@dudousxd/nestjs-authz-prisma 0.5.1 → 0.7.0

package/dist/prisma-authz.store.js

@@ -10,9 +10,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var PrismaAuthzStore_1;
 import { randomUUID } from 'node:crypto';
 import { DEFAULT_ROLE_SOURCE, compareUserRoleAssignments, normalizeUserRef, roleFilterNames, } from '@dudousxd/nestjs-authz/store-kit';
 import { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, } from './prisma-client.js';
+/** The tenant id of a GLOBAL role assignment (applies in every tenant). */
+export const GLOBAL_TENANT = '';
 // Optional Nest DI decorators — declared structurally so this package does not need a
 // hard runtime dependency on @nestjs/common for the POJO store (the module supplies the
 // real Inject token). The store is usable as a plain POJO: `new PrismaAuthzStore(client)`.
@@ -25,7 +28,7 @@ import { Inject, Injectable, Optional } from '@nestjs/common';
  * Same method surface as the TypeORM/MikroORM adapters. The user is referenced BY ID ONLY
  * — this package never owns a users table.
  */
-let PrismaAuthzStore = class PrismaAuthzStore {
+let PrismaAuthzStore = PrismaAuthzStore_1 = class PrismaAuthzStore {
     client;
     options;
     constructor(client, options = {}) {
@@ -44,6 +47,29 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         }
         return {};
     }
+    /** The `tenantId` value of a written assignment (`{}` without `tenantScoped`). */
+    tenantField(tenantId) {
+        if (this.options?.tenantScoped)
+            return { tenantId: tenantId ?? GLOBAL_TENANT };
+        if (tenantId !== undefined && tenantId !== GLOBAL_TENANT) {
+            throw new Error(`PrismaAuthzStore: a tenant-scoped role assignment needs \`tenantId String @default("")\` on the UserRole model (in its @@id) and the store built with { tenantScoped: true }.`);
+        }
+        return {};
+    }
+    /** Assignments visible in a scope: global ones, plus the tenant's own when one is given. */
+    tenantWhere(scope) {
+        if (!this.options?.tenantScoped)
+            return {};
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        return tenantId === GLOBAL_TENANT
+            ? { tenantId: GLOBAL_TENANT }
+            : { tenantId: { in: [GLOBAL_TENANT, tenantId] } };
+    }
+    /** The public `tenantId` of a stored row: `null` for a global assignment. */
+    static rowTenant(row) {
+        const value = row.tenantId;
+        return value === undefined || value === null || value === GLOBAL_TENANT ? null : value;
+    }
     /**
      * No-op: Prisma is schema-first / consumer-managed. Declare the RBAC models in your
      * `schema.prisma` (see {@link PrismaAuthzClientLike}) and apply them with
@@ -206,26 +232,37 @@ let PrismaAuthzStore = class PrismaAuthzStore {
     async assignRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = this.sourceField(opts?.source);
+        const tenant = this.tenantField(opts?.tenantId);
         const roleId = await this.createRole(roleName);
         const existing = await this.client.userRole.findFirst({
-            where: { userType: type, userId: id, roleId, ...source },
+            where: { userType: type, userId: id, roleId, ...source, ...tenant },
         });
         if (existing)
             return;
-        await this.client.userRole.create({ data: { userType: type, userId: id, roleId, ...source } });
+        await this.client.userRole.create({
+            data: { userType: type, userId: id, roleId, ...source, ...tenant },
+        });
     }
     /**
      * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
-     * that source's assignment goes; without it, the role is removed from every source.
+     * that source's assignment goes; without it, the role is removed from every source. With
+     * `tenantScoped`, `{ tenantId }` removes the assignment in that tenant and omitting it removes
+     * the global one.
      */
     async removeRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = opts?.source === undefined ? {} : this.sourceField(opts.source);
+        if (!this.options?.tenantScoped &&
+            opts?.tenantId !== undefined &&
+            opts.tenantId !== GLOBAL_TENANT) {
+            return; // no tenant column: there is no tenant-scoped assignment to remove
+        }
+        const tenant = this.tenantField(opts?.tenantId);
         const roleId = await this.findRoleId(roleName);
         if (!roleId)
             return;
         await this.client.userRole.deleteMany({
-            where: { userType: type, userId: id, roleId, ...source },
+            where: { userType: type, userId: id, roleId, ...source, ...tenant },
         });
     }
     /**
@@ -233,27 +270,36 @@ let PrismaAuthzStore = class PrismaAuthzStore {
      * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
