@ddd-ts-kit/auth 0.0.0-stage → 0.1.1

package/dist/authorization/authorization-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorization-context.js.map

package/dist/authorization/authorization-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-context.js","sourceRoot":"","sources":["../../src/authorization/authorization-context.ts"],"names":[],"mappings":""}

package/dist/authorization/authorizer.d.ts

@@ -0,0 +1,15 @@
+import type { AccessScope } from './access-scope.js';
+import type { CheckRequest } from './check-request.js';
+import type { Decision } from './decision.js';
+import type { ListRequest } from './list-request.js';
+/**
+ * The one port every authorization model implements: roles, attribute policies, relationships,
+ * in process or delegated to a dedicated service. Handlers and middleware know nothing else.
+ */
+export declare abstract class Authorizer {
+    static readonly tokenKey = "auth.Authorizer";
+    abstract check(request: CheckRequest): Promise<Decision>;
+    /** Absent when the model cannot enumerate: asking for a scope then fails loudly. */
+    abstract listAccessible?(request: ListRequest): Promise<AccessScope>;
+}
+//# sourceMappingURL=authorizer.d.ts.map

package/dist/authorization/authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,8BAAsB,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,QAAQ,qBAAqB;IAE7C,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzD,oFAAoF;IACpF,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtE"}

package/dist/authorization/authorizer.js

@@ -0,0 +1,8 @@
+/**
+ * The one port every authorization model implements: roles, attribute policies, relationships,
+ * in process or delegated to a dedicated service. Handlers and middleware know nothing else.
+ */
+export class Authorizer {
+    static tokenKey = 'auth.Authorizer';
+}
+//# sourceMappingURL=authorizer.js.map

package/dist/authorization/authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,MAAM,OAAgB,UAAU;IAC9B,MAAM,CAAU,QAAQ,GAAG,iBAAiB,CAAC;CAM9C"}

package/dist/authorization/check-request.d.ts

@@ -0,0 +1,11 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { Permission } from '../permissions/permission.js';
+import type { AuthorizationContext } from './authorization-context.js';
+import type { ResourceRef } from './resource-ref.js';
+export interface CheckRequest {
+    readonly actor: Actor;
+    readonly permission: Permission;
+    readonly resource?: ResourceRef;
+    readonly context?: AuthorizationContext;
+}
+//# sourceMappingURL=check-request.d.ts.map

package/dist/authorization/check-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-request.d.ts","sourceRoot":"","sources":["../../src/authorization/check-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC"}

package/dist/authorization/check-request.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-request.js.map

package/dist/authorization/check-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-request.js","sourceRoot":"","sources":["../../src/authorization/check-request.ts"],"names":[],"mappings":""}

package/dist/authorization/decision-record-of.d.ts

@@ -0,0 +1,7 @@
+import type { MessageInfo } from '@ddd-ts-kit/kernel';
+import type { CheckRequest } from './check-request.js';
+import type { Decision } from './decision.js';
+import type { DecisionRecord } from './decision-record.js';
+/** `info` is the message the bus is handling, for a decision taken by the bus middleware. */
+export declare function decisionRecordOf(request: CheckRequest, decision: Decision, info?: MessageInfo): DecisionRecord;
+//# sourceMappingURL=decision-record-of.d.ts.map

package/dist/authorization/decision-record-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-record-of.d.ts","sourceRoot":"","sources":["../../src/authorization/decision-record-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAQ9G"}

package/dist/authorization/decision-record-of.js

@@ -0,0 +1,11 @@
+/** `info` is the message the bus is handling, for a decision taken by the bus middleware. */
+export function decisionRecordOf(request, decision, info) {
+    return {
+        actorId: request.actor.id,
+        permissionId: request.permission.id,
+        ...(request.resource === undefined ? {} : { resource: request.resource }),
+        decision,
+        ...(info === undefined ? {} : { useCase: info.name, kind: info.kind }),
+    };
+}
+//# sourceMappingURL=decision-record-of.js.map

package/dist/authorization/decision-record-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-record-of.js","sourceRoot":"","sources":["../../src/authorization/decision-record-of.ts"],"names":[],"mappings":"AAKA,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,OAAqB,EAAE,QAAkB,EAAE,IAAkB;IAC5F,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,QAAQ;QACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC"}

