@spinajs/rbac-http-token 2.0.514 → 2.0.516

package/lib/cjs/actions.d.ts

@@ -49,7 +49,12 @@ export declare function _owner(user: User | number | string): () => Promise<User
  * that name was ever registered. A policy returning `'constructor'` would otherwise survive
  * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
  */
-export declare function _allowed_roles(owner: User): Promise<string[]>;
+export declare function _allowed_roles(owner: User, profile?: string): Promise<string[]>;
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+export declare function _allowed_profiles(owner: User): Promise<string[]>;
 /**
  * Creates a new access token for a user.
  *
@@ -64,8 +69,11 @@ export declare function _allowed_roles(owner: User): Promise<string[]>;
  * @param roles - roles carried by the token, subset of what the configured
  *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
+export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null, profile?: string): Promise<{
     Token: AccessToken;
     Plaintext: string;
 }>;

package/lib/cjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnE;AAiBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOrF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtE;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC/L;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyDtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/lib/cjs/actions.js

@@ -7,6 +7,7 @@ exports.E_TOKEN_CODES = void 0;
 exports._token = _token;
 exports._owner = _owner;
 exports._allowed_roles = _allowed_roles;
+exports._allowed_profiles = _allowed_profiles;
 exports.createToken = createToken;
 exports.deleteToken = deleteToken;
 exports.grantTokenRole = grantTokenRole;
@@ -101,21 +102,41 @@ function _token_ev(event, ...args) {
  * that name was ever registered. A policy returning `'constructor'` would otherwise survive
  * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
  */
-async function _allowed_roles(owner) {
+async function _allowed_roles(owner, profile) {
     const policy = await (0, configuration_1._service)('rbac.token.rolePolicy', interfaces_js_1.AccessTokenRolePolicy)();
-    const allowed = await policy.allowedRoles(owner);
+    const allowed = await policy.allowedRoles(owner, profile);
     const ac = di_1.DI.get('AccessControl');
     const grants = ac.getGrants();
     return allowed.filter((r) => Object.hasOwn(grants, r));
 }
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+async function _allowed_profiles(owner) {
+    const policy = await (0, configuration_1._service)('rbac.token.rolePolicy', interfaces_js_1.AccessTokenRolePolicy)();
+    return policy.allowedProfiles(owner);
+}
+/**
+ * Ensures `profile` is one the configured policy lets `owner` pin a token to.
+ */
+async function _assert_profile(owner, profile) {
+    const allowed = await _allowed_profiles(owner);
+    if (!allowed.includes(profile)) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not pin a token to profile: ${profile}`, { roles: [profile] });
+    }
+}
 /**
  * Ensures every role in `roles` is one the configured policy allows for
  * `owner`. Deliberately not "one the owner literally holds" - a policy may
  * permit roles beyond the owner's own `Role` list, or withhold ones on it;
  * that flexibility is the entire point of the policy seam.
+ *
+ * With `profile` given the question is asked relative to that profile, which a
+ * policy may answer more narrowly than the owner-wide union.
  */
-async function _assert_roles_subset(owner, roles) {
-    const allowed = await _allowed_roles(owner);
+async function _assert_roles_subset(owner, roles, profile) {
+    const allowed = await _allowed_roles(owner, profile);
     const missing = roles.filter((r) => !allowed.includes(r));
     if (missing.length !== 0) {
         throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not put role(s) on a token: ${missing.join(', ')}`, { roles: missing });
@@ -135,17 +156,26 @@ async function _assert_roles_subset(owner, roles) {
  * @param roles - roles carried by the token, subset of what the configured
  *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-async function createToken(user, name, roles, expiresAt) {
+async function createToken(user, name, roles, expiresAt, profile) {
     name = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)(), (0, util_1._max_length)(128))(name, 'name');
     roles = (0, util_1._check_arg)((0, util_1._non_nil)(), (0, util_1._non_empty)())(roles, 'roles');
     const generator = await (0, configuration_1._service)('rbac.token.generation', interfaces_js_1.AccessTokenGenerationProvider)();
     const generated = await generator.generate();
-    return (0, util_1._chain)(_owner(user), (0, util_1._tap)(async (u) => _assert_roles_subset(u, roles)), async (u) => {
+    return (0, util_1._chain)(_owner(user), (0, util_1._tap)(async (u) => {
+        if (profile) {
+            await _assert_profile(u, profile);
+        }
+        await _assert_roles_subset(u, roles, profile);
+    }), async (u) => {
         const token = new AccessToken_js_1.AccessToken({
             Name: name,
             Token: generated.Hash,
             Roles: lodash_1.default.uniq(roles),
+            Profile: profile ?? undefined,
             // `ExpiresAt` is optional rather than nullable ( see the model ), so a
             // "never expires" token leaves the property unset instead of holding null.
             ExpiresAt: expiresAt ?? undefined,
@@ -174,7 +204,7 @@ async function grantTokenRole(token, role) {
     role = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(role, 'role');
     return (0, util_1._chain)(_token(token), (0, util_1._tap)(async (t) => {
         const owner = await _owner(t.user_id)();
-        await _assert_roles_subset(owner, [role]);
+        await _assert_roles_subset(owner, [role], t.Profile);
         t.Roles = lodash_1.default.uniq([...t.Roles, role]);
         await t.update();
     }), _token_ev(index_js_1.AccessTokenRoleGranted, role));
@@ -251,11 +281,20 @@ async function validateToken(plaintext) {
     if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
         throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
     }
+    // a profile token whose owner no longer passes the profile policy (role
+    // revoked, policy tightened) authorises nothing - same immediacy rule as
+    // the role re-intersection below
+    if (token.Profile) {
+        const profiles = await _allowed_profiles(owner);
+        if (!profiles.includes(token.Profile)) {
+            throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token profile is no longer allowed for its owner', { token: token.Uuid });
+        }
+    }
     // roles are re-checked against the policy on every request rather than
     // trusted from the row: a role the owner loses - or one an application's
     // policy stops allowing - must take effect immediately, without having to
     // hunt down every token that still carries it
-    const allowed = await _allowed_roles(owner);
+    const allowed = await _allowed_roles(owner, token.Profile);
     const effective = token.Roles.filter((r) => allowed.includes(r));
     if (effective.length === 0) {
         throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });

