@venizia/ignis 0.2.0-9 → 0.2.0

package/dist/components/auth/authorize/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC"}

package/dist/components/auth/authorize/adapters/index.js

@@ -15,8 +15,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./base-filtered"), exports);
+__exportStar(require("./common"), exports);
 __exportStar(require("./connector"), exports);
 __exportStar(require("./custom-grant-expander"), exports);
-__exportStar(require("./scoped-casbin.adapter"), exports);
-__exportStar(require("./types"), exports);
+__exportStar(require("./scoped-casbin"), exports);
 //# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,8CAA4B;AAC5B,0DAAwC;AACxC,0DAAwC;AACxC,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,2CAAyB;AACzB,8CAA4B;AAC5B,0DAAwC;AACxC,kDAAgC"}

package/dist/components/auth/authorize/adapters/{scoped-casbin.adapter.d.ts → scoped-casbin/adapter.d.ts}

@@ -1,59 +1,11 @@
-import type { IdType } from '../../../../base';
-import type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';
+import type { IdType } from '../../../../../base';
 import { type Model } from 'casbin';
 import { type SQL } from 'drizzle-orm';
-import { BaseFilteredAdapter } from './base-filtered';
-import { CustomGrantExpander } from './custom-grant-expander';
-import type { ICasbinPolicySource, IScopedCasbinEntities } from './types';
-export type TDomainHierarchyEdge = {
-    child: string;
-    parent: string;
-};
-export interface IScopedCasbinPolicyFilter {
-    principal: {
-        type: string;
-        id: IdType;
-    };
-}
-/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */
-export type TGrantRow = {
-    subjectId: IdType;
-    objectCode: TNullable<string>;
-    objectSubject: TNullable<string>;
-    objectMethod: TNullable<string>;
-    action: TNullable<string>;
-    effect: TNullable<string>;
-    domain: TNullable<string>;
-    metadata?: unknown;
-};
-export declare class PrincipalPolicyEdges {
-    static readonly DIRECT = "direct";
-    static readonly ROLE_EDGE = "roleEdge";
-    static readonly ROLE_GRANT = "roleGrant";
-    static readonly DOMAIN_EDGE = "domainEdge";
-}
-/** A row from the single principal-policy statement; `kind` says which branch produced it. */
-export type TPrincipalPolicyRow = TGrantRow & {
-    kind: TConstValue<typeof PrincipalPolicyEdges>;
-    variant: string;
-    targetType: TNullable<string>;
-    targetId: IdType;
-};
-/**
- * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant
- * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app
- * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the
- * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own
- * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side
- * re-formats them.
- */
-export type TResolveDomainEdgesFn = (opts: {
-    principal: {
-        type: string;
-        id: IdType;
-    };
-    domains: string[];
-}) => Promise<TDomainHierarchyEdge[]>;
+import { BaseFilteredAdapter } from '../base-filtered';
+import { CustomGrantExpander } from '../custom-grant-expander';
+import type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';
+import { type TPrincipalPolicyRow } from './policy-edges';
+import { type IScopedCasbinPolicyFilter, type TGrantRow, type TResolveDomainEdgesFn } from './common';
 /**
  * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,
  * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.
@@ -108,6 +60,10 @@ export declare class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasb
     protected schemaOf(table: {
         schemaName?: string;
     }): string;
+    /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */
+    protected domainTokenSelection(opts: {
+        alias: string;
+    }): SQL;
     /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
     protected qualifiedTable(opts: {
         table: {
@@ -134,4 +90,4 @@ export declare class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasb
     /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */
     protected queryEdgePolicies(): Promise<string[]>;
 }
-//# sourceMappingURL=scoped-casbin.adapter.d.ts.map
+//# sourceMappingURL=adapter.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAO,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAQ5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB,CAAC,yBAAyB,CAAC;IACrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC5D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;gBAElD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,qBAAqB,CAAC;QAChC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;KAC5C;IAUD;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmExF,wEAAwE;IACxE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/B,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,YAAY,EAAE,SAAS,EAAE,CAAC;KAC3B,GAAG,IAAI;IAiCR;;;;;;OAMG;cACa,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyBrB,kDAAkD;IAClD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAI1D,4SAA4S;IAC5S,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IAY5D,uGAAuG;IACvG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,GAAG;IAK1F,4LAA4L;IAC5L,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IASxD,iOAAiO;cACjN,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA8IlC,iGAAiG;cACjF,eAAe,CAAC,IAAI,EAAE;QACpC,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4FrB,2OAA2O;cAC3N,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CA6BvD"}

package/dist/components/auth/authorize/adapters/{scoped-casbin.adapter.js → scoped-casbin/adapter.js}

