@venizia/ignis 0.2.0-5 → 0.2.0-7

package/dist/components/auth/authorize/role-managers/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./base"), exports);
+__exportStar(require("./domain-hierarchy"), exports);
+__exportStar(require("./membership"), exports);
+__exportStar(require("./resource"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/role-managers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,qDAAmC;AACnC,+CAA6B;AAC7B,6CAA2B"}

package/dist/components/auth/authorize/role-managers/membership.d.ts

@@ -0,0 +1,21 @@
+import type { RoleManager } from 'casbin';
+import { BaseRoleManager } from './base';
+/** `g2` axis (`g2(r.sub, r.dom)`): membership holds when the user joined the request domain or any
+ * ancestor of it, walking the shared per-request domain-hierarchy overlay. Memberships are
+ * per-principal and rebuilt every request, so `clear()` wipes all. */
+export declare class MembershipRoleManager extends BaseRoleManager implements RoleManager {
+    private readonly overlay?;
+    private memberships;
+    constructor(opts: {
+        overlay?: Map<string, Set<string>>;
+    });
+    clear(): Promise<void>;
+    addLink(user: string, domain: string): Promise<void>;
+    deleteLink(user: string, domain: string): Promise<void>;
+    /** True when `name1` (user) joined `name2` (request domain) itself, or any ancestor of it. Walks UP from the request domain only - walking down from every joined domain would fan out over the whole subtree. */
+    syncedHasLink(name1: string, name2: string): boolean;
+    /** Local membership state only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
+    getRoles(name: string): Promise<string[]>;
+    getUsers(name: string): Promise<string[]>;
+}
+//# sourceMappingURL=membership.d.ts.map

package/dist/components/auth/authorize/role-managers/membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/membership.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC;;sEAEsE;AACtE,qBAAa,qBAAsB,SAAQ,eAAgB,YAAW,WAAW;IAC/E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAGvB;IACF,OAAO,CAAC,WAAW,CAGf;gBAEQ,IAAI,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;KAAE;IAKlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,kNAAkN;IAClN,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA2BpD,uHAAuH;IACjH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAWhD"}

package/dist/components/auth/authorize/role-managers/membership.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MembershipRoleManager = void 0;
+const base_1 = require("./base");
+/** `g2` axis (`g2(r.sub, r.dom)`): membership holds when the user joined the request domain or any
+ * ancestor of it, walking the shared per-request domain-hierarchy overlay. Memberships are
+ * per-principal and rebuilt every request, so `clear()` wipes all. */
+class MembershipRoleManager extends base_1.BaseRoleManager {
+    constructor(opts) {
+        super({ scope: MembershipRoleManager.name });
+        this.memberships = new Map();
+        this.overlay = opts.overlay;
+    }
+    async clear() {
+        this.memberships = new Map();
+        this.graphReported = false;
+    }
+    async addLink(user, domain) {
+        const existing = this.memberships.get(user);
+        if (existing) {
+            existing.add(domain);
+        }
+        else {
+            this.memberships.set(user, new Set([domain]));
+        }
+    }
+    async deleteLink(user, domain) {
+        this.memberships.get(user)?.delete(domain);
+    }
+    /** True when `name1` (user) joined `name2` (request domain) itself, or any ancestor of it. Walks UP from the request domain only - walking down from every joined domain would fan out over the whole subtree. */
+    syncedHasLink(name1, name2) {
+        this.reportGraphOnce(() => {
+            const { nodeCount, edgeCount } = MembershipRoleManager.overlayStats(this.overlay);
+            return {
+                message: 'membership role manager initialized | nodes: %d | edges: %d',
+                args: [nodeCount, edgeCount],
+            };
+        });
+        const joined = this.memberships.get(name1);
+        if (!joined || joined.size === 0) {
+            return false;
+        }
+        const ancestors = MembershipRoleManager.collectAncestors({
+            overlay: this.overlay,
+            node: name2,
+        });
+        for (const ancestor of ancestors) {
+            if (joined.has(ancestor)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Local membership state only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
+    async getRoles(name) {
+        return [...(this.memberships.get(name) ?? [])];
+    }
+    async getUsers(name) {
+        const users = [];
+        for (const [user, domains] of this.memberships) {
+            if (domains.has(name)) {
+                users.push(user);
+            }
+        }
+        return users;
+    }
+}
+exports.MembershipRoleManager = MembershipRoleManager;
+//# sourceMappingURL=membership.js.map

package/dist/components/auth/authorize/role-managers/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/membership.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC;;sEAEsE;AACtE,MAAa,qBAAsB,SAAQ,sBAAe;IAUxD,YAAY,IAA4C;QACtD,KAAK,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QANvC,gBAAW,GAAG,IAAI,GAAG,EAG1B,CAAC;QAIF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,MAAc;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,kNAAkN;IAClN,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,6DAA6D;gBACtE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,gBAAgB,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uHAAuH;IACvH,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA7ED,sDA6EC"}

package/dist/components/auth/authorize/{enforcers/resource-role-manager.d.ts → role-managers/resource.d.ts}

