@cullet/erp-core 1.2.0 → 1.4.0

package/dist/validation-error.d.ts

@@ -13,6 +13,7 @@ declare const ErrorCodes: {
   readonly authorization: {
     readonly forbidden: "sec.authz.forbidden";
     readonly policyDenied: "sec.authz.policy_denied";
+    readonly missingRole: "sec.authz.missing_role";
     readonly missingCapability: "sec.authz.missing_capability";
     readonly outOfScope: "sec.authz.out_of_scope";
   };
@@ -88,103 +89,6 @@ declare class AuthenticationError extends AppError {
   static invalidCredentials(options?: Pick<AuthenticationErrorFactoryOptions, "correlationId" | "requestId" | "type" | "severity" | "createdAtIso" | "publicMessage">): AuthenticationError;
 }
 //#endregion
-//#region src/core/errors/authorization-error.d.ts
-type AuthorizationErrorReason = "forbidden" | "missing_role" | "missing_capability" | "out_of_scope" | "outside_time_window" | "policy_denied" | "unknown";
-type AuthorizationRequirement = {
-  role?: string;
-  capability?: string;
-  scope?: string;
-};
-type AuthorizationErrorMetadata = {
-  reason: AuthorizationErrorReason;
-  /** Stable action you evaluated (not an HTTP route — a "business action") */
-  action: string;
-  /** Resource identification (without leaking the full payload) */
-  resource?: {
-    type: string;
-    id?: string;
-  };
-  /** Optional: actor (do not include sensitive data) */
-  actor?: {
-    userId: string;
-    role?: string;
-  };
-  /** Optional: expected requirement */
-  required?: AuthorizationRequirement;
-  /** Optional: policy (when you already have PolicyEvaluation or similar) */
-  policyId?: string;
-  policyVersion?: number;
-  evaluatedAtIso?: string;
-  decision?: "allow" | "deny";
-  reasonCode?: string;
-  /** Optional: additional non-sensitive info */
-  details?: string;
-};
-/**
- * Options for AuthorizationError factory methods.
- * Combines metadata fields (except 'reason') with common AppError options.
- */
-type AuthorizationErrorFactoryOptions = Omit<AuthorizationErrorMetadata, "reason"> & Omit<AppErrorOptions, "metadata">;
-/**
- * Raised when an authenticated actor is not allowed to perform a business
- * action — the "you may not" error, distinct from authentication ("who are
- * you"). Maps to an HTTP 403 at the edge.
- *
- * The discriminating {@link reason} records *why* access was denied (a flat
- * forbid, a missing role/capability, an out-of-scope target, or a policy
- * decision) so the boundary can shape the response without re-deriving it. The
- * metadata is deliberately built around a stable business `action` and a
- * type/id resource reference rather than an HTTP route or full payload, keeping
- * sensitive data out of logs. Instances are frozen. Construct through the
- * static factories, never directly.
- */
-declare class AuthorizationError extends AppError {
-  readonly reason: AuthorizationErrorReason;
-  private constructor();
-  /**
-   * A flat denial with no more specific reason — the actor simply may not
-   * perform this action. Reach for a more precise factory
-   * ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},
-   * {@link AuthorizationError.policyDenied}) when the cause is known.
-   */
-  static forbidden(input: AuthorizationErrorFactoryOptions): AuthorizationError;
-  /**
-   * The action was denied by an evaluated policy. Captures the deciding
-   * policy's id, version, and evaluation instant into the metadata (with
-   * `decision: "deny"`) so the denial is auditable back to the exact policy
-   * that produced it.
-   *
-   * @param input - Factory options plus the required `policyId`,
-   *   `policyVersion`, and `evaluatedAtIso` of the deciding policy.
-   */
-  static policyDenied(input: AuthorizationErrorFactoryOptions & {
-    policyId: string;
-    policyVersion: number;
-    evaluatedAtIso: string;
-  }): AuthorizationError;
-  /**
-   * The actor lacks a required role or capability. The expected
-   * {@link AuthorizationRequirement} is recorded so the boundary can tell the
-   * caller precisely what grant is missing.
-   *
-   * @param input - Factory options plus the `required` role/capability/scope.