@@ -1,19 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScopedCasbinAdapter = exports.PrincipalPolicyEdges = void 0;
+exports.ScopedCasbinAdapter = void 0;
 const drizzle_orm_1 = require("drizzle-orm");
 const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const base_filtered_1 = require("./base-filtered");
-const custom_grant_expander_1 = require("./custom-grant-expander");
-class PrincipalPolicyEdges {
-    static { this.DIRECT = 'direct'; }
-    static { this.ROLE_EDGE = 'roleEdge'; }
-    static { this.ROLE_GRANT = 'roleGrant'; }
-    static { this.DOMAIN_EDGE = 'domainEdge'; }
-}
-exports.PrincipalPolicyEdges = PrincipalPolicyEdges;
-const DEFAULT_SCHEMA = 'public';
+const base_filtered_1 = require("../base-filtered");
+const custom_grant_expander_1 = require("../custom-grant-expander");
+const policy_edges_1 = require("./policy-edges");
+const common_1 = require("./common");
 /**
  * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,
  * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.
@@ -52,15 +46,15 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
         const domainClosure = new Set();
         for (const row of principalRows) {
             switch (row.kind) {
-                case PrincipalPolicyEdges.ROLE_EDGE: {
+                case policy_edges_1.PrincipalPolicyEdges.ROLE_EDGE: {
                     lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`);
                     break;
                 }
-                case PrincipalPolicyEdges.ROLE_GRANT: {
+                case policy_edges_1.PrincipalPolicyEdges.ROLE_GRANT: {
                     roleGrants.push(row);
                     break;
                 }
-                case PrincipalPolicyEdges.DOMAIN_EDGE: {
+                case policy_edges_1.PrincipalPolicyEdges.DOMAIN_EDGE: {
                     lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`);
                     // Both ends are, by construction, members of the principal's domain_closure CTE.
                     domainClosure.add(String(row.subjectId));
@@ -140,7 +134,18 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
     }
     /** Schema for a table, defaulting to `public`. */
     schemaOf(table) {
-        return table.schemaName ?? DEFAULT_SCHEMA;
+        return table.schemaName ?? common_1.DEFAULT_SCHEMA;
+    }
+    /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */
+    domainTokenSelection(opts) {
+        const column = (name) => (0, drizzle_orm_1.sql) `${drizzle_orm_1.sql.raw(opts.alias)}.${drizzle_orm_1.sql.identifier(name)}`;
+        const domainType = column('domain_type');
+        const domainId = column('domain_id');
+        return (0, drizzle_orm_1.sql) `CASE
+      WHEN ${domainType} IS NULL THEN NULL
+      WHEN ${domainId} IS NULL THEN ${domainType}
+      ELSE ${domainType} || '_' || ${domainId}::text
+    END AS "domain"`;
     }
     /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
     qualifiedTable(opts) {
@@ -203,14 +208,14 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
       )
 
       SELECT
-        ${PrincipalPolicyEdges.DIRECT}::text AS "kind",
+        ${policy_edges_1.PrincipalPolicyEdges.DIRECT}::text AS "kind",
         policyDefinition.variant,
         policyDefinition.subject_id::text AS "subjectId",
         policyDefinition.target_type AS "targetType",
         policyDefinition.target_id::text AS "targetId",
         policyDefinition.action,
         policyDefinition.effect,
-        policyDefinition.domain,
+        ${this.domainTokenSelection({ alias: 'policyDefinition' })},
         permission.code AS "objectCode",
         permission.subject AS "objectSubject",
         permission.method AS "objectMethod"${metadataSelection}
@@ -232,7 +237,7 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
       UNION ALL
 