@@ -1,22 +1,16 @@
-import { BaseHelper } from '@venizia/ignis-helpers/core';
 import type { RoleManager } from 'casbin';
+import { BaseRoleManager } from './base';
 /** Resource-axis (`g4`) role manager: `addMatchingFunc` would set `hasPattern` and disable DefaultRoleManager's O(1) fast path, so prefix ancestors are walked manually; `addLink` must stay idempotent because `buildRoleLinks` re-adds every edge once per request. */
-export declare class ResourceRoleManager extends BaseHelper implements RoleManager {
+export declare class ResourceRoleManager extends BaseRoleManager implements RoleManager {
     private parents;
-    private graphReported;
     constructor();
     clear(): Promise<void>;
     addLink(child: string, parent: string): Promise<void>;
     deleteLink(child: string, parent: string): Promise<void>;
     syncedHasLink(name1: string, name2: string): boolean;
-    hasLink(name1: string, name2: string): Promise<boolean>;
     getRoles(name: string): Promise<string[]>;
     getUsers(name: string): Promise<string[]>;
-    /** casbin calls this after buildRoleLinks purely as a debug hook; the resource graph is not logged. */
-    printRoles(): Promise<void>;
-    getDomains(): Promise<string[]>;
-    getAllDomains(): Promise<string[]>;
     /** All stored prefix ancestors of a dotted code (`a.b.c` -> `a.b` -> `a`), not only the deepest, plus a literal stored `'*'` node - `objectMatch(anything, '*')` is always true, so a `g4` edge whose child is `'*'` must stay reachable from every request object. */
     private collectStoredAncestors;
 }
-//# sourceMappingURL=resource-role-manager.d.ts.map
+//# sourceMappingURL=resource.d.ts.map

package/dist/components/auth/authorize/role-managers/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC,yQAAyQ;AACzQ,qBAAa,mBAAoB,SAAQ,eAAgB,YAAW,WAAW;IAC7E,OAAO,CAAC,OAAO,CAGX;;IAME,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA8C9C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAY/C,uQAAuQ;IACvQ,OAAO,CAAC,sBAAsB;CA0B/B"}

package/dist/components/auth/authorize/{enforcers/resource-role-manager.js → role-managers/resource.js}

@@ -1,13 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ResourceRoleManager = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
+const base_1 = require("./base");
 /** Resource-axis (`g4`) role manager: `addMatchingFunc` would set `hasPattern` and disable DefaultRoleManager's O(1) fast path, so prefix ancestors are walked manually; `addLink` must stay idempotent because `buildRoleLinks` re-adds every edge once per request. */
-class ResourceRoleManager extends core_1.BaseHelper {
+class ResourceRoleManager extends base_1.BaseRoleManager {
     constructor() {
         super({ scope: ResourceRoleManager.name });
         this.parents = new Map();
-        this.graphReported = false;
     }
     async clear() {
         this.parents = new Map();
@@ -29,14 +28,14 @@ class ResourceRoleManager extends core_1.BaseHelper {
         this.parents.get(child)?.delete(parent);
     }
     syncedHasLink(name1, name2) {
-        if (!this.graphReported) {
-            this.graphReported = true;
+        this.reportGraphOnce(() => {
             const nodeCount = this.parents.size;
             const edgeCount = Array.from(this.parents.values()).reduce((sum, set) => sum + set.size, 0);
-            this.logger
-                .for(this.syncedHasLink.name)
-                .debug('resource-role initialized | nodes: %d | edges: %d', nodeCount, edgeCount);
-        }
+            return {
+                message: 'resource-role initialized | nodes: %d | edges: %d',
+                args: [nodeCount, edgeCount],
+            };
+        });
         if (name1 === name2) {
             return true;
         }
@@ -65,9 +64,6 @@ class ResourceRoleManager extends core_1.BaseHelper {
         }
         return false;
     }
-    async hasLink(name1, name2) {
-        return this.syncedHasLink(name1, name2);
-    }
     async getRoles(name) {
         return [...(this.parents.get(name) ?? [])];
     }
@@ -80,14 +76,6 @@ class ResourceRoleManager extends core_1.BaseHelper {
         }
         return users;
     }
-    /** casbin calls this after buildRoleLinks purely as a debug hook; the resource graph is not logged. */
-    async printRoles() { }
-    async getDomains() {
-        return [];
-    }
-    async getAllDomains() {
-        return [];
-    }
     /** All stored prefix ancestors of a dotted code (`a.b.c` -> `a.b` -> `a`), not only the deepest, plus a literal stored `'*'` node - `objectMatch(anything, '*')` is always true, so a `g4` edge whose child is `'*'` must stay reachable from every request object. */
     collectStoredAncestors(opts) {
         const ancestors = [];
@@ -112,4 +100,4 @@ class ResourceRoleManager extends core_1.BaseHelper {
     }
 }
 exports.ResourceRoleManager = ResourceRoleManager;
-//# sourceMappingURL=resource-role-manager.js.map
+//# sourceMappingURL=resource.js.map