-   */
-  static missingCapability(input: AuthorizationErrorFactoryOptions & {
-    required: AuthorizationRequirement;
-  }): AuthorizationError;
-  /**
-   * The actor may perform the action in general, but not on *this* target —
-   * the resource falls outside the actor's permitted scope (e.g. a different
-   * school or tenant than the one they are bound to).
-   *
-   * @param input - Factory options plus the optional `required` scope that the
-   *   target failed to satisfy.
-   */
-  static outOfScope(input: AuthorizationErrorFactoryOptions & {
-    required?: AuthorizationRequirement;
-  }): AuthorizationError;
-}
-//#endregion
 //#region src/core/errors/business-rule-violation-error.d.ts
 declare class BusinessRuleViolationError extends AppError {
   constructor(rule: string, message: string, detail?: Record<string, unknown>, options?: AppErrorOptions);
@@ -773,5 +677,5 @@ declare class ValidationError extends AppError {
   constructor(field: ValidationField, code: ValidationCode, message: string, options?: AppErrorOptions);
 }
 //#endregion
-export { serializationErrorCode as $, IdempotencyPayloadMismatchError as A, UniqueConstraintViolation as B, IntegrationErrorMetadata as C, IdempotencyFailureKind as D, IdempotencyErrorMetadata as E, AlreadyExistsError as F, AuthorizationErrorMetadata as G, translateUniqueViolationToDuplicate as H, ConflictError as I, AuthenticationError as J, AuthorizationErrorReason as K, ConflictErrorMetadata as L, payloadHash as M, sha256Hex as N, IdempotencyInProgressError as O, stableStringify as P, ErrorCodes as Q, ConflictKind as R, IntegrationError as S, IdempotencyError as T, BusinessRuleViolationError as U, UniqueConstraintViolationError as V, AuthorizationError as W, AuthenticationErrorReason as X, AuthenticationErrorMetadata as Y, assertJsonSafeMetadata as Z, SerializationMessages as _, TemporalError as a, NotFoundError as b, TemporalPrecision as c, SerializationCodes as d, SerializationDirection as f, SerializationInError as g, SerializationFailureCategory as h, NotYetValidError as i, IdempotencyReplayNotSupportedError as j, IdempotencyKeyMissingError as k, evaluateTemporalWindow as l, SerializationErrorMetadata as m, UnexpectedError as n, TemporalErrorMetadata as o, SerializationError as p, AuthorizationRequirement as q, ExpiredError as r, TemporalKind as s, ValidationError as t, SerializationBoundary as u, SerializationOutError as v, IntegrationErrorReason as w, LegacyIncompatibleError as x, safePreview as y, DuplicateError as z };
+export { IdempotencyPayloadMismatchError as A, UniqueConstraintViolation as B, IntegrationErrorMetadata as C, IdempotencyFailureKind as D, IdempotencyErrorMetadata as E, AlreadyExistsError as F, AuthenticationErrorMetadata as G, translateUniqueViolationToDuplicate as H, ConflictError as I, ErrorCodes as J, AuthenticationErrorReason as K, ConflictErrorMetadata as L, payloadHash as M, sha256Hex as N, IdempotencyInProgressError as O, stableStringify as P, ConflictKind as R, IntegrationError as S, IdempotencyError as T, BusinessRuleViolationError as U, UniqueConstraintViolationError as V, AuthenticationError as W, serializationErrorCode as Y, SerializationMessages as _, TemporalError as a, NotFoundError as b, TemporalPrecision as c, SerializationCodes as d, SerializationDirection as f, SerializationInError as g, SerializationFailureCategory as h, NotYetValidError as i, IdempotencyReplayNotSupportedError as j, IdempotencyKeyMissingError as k, evaluateTemporalWindow as l, SerializationErrorMetadata as m, UnexpectedError as n, TemporalErrorMetadata as o, SerializationError as p, assertJsonSafeMetadata as q, ExpiredError as r, TemporalKind as s, ValidationError as t, SerializationBoundary as u, SerializationOutError as v, IntegrationErrorReason as w, LegacyIncompatibleError as x, safePreview as y, DuplicateError as z };
 //# sourceMappingURL=validation-error.d.ts.map

package/dist/validation-error.js

@@ -1,4 +1,4 @@