package/dist/authorization/decision-record.d.ts

@@ -0,0 +1,15 @@
+import type { MessageInfo } from '@ddd-ts-kit/kernel';
+import type { Decision } from './decision.js';
+import type { ResourceRef } from './resource-ref.js';
+/** What the audit hook receives, for an allowed decision as for a refused one. */
+export interface DecisionRecord {
+    readonly actorId: string;
+    readonly permissionId: string;
+    readonly resource?: ResourceRef;
+    readonly decision: Decision;
+    /** The command or query, when the decision was taken by the bus middleware. */
+    readonly useCase?: string;
+    /** Whether that use case changes state or answers; absent with `useCase`, for a decision taken outside a bus. */
+    readonly kind?: MessageInfo['kind'];
+}
+//# sourceMappingURL=decision-record.d.ts.map

package/dist/authorization/decision-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-record.d.ts","sourceRoot":"","sources":["../../src/authorization/decision-record.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iHAAiH;IACjH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACrC"}

package/dist/authorization/decision-record.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=decision-record.js.map

package/dist/authorization/decision-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-record.js","sourceRoot":"","sources":["../../src/authorization/decision-record.ts"],"names":[],"mappings":""}

package/dist/authorization/decision.d.ts

@@ -0,0 +1,10 @@
+/** `reason` is a stable machine code (`NO_MATCHING_ROLE`), never a sentence and never data. */
+export type Decision = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly reason: string;
+};
+export declare const ALLOWED: Decision;
+export declare function deny(reason: string): Decision;
+//# sourceMappingURL=decision.d.ts.map

package/dist/authorization/decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,eAAO,MAAM,OAAO,EAAE,QAA2C,CAAC;AAElE,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAE7C"}

package/dist/authorization/decision.js

@@ -0,0 +1,5 @@
+export const ALLOWED = Object.freeze({ allowed: true });
+export function deny(reason) {
+    return { allowed: false, reason };
+}
+//# sourceMappingURL=decision.js.map

package/dist/authorization/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,OAAO,GAAa,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAElE,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/authorization/denial-reason.d.ts

@@ -0,0 +1,14 @@
+/** The reasons the authorizers of this package give. An adapter may add its own. */
+export declare const DenialReason: {
+    readonly anonymous: 'ANONYMOUS';
+    readonly noMatchingRole: 'NO_MATCHING_ROLE';
+    readonly tenantMismatch: 'TENANT_MISMATCH';
+    readonly explicitDeny: 'EXPLICIT_DENY';
+    readonly noMatchingPolicy: 'NO_MATCHING_POLICY';
+    readonly subjectMismatch: 'SUBJECT_MISMATCH';
+    readonly resourceRequired: 'RESOURCE_REQUIRED';
+    readonly unmappedPermission: 'UNMAPPED_PERMISSION';
+    readonly noRelation: 'NO_RELATION';
+    readonly depthExceeded: 'DEPTH_EXCEEDED';
+};
+//# sourceMappingURL=denial-reason.d.ts.map

package/dist/authorization/denial-reason.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denial-reason.d.ts","sourceRoot":"","sources":["../../src/authorization/denial-reason.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,eAAO,MAAM,YAAY;aACvB,SAAS,EAAE,WAAW;aACtB,cAAc,EAAE,kBAAkB;aAClC,cAAc,EAAE,iBAAiB;aACjC,YAAY,EAAE,eAAe;aAC7B,gBAAgB,EAAE,oBAAoB;aACtC,eAAe,EAAE,kBAAkB;aACnC,gBAAgB,EAAE,mBAAmB;aACrC,kBAAkB,EAAE,qBAAqB;aACzC,UAAU,EAAE,aAAa;aACzB,aAAa,EAAE,gBAAgB;CACvB,CAAC"}