       SELECT
-        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS "kind",
+        ${policy_edges_1.PrincipalPolicyEdges.ROLE_EDGE}::text AS "kind",
         policyDefinition.variant,
         policyDefinition.subject_id::text AS "subjectId",
         policyDefinition.target_type AS "targetType",
@@ -250,14 +255,14 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
       UNION ALL
 
       SELECT
-        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS "kind",
+        ${policy_edges_1.PrincipalPolicyEdges.ROLE_GRANT}::text AS "kind",
         policyDefinition.variant,
         policyDefinition.subject_id::text AS "subjectId",
         policyDefinition.target_type AS "targetType",
         policyDefinition.target_id::text AS "targetId",
         policyDefinition.action,
         policyDefinition.effect,
-        policyDefinition.domain,
+        ${this.domainTokenSelection({ alias: 'policyDefinition' })},
         permission.code AS "objectCode",
         permission.subject AS "objectSubject",
         permission.method AS "objectMethod"${metadataSelection}
@@ -271,7 +276,7 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
       UNION ALL
 
       SELECT
-        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS "kind",
+        ${policy_edges_1.PrincipalPolicyEdges.DOMAIN_EDGE}::text AS "kind",
         policyDefinition.variant,
         policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS "subjectId",
         NULL AS "targetType",
@@ -385,4 +390,4 @@ class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
     }
 }
 exports.ScopedCasbinAdapter = ScopedCasbinAdapter;
-//# sourceMappingURL=scoped-casbin.adapter.js.map
+//# sourceMappingURL=adapter.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":";;;AAEA,6CAA4C;AAC5C,wDAAqD;AACrD,wDAK+B;AAC/B,oDAAuD;AACvD,oEAAqF;AAErF,iDAAgF;AAChF,qCAMkB;AAElB;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,mCAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,2CAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,mCAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,uBAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,IAAA,iBAAG,EAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,IAAA,iBAAG,EAAA,sBAAsB,iBAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,6BAA6B,CAAC,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,iBAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,UAAU,EAAE,CAAC,EACjD,IAAA,iBAAG,EAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,IAAA,iBAAG,EAAA;;;eAGL,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,mCAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,mCAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,mCAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,0CAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,mCAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,wCAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,qCAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,2BAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,mCAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,IAAA,iBAAG,EAAA;;UAEV,0CAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,0CAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,0CAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;CACF;AAvdD,kDAudC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const DEFAULT_SCHEMA = "public";
+//# sourceMappingURL=constants.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,WAAW,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SCHEMA = void 0;
+exports.DEFAULT_SCHEMA = 'public';
+//# sourceMappingURL=constants.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG,QAAQ,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types';
+export * from './constants';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./constants"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8CAA4B"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts

@@ -0,0 +1,50 @@
+import type { IdType } from '../../../../../../base';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+export type TDomainHierarchyEdge = {
+    child: string;
+    parent: string;
+};
+export interface IScopedCasbinPolicyFilter {
+    principal: {
+        type: string;
+        id: IdType;
+    };
+}
+/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */
+export type TGrantRow = {
+    subjectId: IdType;
+    objectCode: TNullable<string>;
+    objectSubject: TNullable<string>;
+    objectMethod: TNullable<string>;
+    action: TNullable<string>;
+    effect: TNullable<string>;
+    domain: TNullable<string>;
+    metadata?: unknown;
+};
+/**
+ * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant
+ * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app
+ * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the
+ * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own
+ * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side
+ * re-formats them.
+ *
+ * `domains` is the principal's **membership closure** - built from `join_domain` rows plus both
+ * ends of every `domainEdge` row. It is NOT the set of domains the principal holds a role in via
+ * `assign_role`: a principal can carry `assign_role` at a domain it never joined. A hook ported
+ * from a mechanism that derived its domains from `assign_role` will silently lose access for
+ * exactly those principals - no error, no log, just fewer edges reaching `g`/`g2`/`g3` than before.
+ *
+ * More than one hierarchy axis (e.g. an organizer tree and a separate region tree)? Write one
+ * function per axis and concatenate their results here - this hook deliberately takes a single
+ * function, so composition stays visible in the application, not hidden inside the framework:
+ * `resolveDomainEdges: async opts => [...(await organizerEdges(opts)), ...(await regionEdges(opts))]`.
+ */
+export type TResolveDomainEdgesFn = (opts: {
+    principal: {
+        type: string;
+        id: IdType;
+    };
+    domains: string[];
+}) => Promise<TDomainHierarchyEdge[]>;
+//# sourceMappingURL=types.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,gHAAgH;AAChH,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,KAAK,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":""}

