@nextage/era-lib 1.0.190 → 1.0.192

package/build/utils/claims.js

@@ -0,0 +1,61 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * Identity claims - the SINGLE definition of what identity travels inside an access token.  *
+ *                                                                                           *
+ * Two operations, kept together on purpose because they MUST stay each other's inverse:     *
+ *                                                                                           *
+ *   buildAuthClaims     - auth-srv, when signing a token (login and refresh);               *
+ *   identityFromClaims  - every resource service, when rebuilding the caller per request.   *
+ *                                                                                           *
+ * They used to be four hand-written literals across two services. A drift between them is   *
+ * not a cosmetic bug: a claim that is written but not read means the authorization data      *
+ * silently disappears, and the checks that depend on it fail OPEN or CLOSED at random.       *
+ *                                                                                           *
+ * NOTE: resource services do NOT re-read the user from the database - they trust these       *
+ * claims (ADR-0005 section 5.1). Revoking a grant therefore takes effect only after the      *
+ * token is refreshed: a declared property, bounded by the access-token TTL.                  *
+ *                                                                                           *
+ *********************************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAuthClaims = buildAuthClaims;
+exports.identityFromClaims = identityFromClaims;
+/**
+ * Builds the identity claims to embed in an access token.
+ *
+ * `grn` is omitted entirely when the user holds no grant, so the common case adds
+ * nothing to the token.
+ *
+ * @param user the user the token is being issued for, as read from the database
+ * @returns the identity claims to sign
+ */
+function buildAuthClaims(user) {
+    const grants = (user.grants ?? [])
+        .filter(g => g.id && g.role)
+        .map(g => ({ id: g.id, role: g.role }));
+    return {
+        rls: user.roles ?? [],
+        orgs: (user.organizations ?? []).map(o => o.id).filter(Boolean),
+        ...(grants.length && { grn: grants })
+    };
+}
+/**
+ * Rebuilds the caller's identity from the claims of a verified token.
+ *
+ * Tolerant of a MISSING key but never of a malformed one: an older token issued
+ * before grants existed simply yields an empty list, whereas an entry without an
+ * `id` or a `role` is dropped rather than trusted half-formed.
+ *
+ * @param data the `data` payload of the verified access token
+ * @returns roles, memberships and grants, shaped as the `BaseUser` augmentation
+ */
+function identityFromClaims(data) {
+    return {
+        roles: data?.rls ?? [],
+        organizations: (data?.orgs ?? []).map(id => ({ id })),
+        grants: (data?.grn ?? [])
+            .filter(g => g?.id && g?.role)
+            .map(g => ({ id: g.id, role: g.role }))
+    };
+}
+//# sourceMappingURL=claims.js.map

package/build/utils/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/utils/claims.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;+FAiB+F;;AAgB/F,0CAWC;AAYD,gDASC;AAzCD;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,IAAuB;IAErD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,GAAG,EAAG,IAAI,CAAC,KAAK,IAAI,EAAE;QACtB,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,IAA0B;IAE3D,OAAO;QACL,KAAK,EAAU,IAAI,EAAE,GAAG,IAAI,EAAE;QAC9B,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAS,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAiB,EAAE,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/build/utils/express.js

@@ -63,11 +63,11 @@ function allowMethods(methods = [], message = 'Method Not Allowed') {
 }
 ;
 /**
- * Normalise an array of HTTP methods.
+ * Normalize an array of HTTP methods.
  *
  * @access private
  * @param {Array<string>} methods
- *     The HTTP methods to normalise.
+ *     The HTTP methods to normalize.
  * @returns {Array<string>}
  *     Returns an array of capitalised HTTP methods.
  */

package/build/utils/functs.d.ts

@@ -1,5 +1,5 @@
 import { AppData, AppMongoDB } from '@nextage/nx-frame-be';
-import { BaseUser, NxObject, NxTypeObject } from '@nextage/nx-frame-be';
+import { NxObject, NxTypeObject } from '@nextage/nx-frame-be';
 import { BaseMongoDoc } from '@nextage/nx-frame-be/build/common/base/base.interfaces';
 import { BaseI18nEntity } from '../interfaces';
 /**
@@ -18,7 +18,7 @@ export declare function initConfig(dir: string): Promise<AppData>;
  */
 export declare function buildMongoDBConfig(): Promise<AppMongoDB>;
 /**
- * Reads and normalises the application environment.
+ * Reads and normalizes the application environment.
  *
  * Loads the dotenv file for the active `NODE_ENV`, applies the {@link ENV_DEFAULTS}
  * table for any unset variable, resolves the few defaults that depend on other
@@ -120,40 +120,13 @@ export declare function getEntityI18nString(input: NxTypeObject<string> | string
  */
 export declare function setEntityI18nString(input: NxTypeObject<string> | string, lang: string): NxTypeObject<string>;
 /**
- * Sets the tenantId on the given payload based on the user's role and organizations.
- * - Normal users: tenantId is always set to their first organization
- * - System/provider users (SYSTEM_ROLES):
- *     - If applyDefaultForAdmin = false → can access all tenants
- *     - If applyDefaultForAdmin = true and tenantId not provided → tenantId set to first org (subset view)
- */
-export declare function setTenant(item: NxObject, user?: BaseUser, applyDefaultForAdmin?: boolean): void;
-/**
- * Scopes a query filter to the user's tenant (multi-tenancy guard).
- *
- * System/provider roles (`SYSTEM_ROLES`) are left unscoped so they can query across
- * tenants; every other user gets `tenantId` forced to their first organization.
- * Throws when a non-admin user has no organization.
- *
- * @param item the query filter object, mutated in place
- * @param user the authenticated user (roles + organizations)
- */
-export declare function setTenantFilter(item: any, user?: BaseUser): void;
-/**
- * Returns the user's tenant id (their first organization).
- *
- * @param user the authenticated user
- * @returns the tenant id
- * @throws if the user has no organization
- */
-export declare function getTenant(user?: BaseUser): string | undefined;
-/**
- * Validates and normalises an absolute http(s) URL (SSRF guard).
+ * Validates and normalizes an absolute http(s) URL (SSRF guard).
  *
  * Requires an explicit `http`/`https` protocol and rejects loopback hosts
  * (`localhost`/`127.0.0.1`) to prevent server-side request forgery.
  *
  * @param input the URL to validate
- * @returns the parsed, normalised URL string
+ * @returns the parsed, normalized URL string
  * @throws `Invalid URL` when malformed, `Forbidden URL` when pointing at loopback
  */
 export declare function validateUrl(input: string): string;

