@cqrs-ddd/pipeline-casl 0.5.0

package/dist/helpers/projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../../src/helpers/projection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAmBzD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAsIrC"}

package/dist/helpers/projection.js

@@ -0,0 +1,140 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+const OMIT = Symbol('unreadable-field');
+/** Defines an own data property, so a `__proto__` key stays a plain field. */
+function defineField(target, key, value) {
+    Object.defineProperty(target, key, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
+}
+/**
+ * Projects a snapshot to the fields `ability` permits for `action`. Conditions
+ * are evaluated against the full subject. A granted parent path authorizes its
+ * descendants unless a descendant is explicitly denied; this differs from
+ * `ability.can(action, subject, 'parent.child')`, which needs
+ * `parent.*`/`parent.**`. Denied array elements become `null`. Cyclic input
+ * and more than 1024 path aliases throw.
+ */
+export function projectPermittedFields(ability, action, typedSubject, record) {
+    const ancestors = new WeakSet();
+    // Evaluate full field paths using CASL. Conditions use the complete subject.
+    function ruleFor(paths, inherited) {
+        let rule = null;
+        for (const field of paths) {
+            if (!field)
+                continue;
+            const candidate = ability.relevantRuleFor(action, typedSubject, field);
+            if (candidate) {
+                if (candidate.inverted) {
+                    if (!rule?.inverted || candidate.priority < rule.priority) {
+                        rule = candidate;
+                    }
+                }
+                else if (!rule ||
+                    (!rule.inverted && candidate.priority < rule.priority)) {
+                    rule = candidate;
+                }
+            }
+        }
+        // A direct leaf denial always takes precedence over an inherited grant.
+        if (rule?.inverted) {
+            return rule;
+        }
+        // Parent denials can mask containers unless explicitly overridden.
+        if (inherited?.inverted && (!rule || inherited.priority < rule.priority)) {
+            return inherited;
+        }
+        if (rule) {
+            return rule;
+        }
+        // Inherit parent grant for descendants that are not explicitly denied.
+        if (inherited && !inherited.inverted) {
+            return inherited;
+        }
+        return null;
+    }
+    function project(value, paths, inherited) {
+        const rule = ruleFor(paths, inherited);
+        const allowed = !!rule && !rule.inverted;
+        if (value === null || typeof value !== 'object' || value instanceof Date) {
+            return allowed ? value : OMIT;
+        }
+        if (ancestors.has(value)) {
+            throw new TypeError('Cannot project a cyclic authorization snapshot.');
+        }
+        ancestors.add(value);
+        try {
+            const toJSON = value.toJSON;
+            if (typeof toJSON === 'function') {
+                return project(toJSON.call(value), paths, rule);
+            }
+            if (Array.isArray(value)) {
+                if (value.length === 0)
+                    return allowed ? [] : OMIT;
+                let visible = false;
+                const result = value.map((item, index) => {
+                    // Named paths apply to every element; indexed paths can additionally
+                    // restrict individual elements. Keep positions stable after masking.
+                    const elementPaths = [
+                        ...new Set([
+                            ...paths,
+                            ...paths.map((path) => path ? `${path}.${index}` : String(index)),
+                        ]),
+                    ];
+                    // Nested arrays have both named and indexed aliases. Bound their
+                    // combinations so pathological input fails closed instead of exploding.
+                    if (elementPaths.length > 1024) {
+                        throw new TypeError('Authorization snapshot has too many array path aliases.');
+                    }
+                    const projected = project(item, elementPaths, rule);
+                    if (projected !== OMIT)
+                        visible = true;
+                    return projected === OMIT ? null : projected;
+                });
+                return visible ? result : OMIT;
+            }
+            const entries = Object.entries(value);
+            if (entries.length === 0)
+                return allowed ? {} : OMIT;
+            const result = {};
+            for (const [key, child] of entries) {
+                const projected = project(child, paths.map((path) => (path ? `${path}.${key}` : key)), rule);
+                if (projected !== OMIT)
+                    defineField(result, key, projected);
+            }
+            return Object.keys(result).length > 0 ? result : OMIT;
+        }
+        finally {
+            ancestors.delete(value);
+        }
+    }
+    if (Array.isArray(record)) {
+        ancestors.add(record);
+        try {
+            return record.map((item, index) => {
+                // The empty path gives named fields the same meaning for every item.
+                const projected = project(item, ['', String(index)], null);
+                return projected === OMIT ? null : projected;
+            });
+        }
+        finally {
+            ancestors.delete(record);
+        }
+    }
+    const result = {};
+    ancestors.add(record);
+    try {
+        for (const [key, value] of Object.entries(record)) {
+            const projected = project(value, [key], null);
+            if (projected !== OMIT)
+                defineField(result, key, projected);
+        }
+        return result;
+    }
+    finally {
+        ancestors.delete(record);
+    }
+}
+//# sourceMappingURL=projection.js.map