package/dist/authorization/denial-reason.js

@@ -0,0 +1,14 @@
+/** The reasons the authorizers of this package give. An adapter may add its own. */
+export const DenialReason = {
+    anonymous: 'ANONYMOUS',
+    noMatchingRole: 'NO_MATCHING_ROLE',
+    tenantMismatch: 'TENANT_MISMATCH',
+    explicitDeny: 'EXPLICIT_DENY',
+    noMatchingPolicy: 'NO_MATCHING_POLICY',
+    subjectMismatch: 'SUBJECT_MISMATCH',
+    resourceRequired: 'RESOURCE_REQUIRED',
+    unmappedPermission: 'UNMAPPED_PERMISSION',
+    noRelation: 'NO_RELATION',
+    depthExceeded: 'DEPTH_EXCEEDED',
+};
+//# sourceMappingURL=denial-reason.js.map

package/dist/authorization/denial-reason.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denial-reason.js","sourceRoot":"","sources":["../../src/authorization/denial-reason.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,kBAAkB;IAClC,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,eAAe;IAC7B,gBAAgB,EAAE,oBAAoB;IACtC,eAAe,EAAE,kBAAkB;IACnC,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,qBAAqB;IACzC,UAAU,EAAE,aAAa;IACzB,aAAa,EAAE,gBAAgB;CACvB,CAAC"}

package/dist/authorization/is-resource-ref.d.ts

@@ -0,0 +1,4 @@
+import type { ResourceRef } from './resource-ref.js';
+/** Strict on purpose: an aggregate that happens to have a `type` and an `id` is not a reference. */
+export declare function isResourceRef(value: unknown): value is ResourceRef;
+//# sourceMappingURL=is-resource-ref.d.ts.map

package/dist/authorization/is-resource-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-resource-ref.d.ts","sourceRoot":"","sources":["../../src/authorization/is-resource-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAUlE"}

package/dist/authorization/is-resource-ref.js

@@ -0,0 +1,11 @@
+/** Strict on purpose: an aggregate that happens to have a `type` and an `id` is not a reference. */
+export function isResourceRef(value) {
+    if (typeof value !== 'object' || value === null || Object.keys(value).length !== 2) {
+        return false;
+    }
+    if (!('type' in value) || !('id' in value)) {
+        return false;
+    }
+    return typeof value.type === 'string' && typeof value.id === 'string';
+}
+//# sourceMappingURL=is-resource-ref.js.map

package/dist/authorization/is-resource-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-resource-ref.js","sourceRoot":"","sources":["../../src/authorization/is-resource-ref.ts"],"names":[],"mappings":"AAEA,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC;AACxE,CAAC"}

package/dist/authorization/list-request.d.ts

@@ -0,0 +1,8 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { Permission } from '../permissions/permission.js';
+export interface ListRequest {
+    readonly actor: Actor;
+    readonly permission: Permission;
+    readonly resourceType: string;
+}
+//# sourceMappingURL=list-request.d.ts.map

package/dist/authorization/list-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-request.d.ts","sourceRoot":"","sources":["../../src/authorization/list-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/authorization/list-request.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=list-request.js.map

package/dist/authorization/list-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-request.js","sourceRoot":"","sources":["../../src/authorization/list-request.ts"],"names":[],"mappings":""}

package/dist/authorization/on-decision.d.ts

@@ -0,0 +1,3 @@
+import type { DecisionRecord } from './decision-record.js';
+export type OnDecision = (record: DecisionRecord) => void | Promise<void>;
+//# sourceMappingURL=on-decision.d.ts.map

package/dist/authorization/on-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-decision.d.ts","sourceRoot":"","sources":["../../src/authorization/on-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/authorization/on-decision.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=on-decision.js.map

package/dist/authorization/on-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-decision.js","sourceRoot":"","sources":["../../src/authorization/on-decision.ts"],"names":[],"mappings":""}

package/dist/authorization/resource-ref.d.ts

@@ -0,0 +1,6 @@
+/** One element a right may bear on: `{ type: 'invoice', id: 'inv-1' }`. */
+export interface ResourceRef {
+    readonly type: string;
+    readonly id: string;
+}
+//# sourceMappingURL=resource-ref.d.ts.map

package/dist/authorization/resource-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ref.d.ts","sourceRoot":"","sources":["../../src/authorization/resource-ref.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB"}

package/dist/authorization/resource-ref.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resource-ref.js.map