-import { a as serializationErrorCode, i as ErrorCodes, n as AppError } from "./unexpected-error.js";
+import { i as serializationErrorCode, r as ErrorCodes, t as AppError } from "./app-error.js";
 //#region src/core/errors/authentication-error.ts
 var AuthenticationError = class AuthenticationError extends AppError {
 	constructor(params) {
@@ -25,7 +25,7 @@ var AuthenticationError = class AuthenticationError extends AppError {
 			code: ErrorCodes.authentication.missingToken,
 			reason: "missing_token",
 			metadata: compactMetadata$1(options),
-			...extractAppErrorOptions$1(options)
+			...extractAppErrorOptions(options)
 		});
 	}
 	static invalidToken(options) {
@@ -40,7 +40,7 @@ var AuthenticationError = class AuthenticationError extends AppError {
 				correlationId: options?.correlationId,
 				requestId: options?.requestId
 			}),
-			...extractAppErrorOptions$1(options)
+			...extractAppErrorOptions(options)
 		});
 	}
 	static expiredToken(options) {
@@ -49,7 +49,7 @@ var AuthenticationError = class AuthenticationError extends AppError {
 			code: ErrorCodes.authentication.expiredToken,
 			reason: "expired_token",
 			metadata: compactMetadata$1(options),
-			...extractAppErrorOptions$1(options)
+			...extractAppErrorOptions(options)
 		});
 	}
 	static invalidCredentials(options) {
@@ -58,11 +58,11 @@ var AuthenticationError = class AuthenticationError extends AppError {
 			code: ErrorCodes.authentication.invalidCredentials,
 			reason: "invalid_credentials",
 			metadata: compactMetadata$1(options),
-			...extractAppErrorOptions$1(options)
+			...extractAppErrorOptions(options)
 		});
 	}
 };
-function extractAppErrorOptions$1(options) {
+function extractAppErrorOptions(options) {
 	return {
 		cause: options?.cause,
 		type: options?.type,
@@ -79,133 +79,6 @@ function compactMetadata$1(input) {
 	return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== void 0));
 }
 //#endregion
-//#region src/core/errors/authorization-error.ts
-/**
-* Raised when an authenticated actor is not allowed to perform a business
-* action — the "you may not" error, distinct from authentication ("who are
-* you"). Maps to an HTTP 403 at the edge.
-*
-* The discriminating {@link reason} records *why* access was denied (a flat
-* forbid, a missing role/capability, an out-of-scope target, or a policy
-* decision) so the boundary can shape the response without re-deriving it. The
-* metadata is deliberately built around a stable business `action` and a
-* type/id resource reference rather than an HTTP route or full payload, keeping
-* sensitive data out of logs. Instances are frozen. Construct through the
-* static factories, never directly.
-*/
-var AuthorizationError = class AuthorizationError extends AppError {
-	constructor(params) {
-		super(params.message, params.code, {
-			cause: params.cause,
-			metadata: params.metadata,
-			type: params.type,
-			severity: params.severity,
-			correlationId: params.correlationId,
-			requestId: params.requestId,
-			commandId: params.commandId,
-			createdAtIso: params.createdAtIso,
-			publicMessage: params.publicMessage
-		});
-		this.reason = params.reason;
-		Object.freeze(this);
-	}
-	/**
-	* A flat denial with no more specific reason — the actor simply may not
-	* perform this action. Reach for a more precise factory
-	* ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},
-	* {@link AuthorizationError.policyDenied}) when the cause is known.
-	*/
-	static forbidden(input) {
-		return new AuthorizationError({
-			message: "Action not allowed",
-			code: ErrorCodes.authorization.forbidden,
-			reason: "forbidden",
-			metadata: {
-				reason: "forbidden",
-				...extractMetadataOnly(input)
-			},
-			...extractAppErrorOptions(input)
-		});
-	}
-	/**
-	* The action was denied by an evaluated policy. Captures the deciding
-	* policy's id, version, and evaluation instant into the metadata (with
-	* `decision: "deny"`) so the denial is auditable back to the exact policy
-	* that produced it.