package/dist/helpers/projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../src/helpers/projection.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAKtE,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAExC,8EAA8E;AAC9E,SAAS,WAAW,CAClB,MAA+B,EAC/B,GAAW,EACX,KAAc;IAEd,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QACjC,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,MAA2C;IAE3C,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;IAExC,6EAA6E;IAC7E,SAAS,OAAO,CAAC,KAAe,EAAE,SAAoB;QACpD,IAAI,IAAI,GAAc,IAAI,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACvE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;oBACvB,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC1D,IAAI,GAAG,SAAS,CAAC;oBACnB,CAAC;gBACH,CAAC;qBAAM,IACL,CAAC,IAAI;oBACL,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EACtD,CAAC;oBACD,IAAI,GAAG,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,IAAI,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uEAAuE;QACvE,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,OAAO,CACd,KAAc,EACd,KAAe,EACf,SAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;YACtD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBACvC,qEAAqE;oBACrE,qEAAqE;oBACrE,MAAM,YAAY,GAAG;wBACnB,GAAG,IAAI,GAAG,CAAC;4BACT,GAAG,KAAK;4BACR,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC1C;yBACF,CAAC;qBACH,CAAC;oBACF,iEAAiE;oBACjE,wEAAwE;oBACxE,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;wBAC/B,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;oBACJ,CAAC;oBACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,SAAS,KAAK,IAAI;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACvC,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/C,CAAC,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,OAAO,CACvB,KAAK,EACL,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACpD,IAAI,CACL,CAAC;gBACF,IAAI,SAAS,KAAK,IAAI;oBAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAChC,qEAAqE;gBACrE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC3D,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,SAAS,KAAK,IAAI;gBAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/helpers/requires.d.ts

@@ -0,0 +1,27 @@
+import type { PipelineBehaviorTuple } from '@cqrs-ddd/pipeline';
+import { CaslBehavior, type CaslBehaviorOptions } from '../casl.behavior.js';
+import type { AbilityRequirement } from '../types/casl.types.js';
+/**
+ * `[CaslBehavior, { rules }]` for `pipeline.wrap()`; every requirement must pass.
+ *
+ * @example
+ * ```ts
+ * class Users {
+ *   @pipeline.wrap({ kind: 'query' }, requires({ action: 'read', subject: 'User' }))
+ *   async find(query: GetUserQuery) {}
+ * }
+ *
+ * class Posts {
+ *   @pipeline.wrap(
+ *     { kind: 'command' },
+ *     requires(
+ *       { action: 'update', subject: 'Post', field: 'title' },
+ *       { action: 'update', subject: 'Post', field: 'body' },
+ *     ),
+ *   )
+ *   async edit(command: EditPostCommand) {}
+ * }
+ * ```
+ */
+export declare function requires(...rules: [AbilityRequirement, ...AbilityRequirement[]]): PipelineBehaviorTuple<CaslBehavior, CaslBehaviorOptions>;
+//# sourceMappingURL=requires.d.ts.map

package/dist/helpers/requires.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requires.d.ts","sourceRoot":"","sources":["../../src/helpers/requires.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,QAAQ,CACtB,GAAG,KAAK,EAAE,CAAC,kBAAkB,EAAE,GAAG,kBAAkB,EAAE,CAAC,GACtD,qBAAqB,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAE1D"}

package/dist/helpers/requires.js

@@ -0,0 +1,28 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { CaslBehavior } from '../casl.behavior.js';
+/**
+ * `[CaslBehavior, { rules }]` for `pipeline.wrap()`; every requirement must pass.
+ *
+ * @example
+ * ```ts
+ * class Users {
+ *   @pipeline.wrap({ kind: 'query' }, requires({ action: 'read', subject: 'User' }))
+ *   async find(query: GetUserQuery) {}
+ * }
+ *
+ * class Posts {
+ *   @pipeline.wrap(
+ *     { kind: 'command' },
+ *     requires(
+ *       { action: 'update', subject: 'Post', field: 'title' },
+ *       { action: 'update', subject: 'Post', field: 'body' },
+ *     ),
+ *   )
+ *   async edit(command: EditPostCommand) {}
+ * }
+ * ```
+ */
+export function requires(...rules) {
+    return [CaslBehavior, { rules }];
+}
+//# sourceMappingURL=requires.js.map