package/dist/components/auth/authorize/role-managers/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/resource.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC,yQAAyQ;AACzQ,MAAa,mBAAoB,SAAQ,sBAAe;IAMtD;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QANrC,YAAO,GAAG,IAAI,GAAG,EAGtB,CAAC;IAIJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5F,OAAO;gBACL,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC;QAEnC,uFAAuF;QACvF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uQAAuQ;IAC/P,sBAAsB,CAAC,IAAsB;QACnD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAED,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1HD,kDA0HC"}

package/dist/components/auth/models/entities/policy-definition.model.d.ts

@@ -1,25 +1,39 @@
-import { integer, jsonb, text } from 'drizzle-orm/pg-core';
-export type TPolicyDefinitionOptions = {
+import type { TAuthorizationDecision } from '@venizia/ignis-kernel';
+import { integer, text } from 'drizzle-orm/pg-core';
+export type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {
     idType?: 'string' | 'number';
+    /**
+     * App-only edge kinds stored in this same table alongside IGNIS's seven (e.g. `merchant_role`).
+     * `ScopedCasbinAdapter` never selects an undeclared variant - it is purely the consumer's data.
+     * Pass as an inline array literal; the `const` type parameter below infers the literal union
+     * from it without needing `as const`.
+     */
+    extraVariants?: ReadonlyArray<ExtraVariant>;
 };
-export type TPolicyDefinitionCommonColumns = {
-    variant: ReturnType<typeof text>;
-    subjectType: ReturnType<typeof text>;
-    targetType: ReturnType<typeof text>;
-    action: ReturnType<typeof text>;
-    effect: ReturnType<typeof text>;
-    domain: ReturnType<typeof text>;
-    metadata: ReturnType<typeof jsonb>;
+/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */
+type TExtraPolicyVariantOf<Opts> = Opts extends {
+    extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;
+} ? ExtraVariant : never;
+/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
+declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never>() => {
+    variant: import("drizzle-orm").NotNull<import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"variant", [string, ...string[]]>, "join_domain" | "assign_role" | "grant" | "role_inherits" | "domain_inherits" | "resource_inherits" | "action_inherits" | ExtraVariant>>;
+    subjectType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"subject_type", [string, ...string[]]>>;
+    targetType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"target_type", [string, ...string[]]>>;
+    action: import("drizzle-orm/pg-core").PgTextBuilderInitial<"action", [string, ...string[]]>;
+    effect: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"effect", [string, ...string[]]>, TAuthorizationDecision>;
+    domain: import("drizzle-orm/pg-core").PgTextBuilderInitial<"domain", [string, ...string[]]>;
+    metadata: import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">;
 };
-type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions | undefined = undefined> = Opts extends {
+export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant>>;
+type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined> = Opts extends {
     idType: 'string';
-} ? TPolicyDefinitionCommonColumns & {
+} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>> & {
     subjectId: ReturnType<typeof text>;
     targetId: ReturnType<typeof text>;
-} : TPolicyDefinitionCommonColumns & {
+} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>> & {
     subjectId: ReturnType<typeof integer>;
     targetId: ReturnType<typeof integer>;
 };
-export declare const extraPolicyDefinitionColumns: <Opts extends TPolicyDefinitionOptions | undefined>(opts?: Opts) => TPolicyDefinitionColumnDef<Opts>;
+export declare const extraPolicyDefinitionColumns: <const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined>(opts?: Opts) => TPolicyDefinitionColumnDef<Opts>;
 export {};
 //# sourceMappingURL=policy-definition.model.d.ts.map

