@dudousxd/nestjs-authz-prisma 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @dudousxd/nestjs-authz-prisma
 
+## 0.7.0
+
+### Minor Changes
+
+- Back on the 0.x line. The 1.x and 2.x versions were published by accident: a release-tooling peer cascade bumped this package to a major, not an API decision. 0.7.0 contains everything those versions shipped (console `authorize` support, tenancy, Node 24+ `engines`) with no other change. Upgrade from 1.x/2.x to 0.7.0; those versions are deprecated.
+
+## 2.0.0
+
+### Major Changes
+
+- [#74](https://github.com/DavideCarvalho/nestjs-authz/pull/74) [`35421dc`](https://github.com/DavideCarvalho/nestjs-authz/commit/35421dc5b09bd271d5087d26e8536191ef6ba342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - **Breaking:** require Node.js 24 or newer (`engines.node` is now `>=24`; it was `>=22`, and `>=20` for `-client` and `-react`). CI tests on Node 24 and 26. No API changes: see the Upgrading page in the docs.
+
+## 1.1.1
+
+### Patch Changes
+
+- [#73](https://github.com/DavideCarvalho/nestjs-authz/pull/73) [`9fd6787`](https://github.com/DavideCarvalho/nestjs-authz/commit/9fd6787307361b8552236a833d969fa041a46bca) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix the `$queryRaw` permission fast path: it is now called on the client instead of detached from it. A real `PrismaClient` threw on the unbound call, so every permission check silently fell back to the three-query path.
+
+## 1.1.0
+
+### Minor Changes
+
+- [#72](https://github.com/DavideCarvalho/nestjs-authz/pull/72) [`58a5d72`](https://github.com/DavideCarvalho/nestjs-authz/commit/58a5d72d2964a7cfae9cbfe8506526c8518ba30a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Tenancy for the RBAC modules, following the `@dudousxd/nestjs-context` tenancy switch.
+
+  - New `tenancy` option (`'inherit' | false | { enabled?, kinds?, nullRows?, roles? }`, default `'inherit'`). With context tenancy on, permission and role checks are scoped to the request's tenant from `Context.setTenant`. A request with no tenant, inside `Context.allTenants()`, or outside a request sees global assignments only. `kinds` limits the tenant kinds this module honours. With tenancy off nothing changes.
+  - `tenancy.roles` maps the caller's role inside the tenant (`tenant.role`) to authz roles that apply in that tenant only, e.g. `{ owner: 'org_admin' }`.
+  - New `tenant` resolver option, `(user) => tenantId | null | undefined`: an explicit tenant that wins over the context.
+  - MikroORM and Prisma can now store tenant-scoped role assignments like Drizzle and TypeORM: `assignRole`, `removeRole` and `setUserRoles` take `{ tenantId }`, and the read methods take a tenant scope. MikroORM: build the entities with `createAuthzEntitySchemas({}, { tenantScoped: true })`. Prisma: add `tenantId String @default("")` to `UserRole` and its `@@id`, then pass `tenantScoped: true`. Without that, every assignment stays global.
+
+## 1.0.0
+
+### Patch Changes
+
+- Updated dependencies [[`750a6b3`](https://github.com/DavideCarvalho/nestjs-authz/commit/750a6b3f80deea3803dec8df5f9f8cf67a046ac1)]:
+  - @dudousxd/nestjs-authz@0.10.0
+
+## 0.6.0
+
+### Minor Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Run on `@dudousxd/nestjs-authz` 0.9 and `@nestjs/authorization`: persisted roles and
+  permissions now guard routes through the official guard as the core's `RolePolicy` /
+  `PermissionPolicy` (`@Roles('editor')`, `@Permission('posts.publish')`), and the guard and the
+  handler's `Gate` calls share one permission and role fetch per request. The store API
+  (role sources, admin management, tenant-scoped roles where supported) and `AuthzRbacModule`
+  are unchanged. A persisted permission named like a policy ability no longer bypasses that
+  policy (see the core changeset). Requires NestJS 12, `@nestjs/authorization` ^0.1.3 and Node 22+.
+
+### Patch Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix packages that could be published without files their `exports` point to. `tsc` builds no longer use a `.tsbuildinfo` that can outlive `dist/` and skip emitting files. A new `check:exports` step (also `prepack`) fails the release if any `exports`/`main`/`types` path is missing.
+
 ## 0.5.1
 
 ### Patch Changes

package/README.md

@@ -1,7 +1,7 @@
 # @dudousxd/nestjs-authz-prisma
 
 Prisma RBAC persistence for [`@dudousxd/nestjs-authz`](https://github.com/DavideCarvalho/nestjs-authz) —
-roles, permissions, and a Gate seam, with **zero connection ownership** (your app owns the
+roles and permissions for the official `@nestjs/authorization` policies, with **zero connection ownership** (your app owns the
 `PrismaClient`; this package never opens a connection and never imports `@prisma/client`).
 