package/dist/helpers/requires.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requires.js","sourceRoot":"","sources":["../../src/helpers/requires.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAGtE,OAAO,EAAE,YAAY,EAA4B,MAAM,qBAAqB,CAAC;AAG7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,QAAQ,CACtB,GAAG,KAAoD;IAEvD,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,19 @@
+import type { UnauthorizedActionException } from './errors/unauthorized-action.exception.js';
+/** An HTTP answer for an error: status, JSON body and headers. */
+export interface HttpResponse {
+    status: number;
+    body: Record<string, unknown>;
+    headers: Record<string, string>;
+}
+/**
+ * The HTTP answer for an {@link UnauthorizedActionException}: `403 Forbidden`, naming the
+ * denied action and subject.
+ *
+ * @example
+ * ```ts
+ * const { status, body } = toHttpResponse(error);
+ * res.status(status).json(body);
+ * ```
+ */
+export declare function toHttpResponse(error: UnauthorizedActionException): HttpResponse;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAE7F,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,2BAA2B,GACjC,YAAY,CAYd"}

package/dist/http.js

@@ -0,0 +1,25 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+/**
+ * The HTTP answer for an {@link UnauthorizedActionException}: `403 Forbidden`, naming the
+ * denied action and subject.
+ *
+ * @example
+ * ```ts
+ * const { status, body } = toHttpResponse(error);
+ * res.status(status).json(body);
+ * ```
+ */
+export function toHttpResponse(error) {
+    return {
+        status: 403,
+        body: {
+            statusCode: 403,
+            error: 'Forbidden',
+            message: error.message,
+            action: error.action,
+            subject: error.subject,
+        },
+        headers: {},
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAWtE;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAkC;IAElC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB;QACD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CASL authorization for wrapped functions and methods: the behavior, its permission source contract and `requires()`. The HTTP mapping of its errors is the `@cqrs-ddd/pipeline-casl/http` entry point.
+ *
+ * @module main
+ */
+export { CASL_BEHAVIOR_ID, CaslBehavior, type CaslBehaviorOptions, } from './casl.behavior.js';
+export { CASL_ABILITY_KEY, CASL_ACTIONS, CASL_PRINCIPAL_KEY, CASL_SUBJECTS, type CaslAction, type CaslSubject, } from './constants/tokens.js';
+export { MissingAbilityError } from './errors/missing-ability.error.js';
+export { type UnauthorizedActionDetails, UnauthorizedActionException, } from './errors/unauthorized-action.exception.js';
+export { buildAbility, interpolateConditions } from './helpers/ability.js';
+export { abilityDigest, requireAbilityDigest, } from './helpers/ability-digest.js';
+export { CaslAuthorizer, getCaslAbility, getCaslPrincipal, hasEntityConditions, } from './helpers/authorizer.js';
+export { normalizeCapability, parseCapabilityString, serializeCapability, } from './helpers/capability.js';
+export { requires } from './helpers/requires.js';
+export type { CaslAuthorizationInput, CaslPrincipal, ICaslPermissionSource, } from './interfaces/permission-source.interface.js';
+export type { AbilityRequirement, AppAbility, AppRawRule, Capability, CapabilityString, Projected, } from './types/casl.types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,KAAK,yBAAyB,EAC9B,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,qBAAqB,GACtB,MAAM,6CAA6C,CAAC;AACrD,YAAY,EACV,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,SAAS,GACV,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+/**
+ * CASL authorization for wrapped functions and methods: the behavior, its permission source contract and `requires()`. The HTTP mapping of its errors is the `@cqrs-ddd/pipeline-casl/http` entry point.
+ *
+ * @module main
+ */
+export { CASL_BEHAVIOR_ID, CaslBehavior, } from './casl.behavior.js';
+export { CASL_ABILITY_KEY, CASL_ACTIONS, CASL_PRINCIPAL_KEY, CASL_SUBJECTS, } from './constants/tokens.js';
+export { MissingAbilityError } from './errors/missing-ability.error.js';
+export { UnauthorizedActionException, } from './errors/unauthorized-action.exception.js';
+export { buildAbility, interpolateConditions } from './helpers/ability.js';
+export { abilityDigest, requireAbilityDigest, } from './helpers/ability-digest.js';
+export { CaslAuthorizer, getCaslAbility, getCaslPrincipal, hasEntityConditions, } from './helpers/authorizer.js';
+export { normalizeCapability, parseCapabilityString, serializeCapability, } from './helpers/capability.js';
+export { requires } from './helpers/requires.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE;;;;GAIG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/interfaces/permission-source.interface.d.ts