package/lib/cjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAuB;AACvB,iCAAiC;AAEjC,wCAAqC;AACrC,wCAAmG;AACnG,0DAAkD;AAClD,0CAAqC;AACrC,oDAAgD;AAChD,oCAA8C;AAE9C,4DAAsD;AACtD,mDAAuF;AACvF,gDAA6I;AAE7I;;;;;;;;;;GAUG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,aAAb,aAAa,GAAb,aAAa,QAKxB;AAED;;GAEG;AACH,gBAAuB,KAA2B;IAChD,IAAI,gBAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,4BAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,gBAAuB,IAA4B;IACjD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,yBAAyB,KAAW;IAC9C,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAQ,EAAwB,uBAAuB,EAAE,qCAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe;IAC9D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,sBAAsB,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,4BAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,gBAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,6BAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,sBAAsB,KAA2B;IAC3D,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,6BAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,yBAAyB,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAE1C,CAAC,CAAC,KAAK,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,0BAA0B,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACI,KAAK,wBAAwB,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,gBAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACI,KAAK;IACV,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,qBAAqB,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,oDAAuB;AACvB,iCAAiC;AAEjC,wCAAqC;AACrC,wCAAmG;AACnG,0DAAkD;AAClD,0CAAqC;AACrC,oDAAgD;AAChD,oCAA8C;AAE9C,4DAAsD;AACtD,mDAAuF;AACvF,gDAA6I;AAE7I;;;;;;;;;;GAUG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,aAAb,aAAa,GAAb,aAAa,QAKxB;AAED;;GAEG;AACH,gBAAuB,KAA2B;IAChD,IAAI,gBAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,4BAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,gBAAuB,IAA4B;IACjD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,yBAAyB,KAAW,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAQ,EAAwB,uBAAuB,EAAE,qCAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACI,KAAK,4BAA4B,KAAW;IACjD,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAQ,EAAwB,uBAAuB,EAAE,qCAAqB,CAAC,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,KAAW,EAAE,OAAe;IACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe,EAAE,OAAgB;IAChF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,sBAAsB,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B,EAAE,OAAgB;IACzI,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,EACF,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,4BAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,gBAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,6BAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,sBAAsB,KAA2B;IAC3D,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,6BAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,yBAAyB,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAErD,CAAC,CAAC,KAAK,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,0BAA0B,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACI,KAAK,wBAAwB,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,gBAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,iCAAiC;IACjC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACI,KAAK;IACV,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,qBAAqB,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/cjs/controllers/AccessTokenController.d.ts

