a GLOBAL role assignment
+     * always applies, in every tenant.
+     */
+    nullRows?: 'tenantless' | 'shared';
+    /**
+     * Map the caller's role inside the context tenant (`tenant.role`) to authz roles that
+     * apply in that tenant's scope only, e.g. `{ owner: 'org_admin', member: 'org_member' }`.
+     * Unmapped roles grant nothing.
+     */
+    roles?: Record<string, string | readonly string[]>;
+};
+/**
+ * An explicit tenant for a check, from the user being checked. Return a tenant id to scope the
+ * check to it, `null` for the global scope, or `undefined` to fall back to the context.
+ */
+export type TenantResolver = (user: unknown) => string | null | undefined;
+/** The structural slice of nestjs-context's accessor this module reads. */
+export interface TenantContextAccessor {
+    tenantId?(): string | undefined;
+    userRef?(): {
+        type?: string;
+        id: string | number;
+    } | undefined;
+    tenancy?(): {
+        enabled: boolean;
+        kinds?: string[];
+    };
+    tenantFilter?(options?: {
+        kinds?: string[];
+    }): TenantFilter;
+}
+/** The tenant scope of one check, plus the roles `tenancy.roles` adds in that scope. */
+export interface RbacTenant {
+    scope: {
+        tenantId?: string;
+    };
+    roles: string[];
+}
+export interface ResolveRbacTenantInput {
+    /** The user as the Gate passed it. */
+    user: unknown;
+    /** The same user mapped to a store ref. */
+    ref: UserRef;
+    /** The module's explicit `tenant` resolver, if any. */
+    resolver?: TenantResolver | undefined;
+    /** The module's `tenancy` option. */
+    tenancy?: AuthzTenancyOption | undefined;
+    /** The context accessor found through DI, if any (else the global slot is read). */
+    accessor?: TenantContextAccessor | undefined;
+    /** With tenancy off, scope by the context's plain `tenantId()` (drizzle/typeorm behaviour). */
+    legacyContextTenant: boolean;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export declare function resolveRbacTenant(input: ResolveRbacTenantInput): RbacTenant;
+/** A provider's per-instance cache for {@link rbacTenant}'s accessor lookup. */
+export interface TenantContextCache {
+    resolved: boolean;
+    value: TenantContextAccessor | undefined;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export declare function rbacTenant(options: {
+    tenant?: TenantResolver | undefined;
+    tenancy?: AuthzTenancyOption | undefined;
+}, user: unknown, ref: UserRef, injected: TenantContextAccessor | undefined, moduleRef: ModuleRef | undefined, cache: TenantContextCache, legacyContextTenant: boolean): RbacTenant;
+//# sourceMappingURL=tenancy.d.ts.map

package/dist/tenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,KAAK,GACL;IACE,gFAAgF;IAChF,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC9B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1E,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/D,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,YAAY,CAAC;CAC7D;AAyDD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,2CAA2C;IAC3C,GAAG,EAAE,OAAO,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,qCAAqC;IACrC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,+FAA+F;IAC/F,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAgC3E;AA0BD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1C;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CACxB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC1F,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,kBAAkB,EACzB,mBAAmB,EAAE,OAAO,GAC3B,UAAU,CASZ"}