 This is the Prisma sibling of `@dudousxd/nestjs-authz-typeorm`: identical store surface and
@@ -10,7 +10,7 @@ This is the Prisma sibling of `@dudousxd/nestjs-authz-typeorm`: identical store
 ## Install
 
 ```bash
-pnpm add @dudousxd/nestjs-authz-prisma @dudousxd/nestjs-authz
+pnpm add @dudousxd/nestjs-authz-prisma @dudousxd/nestjs-authz @nestjs/authorization
 ```
 
 No `@prisma/client` is required by this package — it depends only on the structural
@@ -92,16 +92,30 @@ AuthzRbacModule.forRootAsync({
 });
 ```
 
-Once wired, the Gate consults persisted RBAC:
+Once wired, persisted roles and permissions guard routes through the official
+`@nestjs/authorization` guard, as the core's `RolePolicy` / `PermissionPolicy`:
 
 ```ts
-await store.givePermissionToRole('editor', 'posts.publish');
+await store.givePermissionToRole('editor', 'posts.*');
 await store.assignRole({ type: 'user', id: 7 }, 'editor');
 
-gate.forUser(user).allows('posts.publish'); // true (PERMISSION_PROVIDER seam, wildcards supported)
-gate.forUser(user).hasRole('editor');       // true (ROLE_PROVIDER seam)
+@Permission('posts.publish')                                  // posts.* grants it
+@Can(PermissionPolicy, 'has', permission('posts.publish'))   // the same, spelled out
+@Roles('editor')                                              // @Can(RolePolicy, 'has', roles('editor'))
 ```
 
+and in services, through the `Gate`:
+
+```ts
+gate.forUser(user).allows('posts.publish');               // true (PERMISSION_PROVIDER seam)
+gate.forUser(user).allows(PermissionPolicy, 'has', 'posts.publish');
+gate.forUser(user).hasRole('editor');                     // true (ROLE_PROVIDER seam)
+```
+
+The user is the one the official guard reads (`AuthorizationModule.forRoot({ getUser })`,
+default `request.user`), mapped to a store ref with `userRefFrom` (default `{ type, id }` or
+`{ id }`).
+
 ## Role sources (manual vs SSO/SCIM)
 
 Every role assignment records a `source`. It defaults to `'manual'`, so existing calls and existing
@@ -171,10 +185,70 @@ await store.listRoleAssignments({ user: { type: 'user', id: 7 } });
 await store.removeUser({ type: 'user', id: 7 });
 ```
 