      * on every login; other sources' assignments are untouched. Roles are created by name when
      * missing. Atomic when the client has `$transaction`. Without `roleSources: true` there is only
-     * one (implicit manual) source, so this replaces ALL of the user's roles.
+     * one (implicit manual) source, so this replaces ALL of the user's roles. With `tenantScoped` it
+     * replaces the assignments of one tenant (`{ tenantId }`), or the global ones when omitted.
      */
     async setUserRoles(user, roleNames, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = this.sourceField(opts?.source);
+        const tenant = this.tenantField(opts?.tenantId);
         const roleIds = [];
         for (const name of new Set(roleNames))
             roleIds.push(await this.createRole(name));
         const replace = async (client) => {
-            await client.userRole.deleteMany({ where: { userType: type, userId: id, ...source } });
+            await client.userRole.deleteMany({
+                where: { userType: type, userId: id, ...source, ...tenant },
+            });
             for (const roleId of roleIds) {
-                await client.userRole.create({ data: { userType: type, userId: id, roleId, ...source } });
+                await client.userRole.create({
+                    data: { userType: type, userId: id, roleId, ...source, ...tenant },
+                });
             }
         };
         await this.inTransaction(replace);
     }
-    /** Every role assignment of a user, one entry per `(role, source)`. */
-    async getRoleAssignments(user) {
+    /**
+     * Every role assignment of a user visible in a tenant scope (global ones always; the tenant's
+     * own with `{ tenantId }`), one entry per `(role, source, tenant)`.
+     */
+    async getRoleAssignments(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const assignments = await this.client.userRole.findMany({
-            where: { userType: type, userId: id },
+            where: { userType: type, userId: id, ...this.tenantWhere(scope) },
         });
         if (assignments.length === 0)
             return [];
@@ -266,23 +312,30 @@ let PrismaAuthzStore = class PrismaAuthzStore {
             .map((a) => ({
             role: nameById.get(a.roleId),
             source: a.source ?? DEFAULT_ROLE_SOURCE,
-            tenantId: null,
+            tenantId: PrismaAuthzStore_1.rowTenant(a),
         }))
-            .sort((a, b) => a.role.localeCompare(b.role) || a.source.localeCompare(b.source));
+            .sort((a, b) => a.role.localeCompare(b.role) ||
+            a.source.localeCompare(b.source) ||
+            (a.tenantId ?? '').localeCompare(b.tenantId ?? ''));
     }
     /**
      * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
      * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
      * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
      *
-     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
-     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     * `tenantId`: omitted = no tenant filter; `null` = global assignments only; a string = exactly
+     * that tenant's scoped assignments. Without `tenantScoped: true` every row is global
+     * (`tenantId: null`), so a tenant id string matches nothing.
      * Without `roleSources: true` every row is `'manual'`, so another `source` matches nothing.
      */
     async listRoleAssignments(filter = {}) {
-        if (typeof filter.tenantId === 'string')
-            return [];
         const where = {};
+        if (filter.tenantId !== undefined) {
+            if (this.options?.tenantScoped)
+                where.tenantId = filter.tenantId ?? GLOBAL_TENANT;
+            else if (filter.tenantId !== null)
+                return [];
+        }
         if (filter.source !== undefined) {
             if (this.options?.roleSources)
                 where.source = filter.source;
@@ -317,7 +370,7 @@ let PrismaAuthzStore = class PrismaAuthzStore {
             userId: a.userId,
             role: nameById.get(a.roleId),
             source: a.source ?? DEFAULT_ROLE_SOURCE,
-            tenantId: null,
+            tenantId: PrismaAuthzStore_1.rowTenant(a),
         }))
             .sort(compareUserRoleAssignments);
     }
@@ -330,11 +383,11 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         await this.client.userRole.deleteMany({ where: { userType: type, userId: id } });
     }
     // --- queries ---
-    /** The role names a user holds. */
-    async getRolesForUser(user) {
+    /** The role names a user holds, in a tenant scope (see {@link TenantScope}). */
+    async getRolesForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const assignments = await this.client.userRole.findMany({
-            where: { userType: type, userId: id },
+            where: { userType: type, userId: id, ...this.tenantWhere(scope) },