package/build/utils/functs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"functs.d.ts","sourceRoot":"","sources":["../../src/utils/functs.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAe,UAAU,EAAE,MAAqB,sBAAsB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAiB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAyC,wDAAwD,CAAC;AAEzH,OAAO,EAAE,cAAc,EAAE,MAAuC,eAAe,CAAC;AAIhF;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwH9D;AAiCD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,CA0B9D;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAgBzC;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,GAAE,OAAc,GAAG,QAAQ,GAAG,IAAI,CASvF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,IAAI,GAAE,MAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAYpE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAmB3E;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,GAAE,MAAiB,EAAE,KAAK,GAAE,MAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3G;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,GAAE,MAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCvF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBvE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAOvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAMvF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS9F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAS5G;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,oBAAoB,UAAQ,GAAG,IAAI,CAc7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAShE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAM7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBjD"}
+{"version":3,"file":"functs.d.ts","sourceRoot":"","sources":["../../src/utils/functs.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAe,UAAU,EAAE,MAAqB,sBAAsB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAiB,YAAY,EAAE,MAAgB,sBAAsB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAyC,wDAAwD,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAuC,eAAe,CAAC;AAIhF;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwH9D;AAiCD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,CA0B9D;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAgBzC;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,GAAE,OAAc,GAAG,QAAQ,GAAG,IAAI,CASvF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,IAAI,GAAE,MAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAYpE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAmB3E;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,GAAE,MAAiB,EAAE,KAAK,GAAE,MAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3G;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,GAAE,MAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCvF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBvE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAOvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAMvF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS9F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAS5G;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBjD"}

package/build/utils/functs.js

@@ -49,16 +49,12 @@ exports.getI18nEntityStrings = getI18nEntityStrings;
 exports.setI18nEntityStrings = setI18nEntityStrings;
 exports.getEntityI18nString = getEntityI18nString;
 exports.setEntityI18nString = setEntityI18nString;
-exports.setTenant = setTenant;
-exports.setTenantFilter = setTenantFilter;
-exports.getTenant = getTenant;
 exports.validateUrl = validateUrl;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const validator_1 = __importDefault(require("validator"));
 const dotenv_1 = require("dotenv");
 const nx_frame_be_1 = require("@nextage/nx-frame-be");
-const constants_1 = require("../constants");
 const env_constants_1 = require("./env.constants");
 const jwt_1 = require("./jwt");
 /**
@@ -262,7 +258,7 @@ function validateEnv() {
     }
 }
 /**
- * Reads and normalises the application environment.
+ * Reads and normalizes the application environment.
  *
  * Loads the dotenv file for the active `NODE_ENV`, applies the {@link ENV_DEFAULTS}
  * table for any unset variable, resolves the few defaults that depend on other
@@ -504,60 +500,13 @@ function setEntityI18nString(input, lang) {
     return res;
 }
 /**
- * Sets the tenantId on the given payload based on the user's role and organizations.
- * - Normal users: tenantId is always set to their first organization
- * - System/provider users (SYSTEM_ROLES):
- *     - If applyDefaultForAdmin = false → can access all tenants
- *     - If applyDefaultForAdmin = true and tenantId not provided → tenantId set to first org (subset view)
- */
-function setTenant(item, user, applyDefaultForAdmin = false) {
-    const isAdmin = user?.hasRole(constants_1.SYSTEM_ROLES);
-    // Admins who can see all tenants or already have tenantId specified → exit
-    if (isAdmin && (!applyDefaultForAdmin || item.tenantId))
-        return;
-    if (!user?.organizations?.length)
-        throw new Error('Cannot proceed: organization not set');
-    // Admin with applyDefaultForAdmin=true and tenantId absent
-    // OR normal user → force tenantId
-    item.tenantId = user.organizations[0].id;
-}
-/**
- * Scopes a query filter to the user's tenant (multi-tenancy guard).
- *
- * System/provider roles (`SYSTEM_ROLES`) are left unscoped so they can query across
- * tenants; every other user gets `tenantId` forced to their first organization.
- * Throws when a non-admin user has no organization.
- *
- * @param item the query filter object, mutated in place
- * @param user the authenticated user (roles + organizations)
- */
-function setTenantFilter(item, user) {
-    if (user?.hasRole(constants_1.SYSTEM_ROLES))
-        return;
-    if (!user?.organizations?.length)
-        throw new Error('Cannot proceed: organization not set');
-    item.tenantId = user.organizations[0].id;
-}
-/**
- * Returns the user's tenant id (their first organization).
- *
- * @param user the authenticated user
- * @returns the tenant id
- * @throws if the user has no organization
- */
-function getTenant(user) {
-    if (!user?.organizations?.length)
-        throw new Error('Cannot proceed: organization not set');
-    return user.organizations[0].id;
-}
-/**
- * Validates and normalises an absolute http(s) URL (SSRF guard).
+ * Validates and normalizes an absolute http(s) URL (SSRF guard).
  *
  * Requires an explicit `http`/`https` protocol and rejects loopback hosts
  * (`localhost`/`127.0.0.1`) to prevent server-side request forgery.
  *
  * @param input the URL to validate
- * @returns the parsed, normalised URL string
+ * @returns the parsed, normalized URL string
  * @throws `Invalid URL` when malformed, `Forbidden URL` when pointing at loopback
  */
 function validateUrl(input) {