@@ -44,12 +44,29 @@ export declare class AccessTokenController extends BaseController {
      * Answers from the configured AccessTokenRolePolicy - the same source
      * `POST user/tokens` validates against, so a client can never be offered a
      * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
      * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
      * @response 200 Roles the caller may put on a token
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
-    roles(user: UserModel): Promise<Ok<unknown>>;
+    roles(user: UserModel, profile?: string): Promise<Ok<unknown>>;
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    profiles(user: UserModel): Promise<Ok<unknown>>;
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -64,10 +81,13 @@ export declare class AccessTokenController extends BaseController {
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
      * Roles must be a subset of what the configured AccessTokenRolePolicy allows
-     * the caller - the same set `GET user/tokens/roles` reports.
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not allowed for the caller by the configured role policy
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */

package/lib/cjs/controllers/AccessTokenController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;OASG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEhE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;OAUG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAAmC,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAW,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAE3F;IAED;;;;;;;;;OASG;IAGU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEnE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;;;;OAaG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}

package/lib/cjs/controllers/AccessTokenController.js

@@ -65,13 +65,32 @@ let AccessTokenController = class AccessTokenController extends http_1.BaseContr
      * Answers from the configured AccessTokenRolePolicy - the same source
      * `POST user/tokens` validates against, so a client can never be offered a
      * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
      * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
      * @response 200 Roles the caller may put on a token
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
-    async roles(user) {
-        return new http_1.Ok({ Roles: await (0, actions_js_1._allowed_roles)(user) });
+    async roles(user, profile) {
+        return new http_1.Ok({ Roles: await (0, actions_js_1._allowed_roles)(user, profile) });
+    }
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async profiles(user) {
+        return new http_1.Ok({ Profiles: await (0, actions_js_1._allowed_profiles)(user) });
     }
     /**
      * List own access tokens
@@ -90,17 +109,20 @@ let AccessTokenController = class AccessTokenController extends http_1.BaseContr
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
      * Roles must be a subset of what the configured AccessTokenRolePolicy allows
-     * the caller - the same set `GET user/tokens/roles` reports.
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not allowed for the caller by the configured role policy
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
     async create(user, dto) {
         const expiresAt = dto.ExpiresAt ? luxon_1.DateTime.fromISO(dto.ExpiresAt) : null;
         try {
-            const { Token, Plaintext } = await (0, actions_js_1.createToken)(user, dto.Name, dto.Roles, expiresAt);
+            const { Token, Plaintext } = await (0, actions_js_1.createToken)(user, dto.Name, dto.Roles, expiresAt, dto.Profile);
             return new http_1.Ok({ Token: this.toWire(Token), Plaintext }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
         }
         catch (err) {
@@ -229,10 +251,19 @@ __decorate([
     (0, http_1.Get)('tokens/roles'),
     (0, rbac_http_1.Permission)(['readOwn']),
     __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Query)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [rbac_1.User]),
+    __metadata("design:paramtypes", [rbac_1.User, String]),
     __metadata("design:returntype", Promise)
 ], AccessTokenController.prototype, "roles", null);
+__decorate([
+    (0, http_1.Get)('tokens/profiles'),
+    (0, rbac_http_1.Permission)(['readOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "profiles", null);
 __decorate([
     (0, http_1.Get)('tokens'),
     (0, rbac_http_1.Permission)(['readOwn']),