package/dist/authorization/resource-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ref.js","sourceRoot":"","sources":["../../src/authorization/resource-ref.ts"],"names":[],"mappings":""}

package/dist/di/authorization-map-of.d.ts

@@ -0,0 +1,5 @@
+import type { UseCaseDeclaration as DeclaredUseCase } from '@ddd-ts-kit/di';
+import { AuthorizationMap } from '../use-cases/authorization-map.js';
+/** A use case that declared nothing is left out, hence refused when it is sent. */
+export declare function authorizationMapOf(declared: readonly DeclaredUseCase[]): AuthorizationMap;
+//# sourceMappingURL=authorization-map-of.d.ts.map

package/dist/di/authorization-map-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map-of.d.ts","sourceRoot":"","sources":["../../src/di/authorization-map-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,IAAI,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAG5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAIrE,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAAG,gBAAgB,CAEzF"}

package/dist/di/authorization-map-of.js

@@ -0,0 +1,30 @@
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+import { isPermission } from '../permissions/is-permission.js';
+import { AuthorizationMap } from '../use-cases/authorization-map.js';
+import { publicUseCase } from '../use-cases/public-use-case.js';
+/** A use case that declared nothing is left out, hence refused when it is sent. */
+export function authorizationMapOf(declared) {
+    return new AuthorizationMap(declared.flatMap(declarationOf));
+}
+function declarationOf(declared) {
+    if (declared.access === undefined) {
+        return [];
+    }
+    if (declared.access === 'public') {
+        return [publicUseCase(declared.message)];
+    }
+    const { permission } = declared;
+    if (!isPermission(permission)) {
+        throw new AuthorizationSetupError(`Module "${declared.module}" protects ${declared.message.name} with something that is not a permission made by definePermissions.`);
+    }
+    return [
+        {
+            access: 'protected',
+            type: declared.message,
+            permission,
+            resourceOf: (message) => declared.resourceOf?.(message),
+            contextOf: (message) => declared.contextOf?.(message),
+        },
+    ];
+}
+//# sourceMappingURL=authorization-map-of.js.map

package/dist/di/authorization-map-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map-of.js","sourceRoot":"","sources":["../../src/di/authorization-map-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,QAAoC;IACrE,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;IAEhC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,WAAW,QAAQ,CAAC,MAAM,cAAc,QAAQ,CAAC,OAAO,CAAC,IAAI,qEAAqE,CACnI,CAAC;IACJ,CAAC;IAED,OAAO;QACL;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,QAAQ,CAAC,OAAO;YACtB,UAAU;YACV,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC;YACvD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;AACJ,CAAC"}

package/dist/di/authorization-module.d.ts

@@ -0,0 +1,24 @@
+import { type ContextModule, type Provided } from '@ddd-ts-kit/di';
+import { Authenticator } from '../authentication/authenticator.js';
+import { Authorizer } from '../authorization/authorizer.js';
+import type { OnDecision } from '../authorization/on-decision.js';
+import type { Policy } from '../policies/policy.js';
+import { type PolicyAccessOptions } from '../policies/policy-access.js';
+export interface AuthorizationModuleOptions {
+    /** The model: role based, policy based, relation based, or an adapter of a dedicated service. */
+    readonly authorizer: Provided<Authorizer>;
+    readonly authenticator?: Provided<Authenticator>;
+    /** The instance-level policies of every context, evaluated by `Access` next to the classes declared with `@Policy`. */
+    readonly policies?: readonly Policy<unknown>[];
+    readonly resourceOf?: PolicyAccessOptions['resourceOf'];
+    /** The audit hook, called for every decision of the buses and of `Access`. */
+    readonly onDecision?: OnDecision;
+}
+/**
+ * Turns the declarations of the modules into enforcement: binds the use case guard the kernel
+ * buses run first, so a command or query that declared no access is refused, and a protected
+ * one reaches its handler only when the authorizer allows the actor it carries. Starting the
+ * application builds the guard, so a declaration that is not a permission fails the start.
+ */
+export declare function authorizationModule(options: AuthorizationModuleOptions): ContextModule;
+//# sourceMappingURL=authorization-module.d.ts.map