package/build/utils/functs.js.map

@@ -1 +1 @@
-{"version":3,"file":"functs.js","sourceRoot":"","sources":["../../src/utils/functs.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,gCAwHC;AAoCD,gDA0BC;AAuCD,0BAgBC;AAwCD,gCASC;AAQD,gCAYC;AAUD,0CAmBC;AAYD,wDAgBC;AAeD,kEAoCC;AAMD,gDAgBC;AASD,oDAOC;AAYD,oDAMC;AASD,kDASC;AASD,kDASC;AASD,8BAcC;AAYD,0CASC;AASD,8BAMC;AAYD,kCAmBC;AA5mBD,4CAAqE;AACrE,gDAAuE;AACvE,0DAA4E;AAE5E,mCAAyE;AAGzE,sDAAuF;AAEvF,4CAA+E;AAE/E,mDAAkF;AAClF,+BAAwE;AAExE;;;;;;;;;GASG;AACI,KAAK,UAAU,UAAU,CAAC,GAAW;IAE1C,OAAO,CAAC,GAAG,CAAC,CAAC;IAEb,MAAM,EAAE,GAAG,EAAE,GAAG,wDAAa,6CAA6C,GAAC,CAAC;IAE5E,0EAA0E;IAC1E,gFAAgF;IAChF,8EAA8E;IAC9E,4EAA4E;IAC5E,+BAA+B;IAC/B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAElD,sDAAsD;IACtD,2EAA2E;IAC3E,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG;QACpB,MAAM,EAAK,OAAO,CAAC,GAAG,CAAC,UAAU,IAAO,uBAAuB;QAC/D,MAAM,EAAK,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QAC1C,IAAI,EAAO,OAAO,CAAC,GAAG,CAAC,aAAc;QACrC,OAAO,EAAI,OAAO,CAAC,GAAG,CAAC,gBAAiB;QACxC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAoB;QAC3C,EAAE,EAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;QACnC,IAAI,EAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAY,CAAC;KAC9C,CAAC;IAEF,8DAA8D;IAC9D,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG;QACf,MAAM,EAAK,IAAA,2BAAqB,GAAE;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,aAAqC;QAC5D,QAAQ,EAAG,OAAO,CAAC,GAAG,CAAC,YAAa;QACpC,OAAO,EAAI;YACT,MAAM,EAAK,IAAA,0BAAoB,GAAE;YACjC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAyC;YAChE,QAAQ,EAAG,OAAO,CAAC,GAAG,CAAC,gBAAiB;SACzC;KACF,CAAC;IAEF,sBAAsB;IACtB,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG;QACjB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QAC/B,GAAG,EAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;KACjC,CAAC;IAEF,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;KAC/B,CAAC;IAEF,mCAAmC;IACnC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE9C,uEAAuE;IACvE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG;QAClB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAoB;KAC3C,CAAC;IAEF,0DAA0D;IAC1D,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG;QACnB,MAAM,EAAI,OAAO,CAAC,GAAG,CAAC,aAAc;QACpC,GAAG,EAAO,OAAO,CAAC,GAAG,CAAC,OAAQ;QAC9B,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;KAClD,CAAC;IAEF,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE5E,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG;QACf,IAAI,EAAG;YACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI;YACzC,MAAM,EAAG,OAAO,CAAC,GAAG,CAAC,WAAY;SAClC;QACD,IAAI,EAAG;YACL,OAAO,EAAQ,OAAO,CAAC,GAAG,CAAC,QAAS;YACpC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;SAC1C;QACD,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YACzC,OAAO,EAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;SAC3D;QACD,GAAG,EAAI;YACL,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,CAAC;SAC7D;QACD,IAAI,EAAG;YACL,MAAM,EAAS,OAAO,CAAC,GAAG,CAAC,WAAW;YACtC,QAAQ,EAAO,OAAO,CAAC,GAAG,CAAC,cAAc;YACzC,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC7C,WAAW,EAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC5C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG;SACvD;QACD,KAAK,EAAE;YACL,SAAS,EAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC7C,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;SAC/C;QACD,GAAG,EAAI;YACL,cAAc,EAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACvD,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;SAC5D;QACD,KAAK,EAAE;YACL,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;SAC7D;KACF,CAAC;IAEF,6DAA6D;IAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAEvC,uEAAuE;IACvE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAEjC,GAAG,CAAC,SAAS,GAAG,IAAI,2BAAa,EAAE,CAAC;IAEpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAE1B,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAK,EAAE;QACd,QAAQ,EAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAM,EAAE;QAC7C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE;KAC9C,CAAA;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,IAAI,CAAC;QAEH,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,CAAC;QACL,MAAM,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAiB,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB;IAEtC,MAAM,MAAM,GAAe;QACzB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS;QACjD,MAAM,EAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO;QACxE,IAAI,EAAM,OAAO,CAAC,GAAG,CAAC,UAAU,IAAQ,WAAW;QACnD,IAAI,EAAM,OAAO,CAAC,GAAG,CAAC,UAAU;QAChC,IAAI,EAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,EAAC;QAC1D,OAAO,EAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QACpD,GAAG,EAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;QACrC,OAAO,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;QACxC,OAAO,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAChD,OAAO,EAAG;YACR,EAAE,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;YACnC,EAAE,EAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;SACpC;KACF,CAAC;IAEF,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAM,MAAM,CAAC,IAAI,GAAO,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IACzG,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAM,MAAM,CAAC,IAAI,GAAO,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IACzG,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QAAI,MAAM,CAAC,MAAM,GAAK,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3G,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,MAAM,CAAC,IAAK,CAAC,EAAE,GAAG,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5G,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,MAAM,CAAC,IAAK,CAAC,EAAE,GAAG,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAE5G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAElB,KAAK,MAAM,GAAG,IAAI,2BAAW,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,KAAK,IAAI,CAAC,mBAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,KAAK,KAAK,wBAAwB,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,wBAAQ,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAElD,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC1B,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,+BAA+B,KAAK,GAAG,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,OAAO,CAAC,GAAW;IAEjC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAE7D,IAAA,qBAAY,EAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC,CAAC;IAEzG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,4BAAY,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IAE/C,uEAAuE;IACvE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAK,GAAG,GAAG,cAAc,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAO,GAAG,CAAC;IAE/B,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY;IAEnB,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtF,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,sCAAsC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,MAAM,GAAO,OAAO,CAAC,GAAG,CAAC,MAAM,IAAQ,KAAK,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,IAAkB,EAAE,UAAmB,IAAI;IAEpE,MAAM,GAAG,