package/lib/cjs/controllers/AccessTokenController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAqI;AACrI,wCAAkD;AAClD,kDAAgE;AAChE,oDAAgD;AAChD,iCAAiC;AAEjC,6DAAuD;AACvD,8CAAyH;AACzH,oEAA4D;AAC5D,2EAAqE;AACrE,mFAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,qBAAc;IACvD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe;QACxC,OAAO,IAAI,SAAE,CAAC,EAAE,KAAK,EAAE,MAAM,IAAA,2BAAc,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAW,EAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,SAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAA,wBAAW,EAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAc,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAe,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,4BAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,sBAAS,IAAI,GAAG,CAAC,IAAI,KAAK,0BAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,yBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;;AA7Kc;IAFZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;kDAEzC;AAaY;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;iDAGxC;AAeY;IAFZ,IAAA,WAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAlB,WAAS,EAAe,oCAAc;;mDASvE;AAaY;IAFZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;mDAQ1C;AAkBY;IAFZ,IAAA,UAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAA1C,WAAS;;sDAY7C;AAiBY;IAFZ,IAAA,UAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAA1C,WAAS;;uDAY9C;gCAvIU,qBAAqB;IAHjC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,aAAa,CAAC;IACvB,IAAA,aAAM,EAAC,CAAC,wCAAiB,EAAE,gDAAqB,CAAC,CAAC;GACtC,qBAAqB,CA0LjC"}
+{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAA4I;AAC5I,wCAAkD;AAClD,kDAAgE;AAChE,oDAAgD;AAChD,iCAAiC;AAEjC,6DAAuD;AACvD,8CAA4I;AAC5I,oEAA4D;AAC5D,2EAAqE;AACrE,mFAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,qBAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe,EAAW,OAAgB;QACnE,OAAO,IAAI,SAAE,CAAC,EAAE,KAAK,EAAE,MAAM,IAAA,2BAAc,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,OAAO,IAAI,SAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,IAAA,8BAAiB,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAW,EAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClG,OAAO,IAAI,SAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAA,wBAAW,EAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAc,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAe,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,4BAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,sBAAS,IAAI,GAAG,CAAC,IAAI,KAAK,0BAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,yBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;;AAhMc;IAFZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;kDAEzC;AAcY;IAFZ,IAAA,UAAG,EAAC,iBAAiB,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACD,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;qDAE5C;AAaY;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;iDAGxC;AAkBY;IAFZ,IAAA,WAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAlB,WAAS,EAAe,oCAAc;;mDASvE;AAaY;IAFZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;mDAQ1C;AAkBY;IAFZ,IAAA,UAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAA1C,WAAS;;sDAY7C;AAiBY;IAFZ,IAAA,UAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAA1C,WAAS;;uDAY9C;gCAhKU,qBAAqB;IAHjC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,aAAa,CAAC;IACvB,IAAA,aAAM,EAAC,CAAC,wCAAiB,EAAE,gDAAqB,CAAC,CAAC;GACtC,qBAAqB,CAmNjC"}

package/lib/cjs/dto/create-token-dto.d.ts

@@ -17,6 +17,12 @@ export declare const CreateTokenDtoSchema: {
             minItems: number;
             description: string;
         };
+        Profile: {
+            type: string;
+            minLength: number;
+            maxLength: number;
+            description: string;
+        };
         ExpiresAt: {
             type: string[];
             format: string;
@@ -28,6 +34,7 @@ export declare const CreateTokenDtoSchema: {
 export declare class CreateTokenDto {
     Name: string;
     Roles: string[];
+    Profile?: string;
     ExpiresAt?: string | null;
     constructor(data: any);
 }

package/lib/cjs/dto/create-token-dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAC3E,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}
+{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAM3E,OAAO;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACpE,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}

package/lib/cjs/dto/create-token-dto.js

@@ -17,7 +17,13 @@ exports.CreateTokenDtoSchema = {
     type: 'object',
     properties: {
         Name: { type: 'string', minLength: 1, maxLength: 128, description: 'Human readable token label' },
-        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of own roles' },
+        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of what the role policy allows' },
+        // `minLength: 1` is load bearing, not cosmetic: an empty string is falsy all
+        // the way down the actions layer, so `Profile: ''` would mint an UNPINNED
+        // token instead of a refused one - a silent widening of what the token may
+        // reach. Rejecting it here is what keeps "asked for a profile" and "pinned
+        // to a profile" the same statement.
+        Profile: { type: 'string', minLength: 1, maxLength: 128, description: 'Profile (root role) to pin the token to; omitted = legacy union-scoped token' },
         ExpiresAt: { type: ['string', 'null'], format: 'date-time', description: 'ISO expiration instant; null or omitted = never expires' },
     },
     required: ['Name', 'Roles'],