package/dist/di/authorization-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-module.d.ts","sourceRoot":"","sources":["../../src/di/authorization-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAElB,KAAK,QAAQ,EAEd,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAIlE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAKtF,MAAM,WAAW,0BAA0B;IACzC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjD,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,aAAa,CAoBtF"}

package/dist/di/authorization-module.js

@@ -0,0 +1,75 @@
+import { DeclaredPolicies, UseCaseDeclarations, UseCaseGuard, defineContextModule, } from '@ddd-ts-kit/di';
+import { Clock } from '@ddd-ts-kit/kernel';
+import { Authenticator } from '../authentication/authenticator.js';
+import { Access } from '../authorization/access.js';
+import { Authorizer } from '../authorization/authorizer.js';
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+import { isPermission } from '../permissions/is-permission.js';
+import { definePolicy } from '../policies/define-policy.js';
+import { PolicyAccess } from '../policies/policy-access.js';
+import { AuthorizationMap } from '../use-cases/authorization-map.js';
+import { authorizationMiddleware } from '../use-cases/authorization-middleware.js';
+import { authorizationMapOf } from './authorization-map-of.js';
+/**
+ * Turns the declarations of the modules into enforcement: binds the use case guard the kernel
+ * buses run first, so a command or query that declared no access is refused, and a protected
+ * one reaches its handler only when the authorizer allows the actor it carries. Starting the
+ * application builds the guard, so a declaration that is not a permission fails the start.
+ */
+export function authorizationModule(options) {
+    const { authenticator } = options;
+    return defineContextModule({
+        name: 'authorization',
+        register(builder) {
+            builder.bind(Authorizer).toFactory(provided(options.authorizer));
+            if (authenticator !== undefined) {
+                builder.bind(Authenticator).toFactory(provided(authenticator));
+            }
+            builder.bind(AuthorizationMap).toFactory((resolve) => authorizationMapOf(resolve(UseCaseDeclarations).list));
+            builder.bind(Access).toFactory((resolve) => accessOf(options, resolve));
+            builder.bind(UseCaseGuard).toFactory((resolve) => guardOf(options, resolve));
+        },
+        onStart({ resolve }) {
+            resolve(UseCaseGuard);
+        },
+    });
+}
+function provided(value) {
+    return isFactory(value) ? value : () => value;
+}
+function isFactory(value) {
+    return typeof value === 'function';
+}
+function accessOf(options, resolve) {
+    const { resourceOf, onDecision } = options;
+    const declared = resolve(DeclaredPolicies).list.map((binding) => policyOf(binding, resolve));
+    return new PolicyAccess({
+        authorizer: resolve(Authorizer),
+        clock: resolve(Clock),
+        policies: [...(options.policies ?? []), ...declared],
+        ...(resourceOf === undefined ? {} : { resourceOf }),
+        ...(onDecision === undefined ? {} : { onDecision }),
+    });
+}
+/** A class a context declared with `@Policy`, built by its binding the first time it is asked. */
+function policyOf(binding, resolve) {
+    const { name, permission, module, policy } = binding;
+    if (!isPermission(permission)) {
+        throw new AuthorizationSetupError(`Module "${module}" declares the policy "${name}" for something that is not a permission made by definePermissions.`);
+    }
+    return definePolicy({
+        name,
+        permission,
+        appliesTo: (subject) => resolve(policy).appliesTo?.(subject) ?? true,
+        allows: (actor, subject, context) => resolve(policy).allows(actor, subject, context),
+    });
+}
+function guardOf({ onDecision }, resolve) {
+    const check = authorizationMiddleware({
+        authorizer: resolve(Authorizer),
+        map: resolve(AuthorizationMap),
+        ...(onDecision === undefined ? {} : { onDecision }),
+    });
+    return { check };
+}
+//# sourceMappingURL=authorization-module.js.map