-This adapter has no tenant-scoped assignments, so every row has `tenantId: null`:
-`listRoleAssignments({ tenantId: null })` lists everything and a tenant id string matches
-nothing. Without `roleSources: true` every row is `'manual'`, so filtering by another
-`source` matches nothing.
+`tenantId` filters: omitted = every tenant, `null` = global assignments only, a string = that
+tenant's scoped assignments only. Without `tenantScoped: true` (below) every row has
+`tenantId: null`, so a tenant id string matches nothing. Without `roleSources: true` every row
+is `'manual'`, so filtering by another `source` matches nothing.
+
+## Tenant-scoped roles
+
+Tenant-scoped assignments are opt-in. Add the column to `UserRole` and its `@@id`, then run
+`prisma migrate dev` (existing rows get `''`, a global assignment):
+
+```prisma
+model UserRole {
+  userType String
+  userId   String
+  roleId   String
+  tenantId String @default("")
+
+  @@id([userType, userId, roleId, tenantId])
+  @@index([userType, userId])
+  @@map("authz_user_role")
+}
+```
+
+Then turn it on: `new PrismaAuthzStore(prisma, { tenantScoped: true })`, or
+`AuthzRbacModule.forRoot({ client: prisma, tenantScoped: true })`.
+
+```ts
+await store.assignRole(user, 'editor', { tenantId: 'acme' }); // only inside acme
+await store.assignRole(user, 'viewer');                        // everywhere
+await store.getRolesForUser(user, { tenantId: 'acme' });      // ['editor', 'viewer']
+await store.getRolesForUser(user);                            // ['viewer']
+```
+
+`removeRole` and `setUserRoles` take the same `{ tenantId }` (omitted = the global
+assignments). Without `tenantScoped`, every assignment is global and reads ignore the tenant.
+`assignRole` and `setUserRoles` with a `tenantId` throw; `removeRole` with one does nothing,
+since there is no tenant assignment to remove.
+
+## Tenancy
+
+The RBAC module reads the tenant only when tenancy is on: turn it on with
+`ContextModule.forRoot({ tenancy: { enabled: true } })` in `@dudousxd/nestjs-context`. Checks
+are then scoped to the request's tenant from `Context.setTenant(...)`.
+A request with no tenant, or inside `Context.allTenants()`, sees global assignments only.
+
+```ts
+AuthzRbacModule.forRoot({
+  client: prisma,
+  tenantScoped: true,
+  tenancy: {
+    kinds: ['organization'],                  // optional: tenant kinds this module honours
+    roles: { owner: 'org_admin', member: 'org_member' }, // optional: tenant.role → authz roles in that tenant
+  },
+  tenant: (user) => (user as { orgId?: string }).orgId, // optional: an explicit tenant wins over the context
+});
+```
+
+`tenancy` defaults to `'inherit'` (follow the context switch); `false` keeps this module out.
+Roles mapped with `roles` apply only inside that tenant and only to the context's current user.
+The `tenant` resolver returns a tenant id, `null` for the global scope, or `undefined` to fall
+back to the context.
+
+With tenancy on and without `tenantScoped`, every assignment is global, so only `roles` and the
+`tenant` resolver change what a check sees.
 
 ## License
 

package/dist/authz-rbac.module.d.ts

@@ -2,6 +2,7 @@ import type { UserRef } from '@dudousxd/nestjs-authz/store-kit';
 import { type DynamicModule } from '@nestjs/common';
 import { PrismaAuthzStore } from './prisma-authz.store.js';
 import { type PrismaAuthzClientLike } from './prisma-client.js';
+import { type AuthzTenancyOption, type TenantResolver } from './tenancy.js';
 /** Injection token holding the {@link PrismaAuthzStore} the RBAC module manages. */
 export declare const AUTHZ_RBAC_STORE: unique symbol;
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
@@ -30,11 +31,27 @@ export interface AuthzRbacModuleOptions {
      * `source` column on `UserRole`. Only used when the module builds the store from `client`.
      */
     roleSources?: boolean;
+    /**
+     * Tenant-scoped role assignments (see {@link PrismaAuthzStoreOptions.tenantScoped}); requires
+     * the `tenantId` column on `UserRole`. Only used when the module builds the store from `client`.
+     */
+    tenantScoped?: boolean;
     /**
      * Derive a {@link UserRef} from the Gate's current user. Defaults to
      * {@link defaultUserRefMapper} (`{ type, id }` or `{ id }`).
      */
     userRefFrom?: UserRefMapper;
+    /**
+     * Tenancy, from `@dudousxd/nestjs-context`. `'inherit'` (default) follows `ContextModule`'s
+     * `tenancy.enabled`; with it on, checks are scoped to the context tenant. The object form adds
+     * `kinds` and `roles` (map the caller's `tenant.role` to authz roles in that tenant).
+     */
+    tenancy?: AuthzTenancyOption;
+    /**
+     * Explicit tenant for a check, from the user being checked. Wins over the context: return a
+     * tenant id, `null` for the global scope, or `undefined` to fall back to the context.
+     */
+    tenant?: TenantResolver;
 }
 export interface AuthzRbacModuleAsyncOptions {
     imports?: unknown[];

package/dist/authz-rbac.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,eAAoD,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAsD,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oFAAoF;IACpF,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAsFD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}
+{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAEtB,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,eAAoD,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAsD,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oFAAoF;IACpF,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AA0ID;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}