@@ -0,0 +1,20 @@
+import type { IPipelineContext } from '@cqrs-ddd/pipeline';
+import type { Capability } from '../types/casl.types.js';
+/** The authenticated caller. Attributes are available to `${user.<path>}` placeholders. */
+export interface CaslPrincipal {
+    readonly id: string;
+    readonly [attribute: string]: unknown;
+}
+export interface CaslAuthorizationInput {
+    readonly principal: CaslPrincipal;
+    /** The caller's rules in any order; direct rules are applied before inverted ones. */
+    readonly rules: readonly Capability[];
+}
+/**
+ * Application port: resolves the caller and their rules for one pipeline
+ * execution. Return `null` when the caller is unauthenticated.
+ */
+export interface ICaslPermissionSource {
+    load(context: IPipelineContext): Promise<CaslAuthorizationInput | null>;
+}
+//# sourceMappingURL=permission-source.interface.d.ts.map

package/dist/interfaces/permission-source.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-source.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/permission-source.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;CACzE"}

package/dist/interfaces/permission-source.interface.js

@@ -0,0 +1,3 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+export {};
+//# sourceMappingURL=permission-source.interface.js.map

package/dist/interfaces/permission-source.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-source.interface.js","sourceRoot":"","sources":["../../src/interfaces/permission-source.interface.ts"],"names":[],"mappings":"AAAA,sEAAsE"}

package/dist/types/casl.types.d.ts

@@ -0,0 +1,25 @@
+import type { MongoAbility, RawRuleOf } from '@casl/ability';
+/** One permission rule. `conditions` may contain `${user.<path>}` placeholders. */
+export interface Capability {
+    subject: string;
+    action: string;
+    conditions?: Record<string, unknown>;
+    fields?: string[];
+    inverted?: boolean;
+    reason?: string;
+}
+/** Compact form: `[!]subject|action[|conditions[|fields[|reason]]]`. */
+export type CapabilityString = string;
+/** A type-level permission requirement checked by `CaslBehavior`. */
+export interface AbilityRequirement {
+    action: string;
+    subject: string;
+    field?: string;
+}
+export type AppAbility = MongoAbility<[string, string]>;
+export type AppRawRule = RawRuleOf<AppAbility>;
+/** A candidate after field projection: every property may be absent; denied array items become null. */
+export type Projected<T> = T extends Date ? T : T extends readonly (infer U)[] ? (Projected<U> | null)[] : T extends object ? {
+    [K in keyof T]?: Projected<T[K]>;
+} : T;
+//# sourceMappingURL=casl.types.d.ts.map

package/dist/types/casl.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"casl.types.d.ts","sourceRoot":"","sources":["../../src/types/casl.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE7D,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEtC,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAE/C,wGAAwG;AACxG,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,GACrC,CAAC,GACD,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5B,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,GACvB,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACpC,CAAC,CAAC"}

package/dist/types/casl.types.js

@@ -0,0 +1,3 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+export {};
+//# sourceMappingURL=casl.types.js.map

package/dist/types/casl.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"casl.types.js","sourceRoot":"","sources":["../../src/types/casl.types.ts"],"names":[],"mappings":"AAAA,sEAAsE"}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@cqrs-ddd/pipeline-casl",
+  "version": "0.5.0",
+  "description": "CASL authorization for @cqrs-ddd/pipeline: type-level checks before the handler, entity and field checks after it",
+  "author": "Aristotelis",
+  "license": "SEE LICENSE IN LICENSE",
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aristoteliss/ddd-cqrs.git",
+    "directory": "packages/pipeline-casl"
+  },
+  "homepage": "https://aristoteliss.github.io/ddd-cqrs/packages/pipeline-casl/",
+  "bugs": {
+    "url": "https://github.com/aristoteliss/ddd-cqrs/issues"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "default": "./dist/http.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "LICENSE",
+    "COMMERCIAL_LICENSE.txt"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@cqrs-ddd/safe-stringify": "^0.5.0"
+  },
+  "peerDependencies": {
+    "@casl/ability": "^7.0.0",
+    "@cqrs-ddd/pipeline": "^0.5.0"
+  },
+  "devDependencies": {
+    "@casl/ability": "^7.0.1",
+    "@vitest/coverage-v8": "^5.0.3",
+    "vitest": "^5.0.3",
+    "@cqrs-ddd/pipeline": "0.5.0"
+  },
+  "keywords": [],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "build:watch": "tsc -p tsconfig.build.json --watch",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "rebuild": "pnpm run clean && pnpm run build",
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}