package/dist/di/authorization-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-module.js","sourceRoot":"","sources":["../../src/di/authorization-module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,GAKpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,YAAY,EAA4B,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAa/D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,OAAO,mBAAmB,CAAC;QACzB,IAAI,EAAE,eAAe;QACrB,QAAQ,CAAC,OAAO;YACd,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7G,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,EAAE,OAAO,EAAE;YACjB,OAAO,CAAC,YAAY,CAAC,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAI,KAAkB;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAI,KAAkB;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAmC,EAAE,OAAgB;IACrE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAE7F,OAAO,IAAI,YAAY,CAAC;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC;QACpD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,SAAS,QAAQ,CAAC,OAAsB,EAAE,OAAgB;IACxD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,WAAW,MAAM,0BAA0B,IAAI,qEAAqE,CACrH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,IAAI;QACJ,UAAU;QACV,SAAS,EAAE,CAAC,OAAO,EAAsB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI;QACxF,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,EAAE,UAAU,EAA8B,EAAE,OAAgB;IAC3E,MAAM,KAAK,GAAG,uBAAuB,CAAC;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QAC/B,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC;QAC9B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/di.d.ts

@@ -0,0 +1,7 @@
+export { Authenticator } from './authentication/authenticator.js';
+export { Access } from './authorization/access.js';
+export { Authorizer } from './authorization/authorizer.js';
+export { authorizationMapOf } from './di/authorization-map-of.js';
+export { authorizationModule, type AuthorizationModuleOptions } from './di/authorization-module.js';
+export { AuthorizationMap } from './use-cases/authorization-map.js';
+//# sourceMappingURL=di.d.ts.map

package/dist/di.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"di.d.ts","sourceRoot":"","sources":["../src/di.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/di.js

@@ -0,0 +1,7 @@
+export { Authenticator } from './authentication/authenticator.js';
+export { Access } from './authorization/access.js';
+export { Authorizer } from './authorization/authorizer.js';
+export { authorizationMapOf } from './di/authorization-map-of.js';
+export { authorizationModule } from './di/authorization-module.js';
+export { AuthorizationMap } from './use-cases/authorization-map.js';
+//# sourceMappingURL=di.js.map

package/dist/di.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"di.js","sourceRoot":"","sources":["../src/di.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAmC,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/errors/authorization-setup-error.d.ts

@@ -0,0 +1,5 @@
+/** Permissions, roles, policies or declarations that contradict themselves, found when they are defined. */
+export declare class AuthorizationSetupError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=authorization-setup-error.d.ts.map

package/dist/errors/authorization-setup-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-setup-error.d.ts","sourceRoot":"","sources":["../../src/errors/authorization-setup-error.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/errors/authorization-setup-error.js

@@ -0,0 +1,8 @@
+/** Permissions, roles, policies or declarations that contradict themselves, found when they are defined. */
+export class AuthorizationSetupError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthorizationSetupError';
+    }
+}
+//# sourceMappingURL=authorization-setup-error.js.map

package/dist/errors/authorization-setup-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-setup-error.js","sourceRoot":"","sources":["../../src/errors/authorization-setup-error.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF"}

package/dist/errors/forbidden-error.d.ts

@@ -0,0 +1,14 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
+/**
+ * The code `ForbiddenError` of @ddd-ts-kit/http carries, so its default error mapping answers
+ * 403 for the error below with no extra wiring.
+ */
+export declare const FORBIDDEN = "FORBIDDEN";
+/** The actor is known and may not do this. `reason` is a stable machine code, never data. */
+export declare class ForbiddenError extends DomainError {
+    readonly permissionId: string;
+    readonly reason: string;
+    readonly code = "FORBIDDEN";
+    constructor(permissionId: string, reason: string);
+}
+//# sourceMappingURL=forbidden-error.d.ts.map

package/dist/errors/forbidden-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden-error.d.ts","sourceRoot":"","sources":["../../src/errors/forbidden-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,6FAA6F;AAC7F,qBAAa,cAAe,SAAQ,WAAW;IAI3C,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,eAAa;IAE1B,YACW,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EAGxB;CACF"}

package/dist/errors/forbidden-error.js

@@ -0,0 +1,18 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
+/**
+ * The code `ForbiddenError` of @ddd-ts-kit/http carries, so its default error mapping answers
+ * 403 for the error below with no extra wiring.
+ */
+export const FORBIDDEN = 'FORBIDDEN';
+/** The actor is known and may not do this. `reason` is a stable machine code, never data. */
+export class ForbiddenError extends DomainError {
+    permissionId;
+    reason;
+    code = FORBIDDEN;
+    constructor(permissionId, reason) {
+        super(`Permission ${permissionId} is not granted`);
+        this.permissionId = permissionId;
+        this.reason = reason;
+    }
+}
+//# sourceMappingURL=forbidden-error.js.map