-	*
-	* @param input - Factory options plus the required `policyId`,
-	*   `policyVersion`, and `evaluatedAtIso` of the deciding policy.
-	*/
-	static policyDenied(input) {
-		return new AuthorizationError({
-			message: "Action denied by policy",
-			code: ErrorCodes.authorization.policyDenied,
-			reason: "policy_denied",
-			metadata: {
-				reason: "policy_denied",
-				...extractMetadataOnly(input),
-				decision: "deny"
-			},
-			...extractAppErrorOptions(input)
-		});
-	}
-	/**
-	* The actor lacks a required role or capability. The expected
-	* {@link AuthorizationRequirement} is recorded so the boundary can tell the
-	* caller precisely what grant is missing.
-	*
-	* @param input - Factory options plus the `required` role/capability/scope.
-	*/
-	static missingCapability(input) {
-		return new AuthorizationError({
-			message: "Insufficient capability to perform the action",
-			code: ErrorCodes.authorization.missingCapability,
-			reason: "missing_capability",
-			metadata: {
-				reason: "missing_capability",
-				...extractMetadataOnly(input)
-			},
-			...extractAppErrorOptions(input)
-		});
-	}
-	/**
-	* The actor may perform the action in general, but not on *this* target —
-	* the resource falls outside the actor's permitted scope (e.g. a different
-	* school or tenant than the one they are bound to).
-	*
-	* @param input - Factory options plus the optional `required` scope that the
-	*   target failed to satisfy.
-	*/
-	static outOfScope(input) {
-		return new AuthorizationError({
-			message: "Action outside the allowed scope",
-			code: ErrorCodes.authorization.outOfScope,
-			reason: "out_of_scope",
-			metadata: {
-				reason: "out_of_scope",
-				...extractMetadataOnly(input)
-			},
-			...extractAppErrorOptions(input)
-		});
-	}
-};
-function extractAppErrorOptions(options) {
-	return {
-		cause: options?.cause,
-		type: options?.type,
-		severity: options?.severity,
-		correlationId: options?.correlationId,
-		requestId: options?.requestId,
-		commandId: options?.commandId,
-		createdAtIso: options?.createdAtIso,
-		publicMessage: options?.publicMessage
-	};
-}
-function extractMetadataOnly(input) {
-	const { cause, type, severity, correlationId, requestId, commandId, createdAtIso, publicMessage, ...metadata } = input;
-	return metadata;
-}
-//#endregion
 //#region src/core/errors/conflict-error.ts
 /**
 * Base for errors that signal a state conflict — the request collides with data
@@ -866,6 +739,6 @@ var ValidationError = class extends AppError {
 	}
 };
 //#endregion
-export { translateUniqueViolationToDuplicate as C, UniqueConstraintViolationError as S, AuthenticationError as T, IdempotencyPayloadMismatchError as _, evaluateTemporalWindow as a, ConflictError as b, SerializationInError as c, safePreview as d, LegacyIncompatibleError as f, IdempotencyKeyMissingError as g, IdempotencyInProgressError as h, TemporalError as i, SerializationMessages as l, IdempotencyError as m, ExpiredError as n, SerializationCodes as o, IntegrationError as p, NotYetValidError as r, SerializationError as s, ValidationError as t, SerializationOutError as u, IdempotencyReplayNotSupportedError as v, AuthorizationError as w, DuplicateError as x, AlreadyExistsError as y };
+export { translateUniqueViolationToDuplicate as C, UniqueConstraintViolationError as S, IdempotencyPayloadMismatchError as _, evaluateTemporalWindow as a, ConflictError as b, SerializationInError as c, safePreview as d, LegacyIncompatibleError as f, IdempotencyKeyMissingError as g, IdempotencyInProgressError as h, TemporalError as i, SerializationMessages as l, IdempotencyError as m, ExpiredError as n, SerializationCodes as o, IntegrationError as p, NotYetValidError as r, SerializationError as s, ValidationError as t, SerializationOutError as u, IdempotencyReplayNotSupportedError as v, AuthenticationError as w, DuplicateError as x, AlreadyExistsError as y };
 
 //# sourceMappingURL=validation-error.js.map