         });
         if (assignments.length === 0)
             return [];
@@ -351,20 +404,31 @@ let PrismaAuthzStore = class PrismaAuthzStore {
      *
      * Fast path: when the injected client exposes `$queryRaw`, assemble the set in a
      * SINGLE database round-trip via one JOIN (3 round-trips → 1). On ANY failure
-     * (missing `$queryRaw`, custom `@@map` table names, non-Postgres identifier
-     * quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
+     * (custom `@@map` table names, non-Postgres identifier quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
      * is preserved everywhere and only the common (Postgres + documented schema) case
      * gets the speedup.
      */
-    async getPermissionsForUser(user) {
+    async getPermissionsForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
-        const queryRaw = this.client.$queryRaw;
-        if (typeof queryRaw === 'function') {
+        // Call `$queryRaw` as a method ON the client, never detached: the real
+        // `PrismaClient.$queryRaw` reads `this`, so an unbound reference throws and would
+        // silently send every check down the slow path.
+        const client = this.client;
+        if (typeof client.$queryRaw === 'function') {
             try {
                 // Single JOIN across the three documented `@@map` tables. Identifiers are
                 // literal + double-quoted (Postgres); the user `${type}`/`${id}` VALUES go
                 // through the tagged template as BOUND params — never string-concatenated.
-                const rows = await queryRaw `
+                const rows = this.options?.tenantScoped
+                    ? await client.$queryRaw `
+          SELECT DISTINCT p."name" AS name
+          FROM "authz_permissions" p
+          JOIN "authz_role_permission" rp ON rp."permissionId" = p."id"
+          JOIN "authz_user_role" ur ON ur."roleId" = rp."roleId"
+          WHERE ur."userType" = ${type} AND ur."userId" = ${id}
+            AND ur."tenantId" IN (${GLOBAL_TENANT}, ${scope?.tenantId ?? GLOBAL_TENANT})
+        `
+                    : await client.$queryRaw `
           SELECT DISTINCT p."name" AS name
           FROM "authz_permissions" p
           JOIN "authz_role_permission" rp ON rp."permissionId" = p."id"
@@ -375,10 +439,10 @@ let PrismaAuthzStore = class PrismaAuthzStore {
             }
             catch {
                 // Raw path unsupported for this client/schema/dialect — fall back below.
-                return this.getPermissionsViaDelegates(type, id);
+                return this.getPermissionsViaDelegates(type, id, scope);
             }
         }
-        return this.getPermissionsViaDelegates(type, id);
+        return this.getPermissionsViaDelegates(type, id, scope);
     }
     /**
      * The original three-query implementation (userRole → rolePermission → permission),
@@ -386,9 +450,9 @@ let PrismaAuthzStore = class PrismaAuthzStore {
      * Used directly when `$queryRaw` is unavailable, and as the fallback when the raw
      * fast path throws.
      */
-    async getPermissionsViaDelegates(type, id) {
+    async getPermissionsViaDelegates(type, id, scope) {
         const assignments = await this.client.userRole.findMany({
-            where: { userType: type, userId: id },
+            where: { userType: type, userId: id, ...this.tenantWhere(scope) },
         });
         if (assignments.length === 0)
             return [];
@@ -404,21 +468,21 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         });
         return [...new Set(permissions.map((p) => p.name))];
     }
-    /** A user's roles + effective permissions in one shot. */
-    async getUserAuthz(user) {
+    /** A user's roles + effective permissions in one shot, in a tenant scope. */
+    async getUserAuthz(user, scope) {
         const [roles, permissions] = await Promise.all([
-            this.getRolesForUser(user),
-            this.getPermissionsForUser(user),
+            this.getRolesForUser(user, scope),
+            this.getPermissionsForUser(user, scope),
         ]);
         return { roles, permissions };
     }
-    /** True when the user holds `permission` through any of their roles. */
-    async userHasPermission(user, permission) {
-        const permissions = await this.getPermissionsForUser(user);
+    /** True when the user holds `permission` through any of their roles, in a tenant scope. */
+    async userHasPermission(user, permission, scope) {
+        const permissions = await this.getPermissionsForUser(user, scope);
         return permissions.includes(permission);
     }
 };
-PrismaAuthzStore = __decorate([
+PrismaAuthzStore = PrismaAuthzStore_1 = __decorate([
     Injectable(),
     __param(0, Inject(PRISMA_CLIENT)),
     __param(1, Optional()),