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAExC,IAAI,CAAC,GAAG;QACN,OAAO,IAAI,CAAC;IAEd,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE;IAEhD,IAAI,CAAC,IAAI;QACP,OAAO,KAAK,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,YAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,KAAuB;IAErD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QACvD,OAAO,SAAS,CAAC;IAEnB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAE7D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC;IAEnB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,MAAM,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAM,EAAE,CAAC,EAAE,OAAS,EAAE,CAAC,EAAE,QAAU,EAAE,CAAC;IAElG,OAAO,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAAC,MAAc,QAAQ,EAAE,QAAgB,OAAO;IAE1F,sBAAsB;IACtB,MAAM,SAAS,GAAa,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE3D,MAAM,EAAE,GAAG,EAAE,GAAG,wDAAa,6CAA6C,GAAC,CAAC;IAE5E,gCAAgC;IAChC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,yBAAa,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,2BAA2B,CAAC,MAAc,QAAQ;IAEtE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;IAEtF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAEjE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QAEf,MAAM,IAAI,GAAG,cAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC;eAC5C,cAAI,CAAC,QAAQ,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,UAAU,CAAC;IAEf,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;IAErE,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,yBAAa,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAC,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,KAAa;IAE3D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAiB,YAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAEzB,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEtC,IAAI,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YACrC,SAAS,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,gCAAgC;aACrF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;IAC1C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,IAAoB,EAAE,IAAY;IAErE,IAAI,CAAC,IAAI;QAAa,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI;QAAS,IAAI,CAAC,IAAI,GAAU,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAS,IAAI,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAErF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAAC,IAAoB,EAAE,IAAY;IAErE,IAAI,IAAI,CAAC,IAAI;QAAS,IAAI,CAAC,IAAI,GAAU,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAS,IAAI,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAErF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,KAAoC,EAAE,IAAY;IAEpF,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,CAAC;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,KAAoC,EAAE,IAAY;IAEpF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC;IAEf,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,GAAG,CAAC,IAAI,CAAC,GAAyB,KAAe,CAAC;IAElD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,IAAe,EAAE,oBAAoB,GAAG,KAAK;IAErF,MAAM,OAAO,GAAI,IAAI,EAAE,OAAO,CAAC,wBAAY,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,IAAI,OAAO,IAAI,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,CAAC;QACrD,OAAO;IAET,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,2DAA2D;IAC3D,kCAAkC;IAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,IAAS,EAAE,IAAe;IAExD,IAAI,IAAI,EAAE,OAAO,CAAC,wBAAY,CAAC;QAC7B,OAAO;IAET,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,KAAa;IAEvC,IAAI,CAAC,mBAAS,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,gBAAgB,EAAc,IAAI;QAClC,sBAAsB,EAAQ,IAAI;QAClC,iBAAiB,EAAa,KAAK;QACnC,kBAAkB,EAAY,KAAK;QACnC,4BAA4B,EAAE,KAAK;KACpC,CAAC,EAAE,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;QACpE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAEnC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"functs.js","sourceRoot":"","sources":["../../src/utils/functs.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,gCAwHC;AAoCD,gDA0BC;AAuCD,0BAgBC;AAwCD,gCASC;AAQD,gCAYC;AAUD,0CAmBC;AAYD,wDAgBC;AAeD,kEAoCC;AAMD,gDAgBC;AASD,oDAOC;AAYD,oDAMC;AASD,kDASC;AASD,kDASC;AAYD,kCAmBC;AAhjBD,4CAAqE;AACrE,gDAAuE;AACvE,0DAA4E;AAE5E,mCAAyE;AAGzE,sDAAuF;AAGvF,mDAAkF;AAClF,+BAAwE;AAExE;;;;;;;;;GASG;AACI,KAAK,UAAU,UAAU,CAAC,GAAW;IAE1C,OAAO,CAAC,GAAG,CAAC,CAAC;IAEb,MAAM,EAAE,GAAG,EAAE,GAAG,wDAAa,6CAA6C,GAAC,CAAC;IAE5E,0EAA0E;IAC1E,gFAAgF;IAChF,8EAA8E;IAC9E,4EAA4E;IAC5E,+BAA+B;IAC/B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAElD,sDAAsD;IACtD,2EAA2E;IAC3E,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG;QACpB,MAAM,EAAK,OAAO,CAAC,GAAG,CAAC,UAAU,IAAO,uBAAuB;QAC/D,MAAM,EAAK,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QAC1C,IAAI,EAAO,OAAO,CAAC,GAAG,CAAC,aAAc;QACrC,OAAO,EAAI,OAAO,CAAC,GAAG,CAAC,gBAAiB;QACxC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAoB;QAC3C,EAAE,EAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;QACnC,IAAI,EAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAY,CAAC;KAC9C,CAAC;IAEF,8DAA8D;IAC9D,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG;QACf,MAAM,EAAK,IAAA,2BAAqB,GAAE;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,aAAqC;QAC5D,QAAQ,EAAG,OAAO,CAAC,GAAG,CAAC,YAAa;QACpC,OAAO,EAAI;YACT,MAAM,EAAK,IAAA,0BAAoB,GAAE;YACjC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAyC;YAChE,QAAQ,EAAG,OAAO,CAAC,GAAG,CAAC,gBAAiB;SACzC;KACF,CAAC;IAEF,sBAAsB;IACtB,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG;QACjB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QAC/B,GAAG,EAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;KACjC,CAAC;IAEF,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;KAC/B,CAAC;IAEF,mCAAmC;IACnC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE9C,uEAAuE;IACvE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG;QAClB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAoB;KAC3C,CAAC;IAEF,0DAA0D;IAC1D,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG;QACnB,MAAM,EAAI,OAAO,CAAC,GAAG,CAAC,aAAc;QACpC,GAAG,EAAO,OAAO,CAAC,GAAG,CAAC,OAAQ;QAC9B,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;KAClD,CAAC;IAEF,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE5E,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG;QACf,IAAI,EAAG;YACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI;YACzC,MAAM,EAAG,OAAO,CAAC,GAAG,CAAC,WAAY;SAClC;QACD,IAAI,EAAG;YACL,OAAO,EAAQ,OAAO,CAAC,GAAG,CAAC,QAAS;YACpC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;SAC1C;QACD,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YACzC,OAAO,EAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;SAC3D;QACD,GAAG,EAAI;YACL,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,CAAC;SAC7D;QACD,IAAI,EAAG;YACL,MAAM,EAAS,OAAO,CAAC,GAAG,CAAC,WAAW;YACtC,QAAQ,EAAO,OAAO,CAAC,GAAG,CAAC,cAAc;YACzC,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC7C,WAAW,EAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC5C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG;SACvD;QACD,KAAK,EAAE;YACL,SAAS,EAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC7C,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;SAC/C;QACD,GAAG,EAAI