package/lib/cjs/dto/create-token-dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA6C;AAEhC,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE;QACxI,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;;yBARY,cAAc;IAD1B,IAAA,mBAAM,EAAC,QAAA,oBAAoB,CAAC;;GAChB,cAAc,CAQ1B"}
+{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA6C;AAEhC,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE;QAC1J,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,oCAAoC;QACpC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,8EAA8E,EAAE;QACtJ,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAMzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;;yBATY,cAAc;IAD1B,IAAA,mBAAM,EAAC,QAAA,oBAAoB,CAAC;;GAChB,cAAc,CAS1B"}

package/lib/cjs/index.d.ts

@@ -4,6 +4,7 @@ import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js';
 export * from './generator.js';
 export * from './role-policy.js';
 export * from './events/index.js';

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/cjs/index.js

@@ -23,6 +23,7 @@ require("./middlewares.js");
 __exportStar(require("./interfaces.js"), exports);
 __exportStar(require("./models/AccessToken.js"), exports);
 __exportStar(require("./migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js"), exports);
+__exportStar(require("./migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js"), exports);
 __exportStar(require("./generator.js"), exports);
 __exportStar(require("./role-policy.js"), exports);
 __exportStar(require("./events/index.js"), exports);

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,0BAAwB;AACxB,4BAA0B;AAC1B,4BAA0B;AAE1B,kDAAgC;AAChC,0DAAwC;AACxC,2FAAyE;AACzE,iDAA+B;AAC/B,mDAAiC;AACjC,oDAAkC;AAClC,+CAA6B;AAC7B,mDAAiC;AACjC,4DAA0C;AAC1C,kEAAgD;AAChD,sEAAoD;AACpD,yEAAuD;AACvD,4DAA0C;AAC1C,uDAAqC;AACrC,uDAAqC;AACrC,0DAAwC;AACxC,2DAAyC;AACzC,+DAA6C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,0BAAwB;AACxB,4BAA0B;AAC1B,4BAA0B;AAE1B,kDAAgC;AAChC,0DAAwC;AACxC,2FAAyE;AACzE,2FAAyE;AACzE,iDAA+B;AAC/B,mDAAiC;AACjC,oDAAkC;AAClC,+CAA6B;AAC7B,mDAAiC;AACjC,4DAA0C;AAC1C,kEAAgD;AAChD,sEAAoD;AACpD,yEAAuD;AACvD,4DAA0C;AAC1C,uDAAqC;AACrC,uDAAqC;AACrC,0DAAwC;AACxC,2DAAyC;AACzC,+DAA6C"}

package/lib/cjs/interfaces.d.ts

@@ -32,6 +32,12 @@ export interface ITokenAuthInfo {
      * Uuid of the AccessToken row - safe to log; never the token itself.
      */
     Uuid: string;
+    /**
+     * The profile (a role name) this token is pinned to, when it carries one.
+     * Consumed by application row-scoping the way a session's ActiveRole is;
+     * permission checks do NOT read it - they stay on the narrowed User.Role.
+     */
+    Profile?: string;
 }
 /**
  * Decides which roles a given owner may put on an access token.
@@ -68,10 +74,21 @@ export declare abstract class AccessTokenRolePolicy {
      * existing tokens is re-intersected with on each authenticated request, so a
      * role dropped from this answer stops authorising immediately.
      *
+     * With `profile` set the answer is relative to that profile - an application
+     * policy may (and should) narrow it to roles the profile's own grants cover.
+     * The shipped default ignores the argument.
+     *
      * @param owner - at minimum a base `User` with `Metadata` populated; see the
      *                class docblock above for why nothing more may be assumed.
+     * @param profile - the profile the token is (or will be) pinned to
+     */
+    abstract allowedRoles(owner: User, profile?: string): Promise<string[]>;
+    /**
+     * Profiles `owner` may pin a token to. A profile plays the row-scoping part
+     * a session's ActiveRole plays - see `ITokenAuthInfo.Profile`. Default: none;
+     * an application that wants profile tokens overrides this in its policy.
      */
-    abstract allowedRoles(owner: User): Promise<string[]>;
+    allowedProfiles(_owner: User): Promise<string[]>;
 }
 declare module '@spinajs/rbac' {
     interface IRbacAsyncStorage {