package/dist/components/auth/models/entities/policy-definition.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACjC,WAAW,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACrC,UAAU,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,QAAQ,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;CACpC,CAAC;AAEF,KAAK,0BAA0B,CAAC,IAAI,SAAS,wBAAwB,GAAG,SAAS,GAAG,SAAS,IAC3F,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAC7B,8BAA8B,GAAG;IAC/B,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,GAAG;IAC/B,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAER,eAAO,MAAM,4BAA4B,GAAI,IAAI,SAAS,wBAAwB,GAAG,SAAS,EAC5F,OAAO,IAAI,KACV,0BAA0B,CAAC,IAAI,CAoCjC,CAAC"}
+{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAA+B,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC;AAEF,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GAAI,YAAY,SAAS,MAAM,GAAG,KAAK;;;;;;;;CAkB7E,CAAC;AAEH,MAAM,MAAM,8BAA8B,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI,UAAU,CAC1F,OAAO,kCAAkC,CAAC,YAAY,CAAC,CACxD,CAAC;AAEF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,IACnE,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG;IAC5D,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG;IAC5D,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN,eAAO,MAAM,4BAA4B,GACvC,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAE3E,OAAO,IAAI,KACV,0BAA0B,CAAC,IAAI,CA0BjC,CAAC"}

package/dist/components/auth/models/entities/policy-definition.model.js

@@ -3,18 +3,26 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extraPolicyDefinitionColumns = void 0;
 const core_1 = require("@venizia/ignis-helpers/core");
 const pg_core_1 = require("drizzle-orm/pg-core");
+/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
+const buildCommonPolicyDefinitionColumns = () => ({
+    // Narrowed to AuthorizationPolicyVariants.ALL's seven edge kinds plus any app-declared extras -
+    // a typo here is a silent 403, not a compile error.
+    variant: (0, pg_core_1.text)('variant').$type().notNull(),
+    subjectType: (0, pg_core_1.text)('subject_type').notNull(),
+    targetType: (0, pg_core_1.text)('target_type').notNull(),
+    // Open-ended: grant rows carry a Permission-catalog action code, not a value from a fixed lattice.
+    action: (0, pg_core_1.text)('action'),
+    // Narrowed to AuthorizationDecisions (allow/deny/abstain) and NOT extensible like `variant`:
+    // the casbin effect evaluator itself reads this value, so an unknown effect is a correctness
+    // bug in enforcement, not a harmless unselected row.
+    effect: (0, pg_core_1.text)('effect').$type(),
+    domain: (0, pg_core_1.text)('domain'),
+    // Nullable: only subset grants populate it, and a consumer may map its own column instead.
+    metadata: (0, pg_core_1.jsonb)('metadata'),
+});
 const extraPolicyDefinitionColumns = (opts) => {
     const { idType = 'number' } = opts ?? {};
-    const common = {
-        variant: (0, pg_core_1.text)('variant').notNull(),
-        subjectType: (0, pg_core_1.text)('subject_type').notNull(),
-        targetType: (0, pg_core_1.text)('target_type').notNull(),
-        action: (0, pg_core_1.text)('action'),
-        effect: (0, pg_core_1.text)('effect'),
-        domain: (0, pg_core_1.text)('domain'),
-        // Nullable: only subset grants populate it, and a consumer may map its own column instead.
-        metadata: (0, pg_core_1.jsonb)('metadata'),
-    };
+    const common = buildCommonPolicyDefinitionColumns();
     switch (idType) {
         case 'number': {
             return {