package/dist/authz-rbac.module.js

@@ -11,9 +11,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var AuthzRbacModule_1;
-import { PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
+import { CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { PrismaAuthzStore } from './prisma-authz.store.js';
+import { rbacTenant, } from './tenancy.js';
 /** Injection token holding the {@link PrismaAuthzStore} the RBAC module manages. */
 export const AUTHZ_RBAC_STORE = Symbol.for('@dudousxd/nestjs-authz-prisma:store');
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
@@ -35,7 +37,10 @@ function resolveStore(options) {
     if (options.store)
         return options.store;
     if (options.client) {
-        return new PrismaAuthzStore(options.client, options.roleSources ? { roleSources: true } : {});
+        return new PrismaAuthzStore(options.client, {
+            ...(options.roleSources ? { roleSources: true } : {}),
+            ...(options.tenantScoped ? { tenantScoped: true } : {}),
+        });
     }
     throw new Error('AuthzRbacModule (prisma): provide either `store` or `client` in the options.');
 }
@@ -46,13 +51,27 @@ function resolveStore(options) {
  */
 let RbacPermissionProvider = class RbacPermissionProvider {
     options;
+    context;
+    moduleRef;
     // `getPermissions` lists every grant `hasPermission` can find, for any resource.
     exhaustivePermissions = true;
     store;
-    constructor(options) {
+    contextCache = { resolved: false, value: undefined };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
         this.store = resolveStore(options);
     }
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, false);
+    }
+    /** The permissions `tenancy.roles` grants through the caller's role in the tenant. */
+    async tenantRolePermissions(roles) {
+        if (roles.length === 0)
+            return [];
+        return Object.values(await this.store.getRolePermissions(roles)).flat();
+    }
     // The core `PermissionProvider` interface passes an optional `resource` (3rd
     // arg); it is intentionally ignored here. RBAC grants are model-less,
     // named-ability grants (the Laravel/spatie `Gate::before` grant), so the
@@ -62,7 +81,10 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.store.userHasPermission(ref, permission);
+        const tenant = this.tenant(user, ref);
+        if (await this.store.userHasPermission(ref, permission, tenant.scope))
+            return true;
+        return (await this.tenantRolePermissions(tenant.roles)).includes(permission);
     }
     // Expose the user's full granted permission set so the core can apply
     // Laravel/spatie-style wildcard matching (a granted `posts.*` satisfies a check
@@ -72,13 +94,20 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.store.getPermissionsForUser(ref);
+        const tenant = this.tenant(user, ref);
+        const own = await this.store.getPermissionsForUser(ref, tenant.scope);
+        if (tenant.roles.length === 0)
+            return own;
+        return [...new Set([...own, ...(await this.tenantRolePermissions(tenant.roles))])];
     }
 };
 RbacPermissionProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacPermissionProvider);
 /**
  * The RBAC {@link RoleProvider} the Gate consults (via the shared {@link ROLE_PROVIDER}
@@ -88,23 +117,36 @@ RbacPermissionProvider = __decorate([
  */
 let RbacRoleProvider = class RbacRoleProvider {
     options;
+    context;
+    moduleRef;
     store;
-    constructor(options) {
+    contextCache = { resolved: false, value: undefined };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
         this.store = resolveStore(options);
     }
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, false);
+    }
     async getRoles(user) {
         const map = this.options.userRefFrom ?? defaultUserRefMapper;
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.store.getRolesForUser(ref);
+        const tenant = this.tenant(user, ref);
+        const own = await this.store.getRolesForUser(ref, tenant.scope);
+        return tenant.roles.length === 0 ? own : [...new Set([...own, ...tenant.roles])];
     }
 };
 RbacRoleProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacRoleProvider);
 /**
  * Runs `ensureSchema` on bootstrap when `autoCreateSchema` is enabled. For Prisma this is