package/lib/cjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;OAOG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC9D;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;;;;;;OAYG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/E;;;;OAIG;IACU,eAAe,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5D;CACF;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}

package/lib/cjs/interfaces.js

@@ -38,6 +38,14 @@ exports.AccessTokenGenerationProvider = AccessTokenGenerationProvider;
  * which is the behaviour this package had before the seam existed.
  */
 class AccessTokenRolePolicy {
+    /**
+     * Profiles `owner` may pin a token to. A profile plays the row-scoping part
+     * a session's ActiveRole plays - see `ITokenAuthInfo.Profile`. Default: none;
+     * an application that wants profile tokens overrides this in its policy.
+     */
+    async allowedProfiles(_owner) {
+        return [];
+    }
 }
 exports.AccessTokenRolePolicy = AccessTokenRolePolicy;
 //# sourceMappingURL=interfaces.js.map

package/lib/cjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAsBA;;;GAGG;AACH;CAUC;;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;CAUC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAsBA;;;GAGG;AACH;CAUC;;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;IAgBE;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAAC,MAAY;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/lib/cjs/middlewares.d.ts

@@ -35,6 +35,11 @@ import './interfaces.js';
  * runs first and, on a session-less request, stamps the GUEST account's first
  * role into it, which would otherwise survive into the token's own request.
  *
+ * A token's profile is therefore published on `req.storage.TokenAuth.Profile`
+ * instead, for the application's row-scoping layer to read; it is deliberately
+ * NOT written to `ActiveRole`, so it scopes rows without narrowing what the
+ * token is authorized for.
+ *
  * Never throws: an invalid token leaves the request as guest and lets the
  * route's policy produce the rejection.
  */

package/lib/cjs/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAkD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAuD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}

package/lib/cjs/middlewares.js

@@ -54,6 +54,11 @@ const BEARER_SCHEME = /^bearer\s+/i;
  * runs first and, on a session-less request, stamps the GUEST account's first
  * role into it, which would otherwise survive into the token's own request.
  *
+ * A token's profile is therefore published on `req.storage.TokenAuth.Profile`
+ * instead, for the application's row-scoping layer to read; it is deliberately
+ * NOT written to `ActiveRole`, so it scopes rows without narrowing what the
+ * token is authorized for.
+ *
  * Never throws: an invalid token leaves the request as guest and lets the
  * route's policy produce the rejection.
  */
@@ -89,7 +94,12 @@ let TokenAuthMiddleware = class TokenAuthMiddleware extends http_1.ServerMiddlew
                     return next();
                 }
                 req.storage.User = this.narrowRoles(result.User, result.EffectiveRoles);
-                req.storage.TokenAuth = { Uuid: result.Token.Uuid };
+                // `?? undefined` is not cosmetic: an unpinned token stores NULL and the
+                // orm reads it back as `null`, while `ITokenAuthInfo.Profile` is
+                // `string | undefined`. Passing the `null` through would make every
+                // `Profile === undefined` check downstream answer false on exactly the
+                // legacy tokens it is meant to recognise.
+                req.storage.TokenAuth = { Uuid: result.Token.Uuid, Profile: result.Token.Profile ?? undefined };
                 // CLEARED, not merely left alone - see the class docblock for why a
                 // token must carry no active role at all. `RbacMiddleware` has already
                 // run by now and, finding no session, wrote the GUEST user's first role