;YACL,cAAc,EAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACvD,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;SAC5D;QACD,KAAK,EAAE;YACL,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;SAC7D;KACF,CAAC;IAEF,6DAA6D;IAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAEvC,uEAAuE;IACvE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAEjC,GAAG,CAAC,SAAS,GAAG,IAAI,2BAAa,EAAE,CAAC;IAEpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAE1B,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAK,EAAE;QACd,QAAQ,EAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAM,EAAE;QAC7C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE;KAC9C,CAAA;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,IAAI,CAAC;QAEH,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,CAAC;QACL,MAAM,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAiB,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB;IAEtC,MAAM,MAAM,GAAe;QACzB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS;QACjD,MAAM,EAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO;QACxE,IAAI,EAAM,OAAO,CAAC,GAAG,CAAC,UAAU,IAAQ,WAAW;QACnD,IAAI,EAAM,OAAO,CAAC,GAAG,CAAC,UAAU;QAChC,IAAI,EAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,EAAC;QAC1D,OAAO,EAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QACpD,GAAG,EAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;QACrC,OAAO,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;QACxC,OAAO,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAChD,OAAO,EAAG;YACR,EAAE,EAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;YACnC,EAAE,EAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;SACpC;KACF,CAAC;IAEF,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAM,MAAM,CAAC,IAAI,GAAO,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IACzG,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAM,MAAM,CAAC,IAAI,GAAO,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IACzG,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QAAI,MAAM,CAAC,MAAM,GAAK,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3G,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,MAAM,CAAC,IAAK,CAAC,EAAE,GAAG,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5G,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,MAAM,CAAC,IAAK,CAAC,EAAE,GAAG,YAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAE5G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAElB,KAAK,MAAM,GAAG,IAAI,2BAAW,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,KAAK,IAAI,CAAC,mBAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,KAAK,KAAK,wBAAwB,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,wBAAQ,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAElD,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC1B,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,+BAA+B,KAAK,GAAG,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,OAAO,CAAC,GAAW;IAEjC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAE7D,IAAA,qBAAY,EAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC,CAAC;IAEzG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,4BAAY,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IAE/C,uEAAuE;IACvE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAK,GAAG,GAAG,cAAc,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAO,GAAG,CAAC;IAE/B,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY;IAEnB,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtF,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,sCAAsC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,MAAM,GAAO,OAAO,CAAC,GAAG,CAAC,MAAM,IAAQ,KAAK,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,IAAkB,EAAE,UAAmB,IAAI;IAEpE,MAAM,GAAG,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAExC,IAAI,CAAC,GAAG;QACN,OAAO,IAAI,CAAC;IAEd,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE;IAEhD,IAAI,CAAC,IAAI;QACP,OAAO,KAAK,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,YAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,KAAuB;IAErD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QACvD,OAAO,SAAS,CAAC;IAEnB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAE7D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC;IAEnB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,MAAM,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAM,EAAE,CAAC,EAAE,OAAS,EAAE,CAAC,EAAE,QAAU,EAAE,CAAC;IAElG,OAAO,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAAC,MAAc,QAAQ,EAAE,QAAgB,OAAO;IAE1F,sBAAsB;IACtB,MAAM,SAAS,GAAa,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE3D,MAAM,EAAE,GAAG,EAAE,GAAG,wDAAa,6CAA6C,GAAC,CAAC;IAE5E,gCAAgC;IAChC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,yBAAa,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,2BAA2B,CAAC,MAAc,QAAQ;IAEtE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;IAEtF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAEjE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QAEf,MAAM,IAAI,GAAG,cAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC;eAC5C,cAAI,CAAC,QAAQ,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,UAAU,CAAC;IAEf,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;IAErE,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,yBAAa,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAC,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,KAAa;IAE3D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAiB,YAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAEzB,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEtC,IAAI,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YACrC,SAAS,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,gCAAgC;aACrF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;IAC1C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,IAAoB,EAAE,IAAY;IAErE,IAAI,CAAC,IAAI;QAAa,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI;QAAS,IAAI,CAAC,IAAI,GAAU,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAS,IAAI,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAErF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAAC,IAAoB,EAAE,IAAY;IAErE,IAAI,IAAI,CAAC,IAAI;QAAS,IAAI,CAAC,IAAI,GAAU,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAS,IAAI,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAErF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,KAAoC,EAAE,IAAY;IAEpF,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,CAAC;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,KAAoC,EAAE,IAAY;IAEpF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC;IAEf,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,GAAG,CAAC,IAAI,CAAC,GAAyB,KAAe,CAAC;IAElD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,KAAa;IAEvC,IAAI,CAAC,mBAAS,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,gBAAgB,EAAc,IAAI;QAClC,sBAAsB,EAAQ,IAAI;QAClC,iBAAiB,EAAa,KAAK;QACnC,kBAAkB,EAAY,KAAK;QACnC,4BAA4B,EAAE,KAAK;KACpC,CAAC,EAAE,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;QACpE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAEnC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/build/utils/index.d.ts