package/dist/components/auth/authorize/adapters/scoped-casbin/index.d.ts

@@ -0,0 +1,4 @@
+export type { IScopedCasbinPolicyFilter, TDomainHierarchyEdge, TGrantRow, TResolveDomainEdgesFn, } from './common';
+export * from './policy-edges';
+export * from './adapter';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,yBAAyB,EACzB,oBAAoB,EACpB,SAAS,EACT,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./policy-edges"), exports);
+__exportStar(require("./adapter"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAQA,iDAA+B;AAC/B,4CAA0B"}

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts

@@ -0,0 +1,17 @@
+import type { IdType } from '../../../../../base';
+import type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';
+import type { TGrantRow } from './common';
+export declare class PrincipalPolicyEdges {
+    static readonly DIRECT = "direct";
+    static readonly ROLE_EDGE = "roleEdge";
+    static readonly ROLE_GRANT = "roleGrant";
+    static readonly DOMAIN_EDGE = "domainEdge";
+}
+/** A row from the single principal-policy statement; `kind` says which branch produced it. */
+export type TPrincipalPolicyRow = TGrantRow & {
+    kind: TConstValue<typeof PrincipalPolicyEdges>;
+    variant: string;
+    targetType: TNullable<string>;
+    targetId: IdType;
+};
+//# sourceMappingURL=policy-edges.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-edges.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc;IACvC,MAAM,CAAC,QAAQ,CAAC,UAAU,eAAe;IACzC,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;CAC5C;AAED,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG;IAC5C,IAAI,EAAE,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalPolicyEdges = void 0;
+class PrincipalPolicyEdges {
+    static { this.DIRECT = 'direct'; }
+    static { this.ROLE_EDGE = 'roleEdge'; }
+    static { this.ROLE_GRANT = 'roleGrant'; }
+    static { this.DOMAIN_EDGE = 'domainEdge'; }
+}
+exports.PrincipalPolicyEdges = PrincipalPolicyEdges;
+//# sourceMappingURL=policy-edges.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-edges.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":";;;AAIA,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,cAAS,GAAG,UAAU,CAAC;aACvB,eAAU,GAAG,WAAW,CAAC;aACzB,gBAAW,GAAG,YAAY,CAAC;;AAJ7C,oDAKC"}

package/dist/components/auth/authorize/enforcers/policy-line-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-line-codec.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAC9B,MAAM,IAAI,gBAAgB,EAC1B,KAAK,IAAI,eAAe,EACzB,MAAM,QAAQ,CAAC;AAEhB;;;GAGG;AACH,qBAAa,eAAe;IAC1B,wKAAwK;WAC3J,gBAAgB,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,eAAe,CAAC;QACvB,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBrB,mNAAmN;WACtM,gBAAgB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwBxF,4FAA4F;WAC/E,kBAAkB,CAAC,IAAI,EAAE;QACpC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlB"}
+{"version":3,"file":"policy-line-codec.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAC9B,MAAM,IAAI,gBAAgB,EAC1B,KAAK,IAAI,eAAe,EACzB,MAAM,QAAQ,CAAC;AAEhB;;;GAGG;AACH,qBAAa,eAAe;IAC1B,wKAAwK;WAC3J,gBAAgB,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,eAAe,CAAC;QACvB,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBrB,mNAAmN;WACtM,gBAAgB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BxF,4FAA4F;WAC/E,kBAAkB,CAAC,IAAI,EAAE;QACpC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlB"}