package/lib/cjs/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,wCAAsE;AACtE,oDAAgD;AAGhD,6CAAyD;AACzD,2BAAyB;AAEzB;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,uBAAgB;IAUvD;QACE,KAAK,EAAE,CAAC;QACR,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,iCAAiC;oBACjC,MAAM,IAAI,GAAG,GAAG,YAAY,sBAAS,CAAC,CAAC,CAAE,GAAG,CAAC,IAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtG,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBACxE,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAEpD,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,gEAAgE;gBAChE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAEnC,mEAAmE;gBACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAE3C,sEAAsE;gBACtE,oEAAoE;gBACpE,qCAAqC;gBACrC,KAAK,IAAA,uBAAU,EAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1N,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,WAAW,CAAC,IAAU,EAAE,KAAe;QAC/C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAa;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;CACF,CAAA;;AA3HW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;gDAAC;AAGT;IADT,IAAA,sBAAM,EAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;;uDAClC;AAGnB;IADT,IAAA,sBAAM,EAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;mEACzB;8BAR9B,mBAAmB;IAD/B,IAAA,eAAU,EAAC,uBAAgB,CAAC;;GAChB,mBAAmB,CA6H/B"}
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,wCAAsE;AACtE,oDAAgD;AAGhD,6CAAyD;AACzD,2BAAyB;AAEzB;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,uBAAgB;IAUvD;QACE,KAAK,EAAE,CAAC;QACR,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,iCAAiC;oBACjC,MAAM,IAAI,GAAG,GAAG,YAAY,sBAAS,CAAC,CAAC,CAAE,GAAG,CAAC,IAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtG,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBACxE,wEAAwE;gBACxE,iEAAiE;gBACjE,oEAAoE;gBACpE,uEAAuE;gBACvE,0CAA0C;gBAC1C,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;gBAEhG,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,gEAAgE;gBAChE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAEnC,mEAAmE;gBACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAE3C,sEAAsE;gBACtE,oEAAoE;gBACpE,qCAAqC;gBACrC,KAAK,IAAA,uBAAU,EAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1N,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,WAAW,CAAC,IAAU,EAAE,KAAe;QAC/C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAa;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;CACF,CAAA;;AAhIW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;gDAAC;AAGT;IADT,IAAA,sBAAM,EAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;;uDAClC;AAGnB;IADT,IAAA,sBAAM,EAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;mEACzB;8BAR9B,mBAAmB;IAD/B,IAAA,eAAU,EAAC,uBAAgB,CAAC;;GAChB,mBAAmB,CAkI/B"}

package/lib/cjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts

@@ -0,0 +1,6 @@
+import { OrmMigration, OrmDriver } from '@spinajs/orm';
+export declare class RbacHttpTokenProfile_2026_08_21_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts.map

package/lib/cjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAE5E,qBACa,wCAAyC,SAAQ,YAAY;IAC3D,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;CACF"}

package/lib/cjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RbacHttpTokenProfile_2026_08_21_00_00_00 = void 0;
+/* eslint-disable @typescript-eslint/no-unused-vars */
+const orm_1 = require("@spinajs/orm");
+let RbacHttpTokenProfile_2026_08_21_00_00_00 = class RbacHttpTokenProfile_2026_08_21_00_00_00 extends orm_1.OrmMigration {
+    async up(connection) {
+        await connection.schema().raw(new orm_1.RawQuery('ALTER TABLE rbac_access_tokens ADD COLUMN Profile VARCHAR(128) NULL'));
+    }
+    async down(connection) {
+        await connection.schema().raw(new orm_1.RawQuery('ALTER TABLE rbac_access_tokens DROP COLUMN Profile'));
+    }
+};
+exports.RbacHttpTokenProfile_2026_08_21_00_00_00 = RbacHttpTokenProfile_2026_08_21_00_00_00;
+exports.RbacHttpTokenProfile_2026_08_21_00_00_00 = RbacHttpTokenProfile_2026_08_21_00_00_00 = __decorate([
+    (0, orm_1.Migration)('default')
+], RbacHttpTokenProfile_2026_08_21_00_00_00);
+//# sourceMappingURL=RbacHttpTokenProfile_2026_08_21_00_00_00.js.map

package/lib/cjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RbacHttpTokenProfile_2026_08_21_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sDAAsD;AACtD,sCAA4E;AAGrE,IAAM,wCAAwC,GAA9C,MAAM,wCAAyC,SAAQ,kBAAY;IACjE,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,cAAQ,CAAC,qEAAqE,CAAC,CAAC,CAAC;IACrH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,cAAQ,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACpG,CAAC;CACF,CAAA;;mDARY,wCAAwC;IADpD,IAAA,eAAS,EAAC,SAAS,CAAC;GACR,wCAAwC,CAQpD"}