package/dist/prisma-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAW5B,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAGR;IAGA;IALnB,YAEmB,MAA6B,EAG7B,UAAmC,EAAE;QAHrC,WAAM,GAAN,MAAM,CAAuB;QAG7B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ;;;OAGG;IACK,WAAW,CAAC,MAA0B;QAC5C,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,mKAAmK,CAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,gGAAgG;IACxF,KAAK,CAAC,aAAa,CAAI,EAAiD;QAC9E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAM,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,EAAE,EAAwB,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAsB,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;SACzD,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,KAAK,EAAE,MAA6B,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,IAAa;QACpC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;iBACvD,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAkB;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAgB;YAC1B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAyB;;;;;kCAK1B,IAAI,sBAAsB,EAAE;SACrD,CAAC;gBACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CAAC,IAAY,EAAE,EAAU;QAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AA9YY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAL1B,gBAAgB,CA8Y5B"}
+{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAuB5B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;GAOG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAGR;IAGA;IALnB,YAEmB,MAA6B,EAG7B,UAAmC,EAAE;QAHrC,WAAM,GAAN,MAAM,CAAuB;QAG7B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ;;;OAGG;IACK,WAAW,CAAC,MAA0B;QAC5C,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,mKAAmK,CAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,kFAAkF;IAC1E,WAAW,CAAC,QAA4B;QAC9C,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,aAAa,EAAE,CAAC;QAC/E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,+KAA+K,CAChL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,4FAA4F;IACpF,WAAW,CAAC,KAA8B;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,OAAO,QAAQ,KAAK,aAAa;YAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,6EAA6E;IACrE,MAAM,CAAC,SAAS,CAAC,GAA2B;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAqC,CAAC;QACxD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACzF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,gGAAgG;IACxF,KAAK,CAAC,aAAa,CAAI,EAAiD;QAC9E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAM,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,EAAE,EAAwB,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAsB,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,IACE,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY;YAC3B,IAAI,EAAE,QAAQ,KAAK,SAAS;YAC5B,IAAI,CAAC,QAAQ,KAAK,aAAa,EAC/B,CAAC;YACD,OAAO,CAAC,mEAAmE;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,KAAK,EAAE,MAA6B,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;aAC5D,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAa,EAAE,KAAmB;QACzD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,kBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;aACF,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CACrD,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;gBAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,aAAa,CAAC;iBAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;iBACvD,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAkB;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAgB;YAC1B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,kBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,kBAAkB;IAElB,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,KAAmB;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa,EAAE,KAAmB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,uEAAuE;QACvE,kFAAkF;QAClF,gDAAgD;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY;oBACrC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAyB;;;;;kCAKzB,IAAI,sBAAsB,EAAE;oCAC1B,aAAa,KAAK,KAAK,EAAE,QAAQ,IAAI,aAAa;SAC7E;oBACC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAyB;;;;;kCAKzB,IAAI,sBAAsB,EAAE;SACrD,CAAC;gBACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CACtC,IAAY,EACZ,EAAU,EACV,KAA8B;QAE9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,KAAmB;QACnD,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,iBAAiB,CACrB,IAAa,EACb,UAAkB,EAClB,KAAmB;QAEnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AA1dY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAL1B,gBAAgB,CA0d5B"}