package/dist/authz-rbac.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAwCtF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAA+B;IACnD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;AAClG,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAK+B;IAJzD,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,KAAK,CAAmB;IACzC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QACtF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CACF,CAAA;AA7BK,sBAAsB;IAD3B,UAAU,EAAE;IAME,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GALnC,sBAAsB,CA6B3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAEqC;IADxC,KAAK,CAAmB;IACzC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QACtF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAZK,gBAAgB;IADrB,UAAU,EAAE;IAGE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFnC,gBAAgB,CAYrB;AAED;;;GAGG;AACH,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACnD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;gBACtE,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;oBAChE,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}
+{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAML,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAwDtF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAA+B;IACnD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;AAClG,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAQqB;IACU;IAC1B;IAT/B,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,KAAK,CAAmB;IACxB,YAAY,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE1F,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;QAElD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,qBAAqB,CAAC,KAAe;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;CACF,CAAA;AA1DK,sBAAsB;IAD3B,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAVhD,sBAAsB,CA0D3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAK2B;IACU;IAC1B;IANd,KAAK,CAAmB;IACxB,YAAY,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE1F,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;QAElD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;CACF,CAAA;AAhCK,gBAAgB;IADrB,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAPhD,gBAAgB,CAgCrB;AAED;;;GAGG;AACH,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACnD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;gBACtE,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;oBAChE,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 export { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, type PrismaAuthzClientLike, type PrismaAuthzStoreOptions, type PrismaModelDelegate, } from './prisma-client.js';
-export { PrismaAuthzStore } from './prisma-authz.store.js';
-export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, UserAuthz, UserRoleAssignment, } from './prisma-authz.store.js';
+export { GLOBAL_TENANT, PrismaAuthzStore } from './prisma-authz.store.js';
+export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, TenantScope, UserAuthz, UserRoleAssignment, } from './prisma-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
+export type { AuthzTenancyOption, TenantResolver } from './tenancy.js';
 export type { UserRef, UserRefInput } from '@dudousxd/nestjs-authz/store-kit';
 export { applyScope, compileScope } from './scope.js';
 export type { PrismaWhere, ScopeResolver } from './scope.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 export { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, } from './prisma-client.js';
-export { PrismaAuthzStore } from './prisma-authz.store.js';
+export { GLOBAL_TENANT, PrismaAuthzStore } from './prisma-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export { applyScope, compileScope } from './scope.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQ3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAS1E,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/prisma-authz.store.d.ts

@@ -1,10 +1,23 @@
 import { type RoleAssignment, type RoleAssignmentFilter, type UserAuthz, type UserRef, type UserRoleAssignment } from '@dudousxd/nestjs-authz/store-kit';
 import { type PrismaAuthzClientLike, type PrismaAuthzStoreOptions } from './prisma-client.js';
 export type { RoleAssignment, RoleAssignmentFilter, UserAuthz, UserRoleAssignment };
-/** Assignment source for role mutations (default `'manual'`) — see `setUserRoles`. */
-export interface RoleSourceOptions {
+/**
+ * Optional tenant scope for a query. Omitted → the GLOBAL scope (only global assignments; a
+ * tenant-scoped role never leaks into an unscoped check). With a `tenantId`, global assignments
+ * AND that tenant's apply. Needs `tenantScoped: true`; without it every assignment is global.
+ */
+export interface TenantScope {
+    tenantId?: string;
+}
+/**
+ * Assignment source (default `'manual'`, needs `roleSources: true`) and tenant (needs
+ * `tenantScoped: true`) for role mutations — see `setUserRoles`.
+ */
+export interface RoleSourceOptions extends TenantScope {
     source?: string;
 }
+/** The tenant id of a GLOBAL role assignment (applies in every tenant). */
+export declare const GLOBAL_TENANT = "";
 /**
  * Prisma-backed RBAC store. Receives the app-owned Prisma client via the
  * {@link PRISMA_CLIENT} DI token — NO internal connection ownership, NO `@prisma/client`
@@ -22,6 +35,12 @@ export declare class PrismaAuthzStore {
      * `{}` otherwise (legacy schema without the column) — where a non-default source is an error.
      */
     private sourceField;
+    /** The `tenantId` value of a written assignment (`{}` without `tenantScoped`). */
+    private tenantField;
+    /** Assignments visible in a scope: global ones, plus the tenant's own when one is given. */
+    private tenantWhere;
+    /** The public `tenantId` of a stored row: `null` for a global assignment. */
+    private static rowTenant;
     /**
      * No-op: Prisma is schema-first / consumer-managed. Declare the RBAC models in your
      * `schema.prisma` (see {@link PrismaAuthzClientLike}) and apply them with
@@ -68,7 +87,9 @@ export declare class PrismaAuthzStore {
     assignRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
     /**
      * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
-     * that source's assignment goes; without it, the role is removed from every source.
+     * that source's assignment goes; without it, the role is removed from every source. With
+     * `tenantScoped`, `{ tenantId }` removes the assignment in that tenant and omitting it removes
+     * the global one.
      */
     removeRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
     /**
@@ -76,18 +97,23 @@ export declare class PrismaAuthzStore {
      * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
      * on every login; other sources' assignments are untouched. Roles are created by name when
      * missing. Atomic when the client has `$transaction`. Without `roleSources: true` there is only
-     * one (implicit manual) source, so this replaces ALL of the user's roles.
+     * one (implicit manual) source, so this replaces ALL of the user's roles. With `tenantScoped` it
+     * replaces the assignments of one tenant (`{ tenantId }`), or the global ones when omitted.
      */
     setUserRoles(user: UserRef, roleNames: readonly string[], opts?: RoleSourceOptions): Promise<void>;
-    /** Every role assignment of a user, one entry per `(role, source)`. */
-    getRoleAssignments(user: UserRef): Promise<RoleAssignment[]>;
+    /**
+     * Every role assignment of a user visible in a tenant scope (global ones always; the tenant's
+     * own with `{ tenantId }`), one entry per `(role, source, tenant)`.
+     */
+    getRoleAssignments(user: UserRef, scope?: TenantScope): Promise<RoleAssignment[]>;
     /**
      * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
      * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
      * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
      *
-     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
-     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     * `tenantId`: omitted = no tenant filter; `null` = global assignments only; a string = exactly
+     * that tenant's scoped assignments. Without `tenantScoped: true` every row is global
+     * (`tenantId: null`), so a tenant id string matches nothing.
      * Without `roleSources: true` every row is `'manual'`, so another `source` matches nothing.
      */
     listRoleAssignments(filter?: RoleAssignmentFilter): Promise<UserRoleAssignment[]>;
@@ -96,8 +122,8 @@ export declare class PrismaAuthzStore {
      * Roles and permissions are kept. (This adapter has no direct user permissions.)
      */
     removeUser(user: UserRef): Promise<void>;
-    /** The role names a user holds. */
-    getRolesForUser(user: UserRef): Promise<string[]>;
+    /** The role names a user holds, in a tenant scope (see {@link TenantScope}). */
+    getRolesForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
     /**
      * The flattened, distinct permission names a user has via their roles.
      *
@@ -107,12 +133,11 @@ export declare class PrismaAuthzStore {
      *
      * Fast path: when the injected client exposes `$queryRaw`, assemble the set in a
      * SINGLE database round-trip via one JOIN (3 round-trips → 1). On ANY failure
-     * (missing `$queryRaw`, custom `@@map` table names, non-Postgres identifier
-     * quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
+     * (custom `@@map` table names, non-Postgres identifier quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
      * is preserved everywhere and only the common (Postgres + documented schema) case
      * gets the speedup.
      */
-    getPermissionsForUser(user: UserRef): Promise<string[]>;
+    getPermissionsForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
     /**
      * The original three-query implementation (userRole → rolePermission → permission),
      * returning the same deduped permission-name set as {@link getPermissionsForUser}.
@@ -120,9 +145,9 @@ export declare class PrismaAuthzStore {
      * fast path throws.
      */
     private getPermissionsViaDelegates;
-    /** A user's roles + effective permissions in one shot. */
-    getUserAuthz(user: UserRef): Promise<UserAuthz>;
-    /** True when the user holds `permission` through any of their roles. */
-    userHasPermission(user: UserRef, permission: string): Promise<boolean>;
+    /** A user's roles + effective permissions in one shot, in a tenant scope. */
+    getUserAuthz(user: UserRef, scope?: TenantScope): Promise<UserAuthz>;
+    /** True when the user holds `permission` through any of their roles, in a tenant scope. */
+    userHasPermission(user: UserRef, permission: string, scope?: TenantScope): Promise<boolean>;
 }
 //# sourceMappingURL=prisma-authz.store.d.ts.map