package/dist/components/auth/authorize/enforcers/policy-line-codec.js

@@ -28,14 +28,16 @@ class PolicyLineCodec {
         const model = enforcer.getModel();
         const lines = [];
         const policyTypes = model.model.get(ignis_kernel_1.CasbinRuleVariants.P);
-        for (const ptype of policyTypes?.keys() ?? []) {
+        const policyTypesKeys = policyTypes?.keys() ?? [];
+        for (const ptype of policyTypesKeys) {
             const rules = await enforcer.getNamedPolicy(ptype);
             for (const rule of rules) {
                 lines.push([ptype, ...rule].join(', '));
             }
         }
         const groupingTypes = model.model.get(ignis_kernel_1.CasbinRuleVariants.G);
-        for (const gtype of groupingTypes?.keys() ?? []) {
+        const groupingTypesKeys = groupingTypes?.keys() ?? [];
+        for (const gtype of groupingTypesKeys) {
             const rules = await enforcer.getNamedGroupingPolicy(gtype);
             for (const rule of rules) {
                 lines.push([gtype, ...rule].join(', '));

package/dist/components/auth/authorize/enforcers/policy-line-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-line-codec.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AACvD,wDAI+B;AAO/B;;;GAGG;AACH,MAAa,eAAe;IAC1B,wKAAwK;IACxK,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAK7B;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,kBAAkB,CAAC;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,mNAAmN;IACnN,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAsC;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;CACF;AAhED,0CAgEC"}
+{"version":3,"file":"policy-line-codec.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AACvD,wDAI+B;AAO/B;;;GAGG;AACH,MAAa,eAAe;IAC1B,wKAAwK;IACxK,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAK7B;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,kBAAkB,CAAC;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,mNAAmN;IACnN,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAsC;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;CACF;AAlED,0CAkEC"}

package/dist/components/auth/authorize/role-managers/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,8BAAsB,eAAgB,SAAQ,UAAU;IACtD,SAAS,CAAC,aAAa,UAAS;IAEhC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAEvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,8GAA8G;IACxG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAI/B,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,8HAA8H;IAC9H,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,GAAG,IAAI;IAUlF,gGAAgG;IAChG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG;QACjE,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB;IAaD;;yGAEqG;IACrG,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACtC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,MAAM,EAAE;CA4Bb"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,8BAAsB,eAAgB,SAAQ,UAAU;IACtD,SAAS,CAAC,aAAa,UAAS;IAEhC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAEvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,8GAA8G;IACxG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAI/B,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,8HAA8H;IAC9H,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,GAAG,IAAI;IAUlF,gGAAgG;IAChG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG;QACjE,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB;IAcD;;yGAEqG;IACrG,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACtC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,MAAM,EAAE;CA4Bb"}

package/dist/components/auth/authorize/role-managers/base.js

@@ -39,7 +39,8 @@ class BaseRoleManager extends core_1.BaseHelper {
             return { nodeCount: 0, edgeCount: 0 };
         }
         let edgeCount = 0;
-        for (const parents of overlay.values()) {
+        const overlayValues = overlay.values();
+        for (const parents of overlayValues) {
             edgeCount += parents.size;
         }
         return { nodeCount: overlay.size, edgeCount };

package/dist/components/auth/authorize/role-managers/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":";;;AAAA,sDAAyD;AAEzD;;;;;GAKG;AACH,MAAsB,eAAgB,SAAQ,iBAAU;IAAxD;;QACY,kBAAa,GAAG,KAAK,CAAC;IAiFlC,CAAC;IA7EC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8HAA8H;IACpH,eAAe,CAAC,KAAiD;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,gGAAgG;IACtF,MAAM,CAAC,YAAY,CAAC,OAAkC;QAI9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;yGAEqG;IAC3F,MAAM,CAAC,gBAAgB,CAAC,IAGjC;QACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAlFD,0CAkFC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":";;;AAAA,sDAAyD;AAEzD;;;;;GAKG;AACH,MAAsB,eAAgB,SAAQ,iBAAU;IAAxD;;QACY,kBAAa,GAAG,KAAK,CAAC;IAkFlC,CAAC;IA9EC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8HAA8H;IACpH,eAAe,CAAC,KAAiD;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,gGAAgG;IACtF,MAAM,CAAC,YAAY,CAAC,OAAkC;QAI9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;yGAEqG;IAC3F,MAAM,CAAC,gBAAgB,CAAC,IAGjC;QACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnFD,0CAmFC"}