package/dist/prisma-client.d.ts

@@ -47,8 +47,10 @@
  *   roleId   String
  *   // Only with `roleSources: true` (per-source assignments — see PrismaAuthzStore.setUserRoles):
  *   // source String @default("manual")
+ *   // Only with `tenantScoped: true` (tenant-scoped assignments, '' = global):
+ *   // tenantId String @default("")
  *
- *   @@id([userType, userId, roleId])          // with roleSources: @@id([userType, userId, roleId, source])
+ *   @@id([userType, userId, roleId])          // add `tenantId` and/or `source` to the @@id when enabled
  *   @@index([userType, userId])
  *   @@map("authz_user_role")
  * }
@@ -142,6 +144,13 @@ export interface PrismaAuthzStoreOptions {
      * `setUserRoles(…, { source })` for a non-default source throw.
      */
     roleSources?: boolean;
+    /**
+     * Tenant-scoped role assignments. Requires a `tenantId String @default("")` column on the
+     * `UserRole` model, included in its `@@id` (`''` = a global assignment). Default `false`: the
+     * schema keeps working unchanged, every assignment is global, and a `tenantId` on a write
+     * throws.
+     */
+    tenantScoped?: boolean;
 }
 /** DI token for optional {@link PrismaAuthzStoreOptions}. */
 export declare const PRISMA_AUTHZ_STORE_OPTIONS: unique symbol;

package/dist/prisma-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;;;;;;;;;;;OAYG;IAEH,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnF;;;;OAIG;IAEH,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,eAA4D,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}
+{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;;;;;;;;;;;OAYG;IAEH,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnF;;;;OAIG;IAEH,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,eAA4D,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}

package/dist/prisma-client.js

@@ -47,8 +47,10 @@
  *   roleId   String
  *   // Only with `roleSources: true` (per-source assignments — see PrismaAuthzStore.setUserRoles):
  *   // source String @default("manual")
+ *   // Only with `tenantScoped: true` (tenant-scoped assignments, '' = global):
+ *   // tenantId String @default("")
  *
- *   @@id([userType, userId, roleId])          // with roleSources: @@id([userType, userId, roleId, source])
+ *   @@id([userType, userId, roleId])          // add `tenantId` and/or `source` to the @@id when enabled
  *   @@index([userType, userId])
  *   @@map("authz_user_role")
  * }

package/dist/prisma-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAiEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}
+{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAwEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}