package/dist/prisma-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAGvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,MAAM,EAAE,qBAAqB,EAG7B,OAAO,GAAE,uBAA4B;IAGxD;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF,gGAAgG;YAClF,aAAa;IAO3B;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpD;;;;;;OAMG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IA2BzF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1F;;;;;;OAMG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAchB,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoBlE;;;;;;;;OAQG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAqC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0B7D;;;;;OAKG;YACW,0BAA0B;IAiBxC,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
+{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,eAAO,MAAM,aAAa,KAAK,CAAC;AAOhC;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAGvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,MAAM,EAAE,qBAAqB,EAG7B,OAAO,GAAE,uBAA4B;IAGxD;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAUnB,4FAA4F;IAC5F,OAAO,CAAC,WAAW;IAQnB,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,SAAS;IAKxB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF,gGAAgG;YAClF,aAAa;IAO3B;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpD;;;;;;OAMG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IA2BzF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc1F;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1F;;;;;;;OAOG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;OAGG;IACG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAyBvF;;;;;;;;;OASG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAwC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,gFAAgF;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAW5E;;;;;;;;;;;;OAYG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAsClF;;;;;OAKG;YACW,0BAA0B;IAqBxC,6EAA6E;IACvE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAQ1E,2FAA2F;IACrF,iBAAiB,CACrB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC;CAIpB"}