package/dist/components/auth/models/entities/policy-definition.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-definition.model.js","sourceRoot":"","sources":["../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AACvD,iDAA2D;AA2BpD,MAAM,4BAA4B,GAAG,CAC1C,IAAW,EACuB,EAAE;IACpC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAA,cAAI,EAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QAClC,WAAW,EAAE,IAAA,cAAI,EAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,UAAU,EAAE,IAAA,cAAI,EAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QACzC,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC;QACtB,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC;QACtB,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC;QAEtB,2FAA2F;QAC3F,QAAQ,EAAE,IAAA,eAAK,EAAC,UAAU,CAAC;KAC5B,CAAC;IAEF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,IAAA,iBAAO,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;gBAC1C,QAAQ,EAAE,IAAA,iBAAO,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;aACL,CAAC;QACxC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,IAAA,cAAI,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;aACF,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,2DAA2D,MAAM,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAtCW,QAAA,4BAA4B,gCAsCvC"}
+{"version":3,"file":"policy-definition.model.js","sourceRoot":"","sources":["../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAEvD,iDAA2D;AAoB3D,iHAAiH;AACjH,MAAM,kCAAkC,GAAG,GAAwC,EAAE,CAAC,CAAC;IACrF,gGAAgG;IAChG,oDAAoD;IACpD,OAAO,EAAE,IAAA,cAAI,EAAC,SAAS,CAAC,CAAC,KAAK,EAA8C,CAAC,OAAO,EAAE;IACtF,WAAW,EAAE,IAAA,cAAI,EAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAA,cAAI,EAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAEzC,mGAAmG;IACnG,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC;IAEtB,6FAA6F;IAC7F,6FAA6F;IAC7F,qDAAqD;IACrD,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC,CAAC,KAAK,EAA0B;IACtD,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC;IAEtB,2FAA2F;IAC3F,QAAQ,EAAE,IAAA,eAAK,EAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAkBI,MAAM,4BAA4B,GAAG,CAG1C,IAAW,EACuB,EAAE;IACpC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG,kCAAkC,EAA+B,CAAC;IAEjF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,IAAA,iBAAO,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;gBAC1C,QAAQ,EAAE,IAAA,iBAAO,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;aACL,CAAC;QACxC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,IAAA,cAAI,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;aACF,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,2DAA2D,MAAM,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AA9BW,QAAA,4BAA4B,gCA8BvC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venizia/ignis",
-  "version": "0.2.0-5",
+  "version": "0.2.0-7",
   "description": "High-performance TypeScript server infrastructure combining LoopBack 4 enterprise architecture (decorator-based DI, repository pattern, component system) with Hono speed (~140k req/s). Features auto-generated OpenAPI docs, Drizzle ORM type-safe SQL, JWT/Basic authentication, Casbin authorization, convention-based bootstrapping, and pluggable components for health checks, Swagger UI, mail, Socket.IO, and static assets. Built for Bun and Node.js.",
   "keywords": [
     "access-control",
@@ -198,12 +198,12 @@
     "prepublishOnly": "bun run rebuild"
   },
   "dependencies": {
-    "@venizia/ignis-boot": "^0.2.0-3",
-    "@venizia/ignis-connectors": "^0.2.0-5",
-    "@venizia/ignis-filter": "^0.2.0-1",
-    "@venizia/ignis-helpers": "^0.2.0-4",
-    "@venizia/ignis-inversion": "^0.2.0-0",
-    "@venizia/ignis-kernel": "^0.2.0-5",
+    "@venizia/ignis-boot": "^0.2.0-5",
+    "@venizia/ignis-connectors": "^0.2.0-7",
+    "@venizia/ignis-filter": "^0.2.0-3",
+    "@venizia/ignis-helpers": "^0.2.0-6",
+    "@venizia/ignis-inversion": "^0.2.0-2",
+    "@venizia/ignis-kernel": "^0.2.0-7",
     "lodash": "^4.18.1",
     "reflect-metadata": "^0.2.2",
     "zod": "^4.4.3"
@@ -306,7 +306,7 @@
     "@types/lodash": "^4.17.23",
     "@types/nodemailer": "^8.0.1",
     "@types/pg": "^8.20.0",
-    "@venizia/dev-configs": "^0.2.0-0",
+    "@venizia/dev-configs": "^0.2.0-2",
     "casbin": "^5.51.1",
     "drizzle-kit": "^0.31.10",
     "eslint": "^10.7.0",

package/dist/components/auth/authorize/enforcers/resource-role-manager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource-role-manager.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/resource-role-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE1C,yQAAyQ;AACzQ,qBAAa,mBAAoB,SAAQ,UAAW,YAAW,WAAW;IACxE,OAAO,CAAC,OAAO,CAGX;IACJ,OAAO,CAAC,aAAa,CAAS;;IAMxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA8C9C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAY/C,uGAAuG;IACjG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAI/B,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,uQAAuQ;IACvQ,OAAO,CAAC,sBAAsB;CA0B/B"}

package/dist/components/auth/authorize/enforcers/resource-role-manager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource-role-manager.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/resource-role-manager.ts"],"names":[],"mappings":";;;AAAA,sDAAyD;AAGzD,yQAAyQ;AACzQ,MAAa,mBAAoB,SAAQ,iBAAU;IAOjD;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAPrC,YAAO,GAAG,IAAI,GAAG,EAGtB,CAAC;QACI,kBAAa,GAAG,KAAK,CAAC;IAI9B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,KAAK,CAAC,mDAAmD,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC;QAEnC,uFAAuF;QACvF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,uQAAuQ;IAC/P,sBAAsB,CAAC,IAAsB;QACnD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAED,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1ID,kDA0IC"}