package/dist/tenancy.d.ts

@@ -0,0 +1,100 @@
+import { type UserRef } from '@dudousxd/nestjs-authz/store-kit';
+import type { ModuleRef } from '@nestjs/core';
+/** A tenant as published by `@dudousxd/nestjs-context` (`Context.tenant()`). */
+export interface TenantRef {
+    id: string;
+    kind: string;
+    source: string;
+    slug?: string;
+    role?: string;
+}
+/** How the context says a lib must scope data right now (`Context.tenantFilter()`). */
+export type TenantFilter = {
+    mode: 'system';
+} | {
+    mode: 'all';
+} | {
+    mode: 'tenantless';
+} | {
+    mode: 'tenant';
+    tenant: TenantRef;
+};
+/**
+ * The RBAC module's `tenancy` option. `'inherit'` (default) follows `ContextModule`'s
+ * `tenancy.enabled`; `false` keeps this module out of tenancy.
+ */
+export type AuthzTenancyOption = 'inherit' | false | {
+    /** `'inherit'` (default) follows the context switch; a boolean overrides it. */
+    enabled?: 'inherit' | boolean;
+    /** Tenant kinds this module honours, instead of the context's `kinds`. */
+    kinds?: string[];
+    /**
+     * Accepted for the shared shape. It changes nothing here: a GLOBAL role assignment
+     * always applies, in every tenant.
+     */
+    nullRows?: 'tenantless' | 'shared';
+    /**
+     * Map the caller's role inside the context tenant (`tenant.role`) to authz roles that
+     * apply in that tenant's scope only, e.g. `{ owner: 'org_admin', member: 'org_member' }`.
+     * Unmapped roles grant nothing.
+     */
+    roles?: Record<string, string | readonly string[]>;
+};
+/**
+ * An explicit tenant for a check, from the user being checked. Return a tenant id to scope the
+ * check to it, `null` for the global scope, or `undefined` to fall back to the context.
+ */
+export type TenantResolver = (user: unknown) => string | null | undefined;
+/** The structural slice of nestjs-context's accessor this module reads. */
+export interface TenantContextAccessor {
+    tenantId?(): string | undefined;
+    userRef?(): {
+        type?: string;
+        id: string | number;
+    } | undefined;
+    tenancy?(): {
+        enabled: boolean;
+        kinds?: string[];
+    };
+    tenantFilter?(options?: {
+        kinds?: string[];
+    }): TenantFilter;
+}
+/** The tenant scope of one check, plus the roles `tenancy.roles` adds in that scope. */
+export interface RbacTenant {
+    scope: {
+        tenantId?: string;
+    };
+    roles: string[];
+}
+export interface ResolveRbacTenantInput {
+    /** The user as the Gate passed it. */
+    user: unknown;
+    /** The same user mapped to a store ref. */
+    ref: UserRef;
+    /** The module's explicit `tenant` resolver, if any. */
+    resolver?: TenantResolver | undefined;
+    /** The module's `tenancy` option. */
+    tenancy?: AuthzTenancyOption | undefined;
+    /** The context accessor found through DI, if any (else the global slot is read). */
+    accessor?: TenantContextAccessor | undefined;
+    /** With tenancy off, scope by the context's plain `tenantId()` (drizzle/typeorm behaviour). */
+    legacyContextTenant: boolean;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export declare function resolveRbacTenant(input: ResolveRbacTenantInput): RbacTenant;
+/** A provider's per-instance cache for {@link rbacTenant}'s accessor lookup. */
+export interface TenantContextCache {
+    resolved: boolean;
+    value: TenantContextAccessor | undefined;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export declare function rbacTenant(options: {
+    tenant?: TenantResolver | undefined;
+    tenancy?: AuthzTenancyOption | undefined;
+}, user: unknown, ref: UserRef, injected: TenantContextAccessor | undefined, moduleRef: ModuleRef | undefined, cache: TenantContextCache, legacyContextTenant: boolean): RbacTenant;
+//# sourceMappingURL=tenancy.d.ts.map

package/dist/tenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,KAAK,GACL;IACE,gFAAgF;IAChF,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC9B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1E,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/D,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,YAAY,CAAC;CAC7D;AAyDD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,2CAA2C;IAC3C,GAAG,EAAE,OAAO,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,qCAAqC;IACrC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,+FAA+F;IAC/F,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAgC3E;AA0BD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1C;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CACxB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC1F,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,kBAAkB,EACzB,mBAAmB,EAAE,OAAO,GAC3B,UAAU,CASZ"}