@@ -1,8 +1,14 @@
+export * from './claims';
+export * from './claims.interfaces';
 export * from './express';
 export * from './functs';
 export * from './jwt';
 export * from './jwt.constants';
 export * from './jwt.interfaces';
+export * from './scope';
+export * from './scope.interfaces';
 export * from './start-service';
+export * from './tenant';
+export * from './tenant.interfaces';
 export * from './start-service.constants';
 //# sourceMappingURL=index.d.ts.map

package/build/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/build/utils/index.js

@@ -14,11 +14,17 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./claims"), exports);
+__exportStar(require("./claims.interfaces"), exports);
 __exportStar(require("./express"), exports);
 __exportStar(require("./functs"), exports);
 __exportStar(require("./jwt"), exports);
 __exportStar(require("./jwt.constants"), exports);
 __exportStar(require("./jwt.interfaces"), exports);
+__exportStar(require("./scope"), exports);
+__exportStar(require("./scope.interfaces"), exports);
 __exportStar(require("./start-service"), exports);
+__exportStar(require("./tenant"), exports);
+__exportStar(require("./tenant.interfaces"), exports);
 __exportStar(require("./start-service.constants"), exports);
 //# sourceMappingURL=index.js.map

package/build/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,2CAAyB;AACzB,wCAAsB;AACtB,kDAAgC;AAChC,mDAAiC;AACjC,kDAAgC;AAChC,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,sDAAoC;AACpC,4CAA0B;AAC1B,2CAAyB;AACzB,wCAAsB;AACtB,kDAAgC;AAChC,mDAAiC;AACjC,0CAAwB;AACxB,qDAAmC;AACnC,kDAAgC;AAChC,2CAAyB;AACzB,sDAAoC;AACpC,4DAA0C"}