package/dist/components/auth/models/entities/policy-definition.model.d.ts

@@ -1,4 +1,4 @@
-import type { TAuthorizationDecision } from '@venizia/ignis-kernel';
+import type { TAuthorizationDecision, TSubsetGrantMetadata } from '@venizia/ignis-kernel';
 import { integer, text } from 'drizzle-orm/pg-core';
 export type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {
     idType?: 'string' | 'number';
@@ -15,25 +15,46 @@ type TExtraPolicyVariantOf<Opts> = Opts extends {
     extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;
 } ? ExtraVariant : never;
 /** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
-declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never>() => {
+declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata>() => {
+    metadata: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">, Metadata>;
     variant: import("drizzle-orm").NotNull<import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"variant", [string, ...string[]]>, "join_domain" | "assign_role" | "grant" | "role_inherits" | "domain_inherits" | "resource_inherits" | "action_inherits" | ExtraVariant>>;
     subjectType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"subject_type", [string, ...string[]]>>;
     targetType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"target_type", [string, ...string[]]>>;
+    domainType: import("drizzle-orm/pg-core").PgTextBuilderInitial<"domain_type", [string, ...string[]]>;
     action: import("drizzle-orm/pg-core").PgTextBuilderInitial<"action", [string, ...string[]]>;
     effect: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"effect", [string, ...string[]]>, TAuthorizationDecision>;
-    domain: import("drizzle-orm/pg-core").PgTextBuilderInitial<"domain", [string, ...string[]]>;
-    metadata: import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">;
 };
-export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant>>;
-type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined> = Opts extends {
+export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;
+type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata> = Opts extends {
     idType: 'string';
-} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>> & {
+} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
     subjectId: ReturnType<typeof text>;
     targetId: ReturnType<typeof text>;
-} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>> & {
+    domainId: ReturnType<typeof text>;
+} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
     subjectId: ReturnType<typeof integer>;
     targetId: ReturnType<typeof integer>;
+    domainId: ReturnType<typeof integer>;
 };
-export declare const extraPolicyDefinitionColumns: <const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined>(opts?: Opts) => TPolicyDefinitionColumnDef<Opts>;
+/**
+ * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
+ * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
+ * `extraPolicyDefinitionColumns<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
+ * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
+ */
+export declare const extraPolicyDefinitionColumns: <const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata>(opts?: Opts) => TPolicyDefinitionColumnDef<Opts, Metadata>;
+/**
+ * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
+ * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
+ * table-level CHECK rejects.
+ *
+ * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
+ * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
+ * with no type passes.
+ */
+export declare const policyDefinitionDomainShapeCheck: (opts?: {
+    domainTypeColumn?: string;
+    domainIdColumn?: string;
+}) => string;
 export {};
 //# sourceMappingURL=policy-definition.model.d.ts.map

package/dist/components/auth/models/entities/policy-definition.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAA+B,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC;AAEF,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GAAI,YAAY,SAAS,MAAM,GAAG,KAAK;;;;;;;;CAkB7E,CAAC;AAEH,MAAM,MAAM,8BAA8B,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI,UAAU,CAC1F,OAAO,kCAAkC,CAAC,YAAY,CAAC,CACxD,CAAC;AAEF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,IACnE,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG;IAC5D,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG;IAC5D,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN,eAAO,MAAM,4BAA4B,GACvC,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAE3E,OAAO,IAAI,KACV,0BAA0B,CAAC,IAAI,CA0BjC,CAAC"}
+{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EAEtB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC;AAEF,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GACtC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB;;;;;;;;CAa9C,CAAC;AAEH,MAAM,MAAM,8BAA8B,CACxC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,UAAU,CAAC,OAAO,kCAAkC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACrE,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,MAAM,GAAG,oBAAoB,EAE9C,OAAO,IAAI,KACV,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CA4B3C,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAAI,OAAO;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,KAAG,MAaH,CAAC"}