package/dist/tenancy.js

@@ -0,0 +1,128 @@
+// Tenancy for the RBAC module: which tenant scope a permission/role check runs in, and which
+// roles the caller's role inside the context tenant maps to. The same file ships in every
+// store adapter. It reads the @dudousxd/nestjs-context tenancy contract STRUCTURALLY (no import),
+// so it works with any context version, and with none: a missing or older context reads as
+// tenancy off.
+import { CONTEXT_ACCESSOR } from '@dudousxd/nestjs-authz';
+import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
+const SLOT = Symbol.for('@dudousxd/nestjs-diagnostics:accessor');
+/** Is tenancy on for this module? Call per check: the context can change between requests. */
+function readTenancy(option, a) {
+    if (option === false)
+        return { enabled: false };
+    if (typeof a?.tenancy !== 'function' || typeof a.tenantFilter !== 'function') {
+        return { enabled: false };
+    }
+    const own = typeof option === 'object' ? option : {};
+    const inherit = own.enabled === undefined || own.enabled === 'inherit';
+    if (!(inherit ? a.tenancy().enabled : own.enabled))
+        return { enabled: false };
+    const kinds = own.kinds;
+    const tenantFilter = a.tenantFilter.bind(a);
+    return { enabled: true, filter: () => tenantFilter(kinds ? { kinds } : undefined) };
+}
+/** The accessor found through DI, else the global slot `ContextModule` publishes. */
+function effectiveAccessor(injected) {
+    if (injected)
+        return injected;
+    const slot = globalThis[SLOT];
+    const current = slot?.current;
+    return current && typeof current === 'object' ? current : undefined;
+}
+/** Today's behaviour without tenancy: the context's plain `tenantId()`, read defensively. */
+function legacyTenantId(accessor) {
+    if (!accessor || typeof accessor.tenantId !== 'function')
+        return undefined;
+    try {
+        return accessor.tenantId() ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `ref` the context's current user? Tenant roles belong to the caller, nobody else. */
+function isContextUser(ref, accessor) {
+    let current;
+    try {
+        current = accessor?.userRef?.();
+    }
+    catch {
+        current = undefined;
+    }
+    if (!current || current.id === undefined || current.id === null)
+        return false;
+    const a = normalizeUserRef(ref);
+    const b = normalizeUserRef(current);
+    return a.type === b.type && a.id === b.id;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export function resolveRbacTenant(input) {
+    const explicit = input.resolver ? input.resolver(input.user) : undefined;
+    const accessor = effectiveAccessor(input.accessor);
+    const tenancy = readTenancy(input.tenancy, accessor);
+    const filter = tenancy.enabled ? tenancy.filter() : undefined;
+    let scope;
+    if (explicit !== undefined) {
+        scope = explicit === null ? {} : { tenantId: explicit };
+    }
+    else if (filter) {
+        scope = filter.mode === 'tenant' ? { tenantId: filter.tenant.id } : {};
+    }
+    else if (input.legacyContextTenant) {
+        const id = legacyTenantId(input.accessor);
+        scope = id === undefined ? {} : { tenantId: id };
+    }
+    else {
+        scope = {};
+    }
+    const map = typeof input.tenancy === 'object' ? input.tenancy.roles : undefined;
+    let roles = [];
+    if (map &&
+        filter?.mode === 'tenant' &&
+        filter.tenant.role !== undefined &&
+        scope.tenantId === filter.tenant.id &&
+        Object.prototype.hasOwnProperty.call(map, filter.tenant.role) &&
+        isContextUser(input.ref, accessor)) {
+        const mapped = map[filter.tenant.role];
+        roles = typeof mapped === 'string' ? [mapped] : [...(mapped ?? [])];
+    }
+    return { scope, roles };
+}
+/**
+ * Locate the context accessor. Prefers a value injected into the module; falls back to a
+ * non-strict {@link ModuleRef} lookup so an accessor provided by ANY module (the app root, a
+ * global ContextModule) is still found: the RBAC module is global and its providers don't import
+ * the app's modules, so a plain `@Inject` would miss a root-provided accessor.
+ */
+function resolveTenantContext(injected, moduleRef, cache) {
+    if (injected)
+        return injected;
+    if (cache.resolved)
+        return cache.value;
+    cache.resolved = true;
+    if (moduleRef) {
+        try {
+            cache.value = moduleRef.get(CONTEXT_ACCESSOR, { strict: false });
+        }
+        catch {
+            cache.value = undefined;
+        }
+    }
+    return cache.value;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export function rbacTenant(options, user, ref, injected, moduleRef, cache, legacyContextTenant) {
+    return resolveRbacTenant({
+        user,
+        ref,
+        resolver: options.tenant,
+        tenancy: options.tenancy,
+        accessor: resolveTenantContext(injected, moduleRef, cache),
+        legacyContextTenant,
+    });
+}
+//# sourceMappingURL=tenancy.js.map