package/dist/tenancy.js

@@ -0,0 +1,128 @@
+// Tenancy for the RBAC module: which tenant scope a permission/role check runs in, and which
+// roles the caller's role inside the context tenant maps to. The same file ships in every
+// store adapter. It reads the @dudousxd/nestjs-context tenancy contract STRUCTURALLY (no import),
+// so it works with any context version, and with none: a missing or older context reads as
+// tenancy off.
+import { CONTEXT_ACCESSOR } from '@dudousxd/nestjs-authz';
+import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
+const SLOT = Symbol.for('@dudousxd/nestjs-diagnostics:accessor');
+/** Is tenancy on for this module? Call per check: the context can change between requests. */
+function readTenancy(option, a) {
+    if (option === false)
+        return { enabled: false };
+    if (typeof a?.tenancy !== 'function' || typeof a.tenantFilter !== 'function') {
+        return { enabled: false };
+    }
+    const own = typeof option === 'object' ? option : {};
+    const inherit = own.enabled === undefined || own.enabled === 'inherit';
+    if (!(inherit ? a.tenancy().enabled : own.enabled))
+        return { enabled: false };
+    const kinds = own.kinds;
+    const tenantFilter = a.tenantFilter.bind(a);
+    return { enabled: true, filter: () => tenantFilter(kinds ? { kinds } : undefined) };
+}
+/** The accessor found through DI, else the global slot `ContextModule` publishes. */
+function effectiveAccessor(injected) {
+    if (injected)
+        return injected;
+    const slot = globalThis[SLOT];
+    const current = slot?.current;
+    return current && typeof current === 'object' ? current : undefined;
+}
+/** Today's behaviour without tenancy: the context's plain `tenantId()`, read defensively. */
+function legacyTenantId(accessor) {
+    if (!accessor || typeof accessor.tenantId !== 'function')
+        return undefined;
+    try {
+        return accessor.tenantId() ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `ref` the context's current user? Tenant roles belong to the caller, nobody else. */
+function isContextUser(ref, accessor) {
+    let current;
+    try {
+        current = accessor?.userRef?.();
+    }
+    catch {
+        current = undefined;
+    }
+    if (!current || current.id === undefined || current.id === null)
+        return false;
+    const a = normalizeUserRef(ref);
+    const b = normalizeUserRef(current);
+    return a.type === b.type && a.id === b.id;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export function resolveRbacTenant(input) {
+    const explicit = input.resolver ? input.resolver(input.user) : undefined;
+    const accessor = effectiveAccessor(input.accessor);
+    const tenancy = readTenancy(input.tenancy, accessor);
+    const filter = tenancy.enabled ? tenancy.filter() : undefined;
+    let scope;
+    if (explicit !== undefined) {
+        scope = explicit === null ? {} : { tenantId: explicit };
+    }
+    else if (filter) {
+        scope = filter.mode === 'tenant' ? { tenantId: filter.tenant.id } : {};
+    }
+    else if (input.legacyContextTenant) {
+        const id = legacyTenantId(input.accessor);
+        scope = id === undefined ? {} : { tenantId: id };
+    }
+    else {
+        scope = {};
+    }
+    const map = typeof input.tenancy === 'object' ? input.tenancy.roles : undefined;
+    let roles = [];
+    if (map &&
+        filter?.mode === 'tenant' &&
+        filter.tenant.role !== undefined &&
+        scope.tenantId === filter.tenant.id &&
+        Object.prototype.hasOwnProperty.call(map, filter.tenant.role) &&
+        isContextUser(input.ref, accessor)) {
+        const mapped = map[filter.tenant.role];
+        roles = typeof mapped === 'string' ? [mapped] : [...(mapped ?? [])];
+    }
+    return { scope, roles };
+}
+/**
+ * Locate the context accessor. Prefers a value injected into the module; falls back to a
+ * non-strict {@link ModuleRef} lookup so an accessor provided by ANY module (the app root, a
+ * global ContextModule) is still found: the RBAC module is global and its providers don't import
+ * the app's modules, so a plain `@Inject` would miss a root-provided accessor.
+ */
+function resolveTenantContext(injected, moduleRef, cache) {
+    if (injected)
+        return injected;
+    if (cache.resolved)
+        return cache.value;
+    cache.resolved = true;
+    if (moduleRef) {
+        try {
+            cache.value = moduleRef.get(CONTEXT_ACCESSOR, { strict: false });
+        }
+        catch {
+            cache.value = undefined;
+        }
+    }
+    return cache.value;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export function rbacTenant(options, user, ref, injected, moduleRef, cache, legacyContextTenant) {
+    return resolveRbacTenant({
+        user,
+        ref,
+        resolver: options.tenant,
+        tenancy: options.tenancy,
+        accessor: resolveTenantContext(injected, moduleRef, cache),
+        legacyContextTenant,
+    });
+}
+//# sourceMappingURL=tenancy.js.map

package/dist/tenancy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,0FAA0F;AAC1F,kGAAkG;AAClG,2FAA2F;AAC3F,eAAe;AACf,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AA0DlF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAIjE,8FAA8F;AAC9F,SAAS,WAAW,CAClB,MAAsC,EACtC,CAAoC;IAEpC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;IACvE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,qFAAqF;AACrF,SAAS,iBAAiB,CACxB,QAA2C;IAE3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAI,UAA2E,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,QAA2C;IACjE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,GAAY,EAAE,QAA2C;IAC9E,IAAI,OAA2D,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAuBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,IAAI,KAA4B,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC1D,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;SAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IACE,GAAG;QACH,MAAM,EAAE,IAAI,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAChC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE;QACnC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7D,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAClC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,QAA2C,EAC3C,SAAgC,EAChC,KAAsE;IAEtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACvC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAwB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAQD,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CACxB,OAA0F,EAC1F,IAAa,EACb,GAAY,EACZ,QAA2C,EAC3C,SAAgC,EAChC,KAAyB,EACzB,mBAA4B;IAE5B,OAAO,iBAAiB,CAAC;QACvB,IAAI;QACJ,GAAG;QACH,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;QAC1D,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC"}