package/build/utils/scope.d.ts

@@ -0,0 +1,75 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * Organization scope - THE single answer to "may this user operate on THIS organization?"   *
+ *                                                                                           *
+ * The organization arrives EXPLICITLY from the request (an `oid`/`uid` on a mutation).      *
+ * The sibling question - "which organization is this user operating on?", where the tenant  *
+ * must be DEDUCED - is answered by `resolveTenant` in `tenant.ts`. Two questions, two        *
+ * functions, no overlap.                                                                    *
+ *                                                                                           *
+ * SINGLE SOURCE OF TRUTH: every caller imports from here and NEVER re-implements the        *
+ * check. `@auth(requires:)` alone is never sufficient - it verifies the ROLE, never the      *
+ * ORGANIZATION (ADR-0005 section 5).                                                        *
+ *                                                                                           *
+ *********************************************************************************************/
+import { BaseUser } from '@nextage/nx-frame-be';
+import { OrgScope } from './scope.interfaces';
+/**
+ * Resolves how `user` reaches the organization `orgId`, or `null` if they cannot.
+ *
+ * Resolution order (ADR-0005 section 5) - the first match wins:
+ *
+ *   1. cross-tenant level        -> { tier: PROVIDER }        // no organization constraint
+ *   2. membership on `orgId`     -> { tier: MEMBER,  role }   // role from `roles[]`
+ *   3. grant on `orgId`          -> { tier: GRANTED, role }   // role from the grant
+ *   4. otherwise                 -> null                      // denied
+ *
+ * Membership is checked BEFORE grants because it is identity: a user who belongs to
+ * the organization already reaches it, and a grant on one's own organization would
+ * be redundant. Note the two carry the role differently - membership entries hold no
+ * role (it lives in `users.roles[]`, one organization-tier role per user), whereas a
+ * grant carries its own, which is what allows a different role per organization.
+ *
+ * FAIL-CLOSED: a missing user, a missing `orgId` or no match at all all yield `null`.
+ * Callers must treat `null` as "denied" and never as "unknown".
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the target organization id, as received from the request
+ * @returns the scope through which the user reaches the organization, or `null`
+ */
+export declare function resolveOrgScope(user?: BaseUser, orgId?: string): OrgScope | null;
+/**
+ * Throwing variant of `resolveOrgScope`, for the call sites that must simply deny.
+ *
+ * Raises the same error whether the organization is out of scope or does not exist:
+ * distinguishing the two would confirm the existence of somebody else's organization.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the target organization id, as received from the request
+ * @returns the resolved scope (never `null`)
+ * @throws `AppError('messages.authorization.missingRole')` when out of scope
+ */
+export declare function assertOrgScope(user?: BaseUser, orgId?: string): OrgScope;
+/**
+ * Every organization the user reaches, for the LIST case.
+ *
+ * `resolveOrgScope` answers about ONE organization named by the request; this answers
+ * "which ones may appear at all?", which is what a model's `updateFilters` needs. The
+ * two share the same rules deliberately: a list that showed an organization the point
+ * check would then deny would be a leak by itself.
+ *
+ * Three outcomes, and the caller MUST tell them apart:
+ *
+ *   `undefined` -> no constraint: a cross-tenant user, every organization is visible
+ *   `string[]`  -> exactly these ids (memberships UNION grants), never any other
+ *   `[]`        -> nothing is visible; the caller must yield an EMPTY result, never all
+ *
+ * The union is what makes a grant visible in the organization switcher: an
+ * `ORG_EDITOR` granted on another organization must find it in the list, or the
+ * grant would be unusable (ADR-0005 section 3.2).
+ *
+ * @param user the authenticated user (`NxContext.user`)
+ * @returns `undefined` for no constraint, otherwise the exact set of reachable ids
+ */
+export declare function reachableOrgIds(user?: BaseUser): string[] | undefined;
+//# sourceMappingURL=scope.d.ts.map

package/build/utils/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;+FAa+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,EAAE,QAAQ,EAAE,MAAgB,oBAAoB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAqBhF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAQxE;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,SAAS,CAcrE"}

package/build/utils/scope.interfaces.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Organization-scope types & interfaces (ADR-0005 section 5).
+ *
+ * Kept separate from the logic in `scope.ts` (house-style: types live in a
+ * dedicated `*.interfaces.ts`, never mixed with the logic that consumes them).
+ * `OrgScopeTier` itself lives in `enums.ts`, next to `BaseRoles`/`RolesType`.
+ */
+import { BaseRoles, OrgScopeTier } from '../enums';
+/**
+ * Outcome of `resolveOrgScope`: the tier through which the user reaches the
+ * organization, plus the organization-tier role that applies THERE.
+ *
+ * `role` is undefined only for the `PROVIDER` tier, whose capabilities come from
+ * the capability matrix (ADR-0005 section 4) and not from an organization role.
+ */
+export interface OrgScope {
+    tier: OrgScopeTier;
+    role?: BaseRoles;
+}
+//# sourceMappingURL=scope.interfaces.d.ts.map

package/build/utils/scope.interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.interfaces.d.ts","sourceRoot":"","sources":["../../src/utils/scope.interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAG,YAAY,CAAC;IACpB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB"}

package/build/utils/scope.interfaces.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * Organization-scope types & interfaces (ADR-0005 section 5).
+ *
+ * Kept separate from the logic in `scope.ts` (house-style: types live in a
+ * dedicated `*.interfaces.ts`, never mixed with the logic that consumes them).
+ * `OrgScopeTier` itself lives in `enums.ts`, next to `BaseRoles`/`RolesType`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=scope.interfaces.js.map

package/build/utils/scope.interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.interfaces.js","sourceRoot":"","sources":["../../src/utils/scope.interfaces.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG"}

package/build/utils/scope.js

@@ -0,0 +1,121 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * Organization scope - THE single answer to "may this user operate on THIS organization?"   *
+ *                                                                                           *
+ * The organization arrives EXPLICITLY from the request (an `oid`/`uid` on a mutation).      *
+ * The sibling question - "which organization is this user operating on?", where the tenant  *
+ * must be DEDUCED - is answered by `resolveTenant` in `tenant.ts`. Two questions, two        *
+ * functions, no overlap.                                                                    *
+ *                                                                                           *
+ * SINGLE SOURCE OF TRUTH: every caller imports from here and NEVER re-implements the        *
+ * check. `@auth(requires:)` alone is never sufficient - it verifies the ROLE, never the      *
+ * ORGANIZATION (ADR-0005 section 5).                                                        *
+ *                                                                                           *
+ *********************************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOrgScope = resolveOrgScope;
+exports.assertOrgScope = assertOrgScope;
+exports.reachableOrgIds = reachableOrgIds;
+const nx_frame_be_1 = require("@nextage/nx-frame-be");
+const constants_1 = require("../constants");
+const constants_2 = require("../constants");
+const enums_1 = require("../enums");
+/**
+ * Resolves how `user` reaches the organization `orgId`, or `null` if they cannot.
+ *
+ * Resolution order (ADR-0005 section 5) - the first match wins:
+ *
+ *   1. cross-tenant level        -> { tier: PROVIDER }        // no organization constraint
+ *   2. membership on `orgId`     -> { tier: MEMBER,  role }   // role from `roles[]`
+ *   3. grant on `orgId`          -> { tier: GRANTED, role }   // role from the grant
+ *   4. otherwise                 -> null                      // denied
+ *
+ * Membership is checked BEFORE grants because it is identity: a user who belongs to
+ * the organization already reaches it, and a grant on one's own organization would
+ * be redundant. Note the two carry the role differently - membership entries hold no
+ * role (it lives in `users.roles[]`, one organization-tier role per user), whereas a
+ * grant carries its own, which is what allows a different role per organization.
+ *
+ * FAIL-CLOSED: a missing user, a missing `orgId` or no match at all all yield `null`.
+ * Callers must treat `null` as "denied" and never as "unknown".
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the target organization id, as received from the request
+ * @returns the scope through which the user reaches the organization, or `null`
+ */
+function resolveOrgScope(user, orgId) {
+    if (!user || !orgId)
+        return null;
+    // 1. cross-tenant level: reaches every organization by definition of level.
+    if (user.hasRole?.(constants_1.CROSS_TENANT_ROLES))
+        return { tier: enums_1.OrgScopeTier.PROVIDER };
+    // 2. membership (identity): the role is the highest organization-tier one held.
+    if (user.organizations?.some(o => o.id === orgId))
+        return { tier: enums_1.OrgScopeTier.MEMBER, role: highestOrgRole(user) };
+    // 3. grant (authorization): the role travels WITH the grant.
+    const grant = user.grants?.find(g => g.id === orgId);
+    if (grant)
+        return { tier: enums_1.OrgScopeTier.GRANTED, role: grant.role };
+    // 4. no path to this organization.
+    return null;
+}
+/**
+ * Throwing variant of `resolveOrgScope`, for the call sites that must simply deny.
+ *
+ * Raises the same error whether the organization is out of scope or does not exist:
+ * distinguishing the two would confirm the existence of somebody else's organization.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the target organization id, as received from the request
+ * @returns the resolved scope (never `null`)
+ * @throws `AppError('messages.authorization.missingRole')` when out of scope
+ */
+function assertOrgScope(user, orgId) {
+    const scope = resolveOrgScope(user, orgId);
+    if (!scope)
+        throw new nx_frame_be_1.AppError('messages.authorization.missingRole');
+    return scope;
+}
+/**
+ * The highest organization-tier role the user holds, if any.
+ *
+ * `ORG_MEMBER_ROLES` is ordered from the highest to the lowest privilege, so the
+ * first match IS the highest. Returns `undefined` for a user with no
+ * organization-tier role at all (possible for a pure provider-level account).
+ */
+function highestOrgRole(user) {
+    return constants_2.ORG_MEMBER_ROLES.find(r => user.hasRole?.(r));
+}
+/**
+ * Every organization the user reaches, for the LIST case.
+ *
+ * `resolveOrgScope` answers about ONE organization named by the request; this answers
+ * "which ones may appear at all?", which is what a model's `updateFilters` needs. The
+ * two share the same rules deliberately: a list that showed an organization the point
+ * check would then deny would be a leak by itself.
+ *
+ * Three outcomes, and the caller MUST tell them apart:
+ *
+ *   `undefined` -> no constraint: a cross-tenant user, every organization is visible
+ *   `string[]`  -> exactly these ids (memberships UNION grants), never any other
+ *   `[]`        -> nothing is visible; the caller must yield an EMPTY result, never all
+ *
+ * The union is what makes a grant visible in the organization switcher: an
+ * `ORG_EDITOR` granted on another organization must find it in the list, or the
+ * grant would be unusable (ADR-0005 section 3.2).
+ *
+ * @param user the authenticated user (`NxContext.user`)
+ * @returns `undefined` for no constraint, otherwise the exact set of reachable ids
+ */
+function reachableOrgIds(user) {
+    if (!user)
+        return [];
+    if (user.hasRole?.(constants_1.CROSS_TENANT_ROLES))
+        return undefined;
+    const ids = new Set();
+    user.organizations?.forEach(o => o.id && ids.add(String(o.id)));
+    user.grants?.forEach(g => g.id && ids.add(String(g.id)));
+    return [...ids];
+}
+//# sourceMappingURL=scope.js.map

package/build/utils/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;+FAa+F;;AAiC/F,0CAqBC;AAaD,wCAQC;AAmCD,0CAcC;AA1HD,sDAA0D;AAE1D,4CAAkD;AAClD,4CAAkD;AAElD,oCAA8C;AAG9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,eAAe,CAAC,IAAe,EAAE,KAAc;IAE7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QACjB,OAAO,IAAI,CAAC;IAEd,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,8BAAkB,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,QAAQ,EAAE,CAAC;IAEzC,gFAAgF;IAChF,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;IAEnE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAErD,IAAI,KAAK;QACP,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAE1D,mCAAmC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,IAAe,EAAE,KAAc;IAE5D,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,sBAAQ,CAAC,oCAAoC,CAAC,CAAC;IAE3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAc;IAEpC,OAAO,4BAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,eAAe,CAAC,IAAe;IAE7C,IAAI,CAAC,IAAI;QACP,OAAO,EAAE,CAAC;IAEZ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,8BAAkB,CAAC;QACpC,OAAO,SAAS,CAAC;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/build/utils/start-service.js

@@ -152,7 +152,7 @@ async function safeCheck(check) {
     }
 }
 /**
- * Normalises an unknown thrown value into a readable message.
+ * Normalizes an unknown thrown value into a readable message.
  */
 function errMessage(err) {
     if (err instanceof Error)