package/dist/errors/forbidden-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden-error.js","sourceRoot":"","sources":["../../src/errors/forbidden-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,6FAA6F;AAC7F,MAAM,OAAO,cAAe,SAAQ,WAAW;IAIlC,YAAY;IACZ,MAAM;IAJR,IAAI,GAAG,SAAS,CAAC;IAE1B,YACW,YAAoB,EACpB,MAAc;QAEvB,KAAK,CAAC,cAAc,YAAY,iBAAiB,CAAC,CAAC;4BAH1C,YAAY;sBACZ,MAAM;IAGjB,CAAC;CACF"}

package/dist/errors/invalid-credential-error.d.ts

@@ -0,0 +1,8 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
+/** A credential was presented and it is not acceptable. `reason` is a stable machine code. */
+export declare class InvalidCredentialError extends DomainError {
+    readonly reason: string;
+    readonly code = "UNAUTHORIZED";
+    constructor(reason: string);
+}
+//# sourceMappingURL=invalid-credential-error.d.ts.map

package/dist/errors/invalid-credential-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-credential-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-credential-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,8FAA8F;AAC9F,qBAAa,sBAAuB,SAAQ,WAAW;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAFnC,QAAQ,CAAC,IAAI,kBAAgB;IAE7B,YAAqB,MAAM,EAAE,MAAM,EAElC;CACF"}

package/dist/errors/invalid-credential-error.js

@@ -0,0 +1,12 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
+import { UNAUTHORIZED } from './unauthenticated-error.js';
+/** A credential was presented and it is not acceptable. `reason` is a stable machine code. */
+export class InvalidCredentialError extends DomainError {
+    reason;
+    code = UNAUTHORIZED;
+    constructor(reason) {
+        super('The credential is not valid');
+        this.reason = reason;
+    }
+}
+//# sourceMappingURL=invalid-credential-error.js.map

package/dist/errors/invalid-credential-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-credential-error.js","sourceRoot":"","sources":["../../src/errors/invalid-credential-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,8FAA8F;AAC9F,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IAGhC,MAAM;IAFlB,IAAI,GAAG,YAAY,CAAC;IAE7B,YAAqB,MAAc;QACjC,KAAK,CAAC,6BAA6B,CAAC,CAAC;sBADlB,MAAM;IAE3B,CAAC;CACF"}

package/dist/errors/listing-not-supported-error.d.ts

@@ -0,0 +1,5 @@
+/** The configured authorizer cannot enumerate what an actor may access. */
+export declare class ListingNotSupportedError extends Error {
+    constructor();
+}
+//# sourceMappingURL=listing-not-supported-error.d.ts.map

package/dist/errors/listing-not-supported-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listing-not-supported-error.d.ts","sourceRoot":"","sources":["../../src/errors/listing-not-supported-error.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,cAGC;CACF"}

package/dist/errors/listing-not-supported-error.js

@@ -0,0 +1,8 @@
+/** The configured authorizer cannot enumerate what an actor may access. */
+export class ListingNotSupportedError extends Error {
+    constructor() {
+        super('The authorizer does not implement listAccessible: it cannot turn a permission into an access scope');
+        this.name = 'ListingNotSupportedError';
+    }
+}
+//# sourceMappingURL=listing-not-supported-error.js.map

package/dist/errors/listing-not-supported-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listing-not-supported-error.js","sourceRoot":"","sources":["../../src/errors/listing-not-supported-error.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,oGAAoG,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF"}

package/dist/errors/missing-actor-error.d.ts

@@ -0,0 +1,6 @@
+import type { MessageInfo } from '@ddd-ts-kit/kernel';
+/** A protected command or query was sent without its actor. A programming error, not a refusal. */
+export declare class MissingActorError extends Error {
+    constructor(info: MessageInfo);
+}
+//# sourceMappingURL=missing-actor-error.d.ts.map

package/dist/errors/missing-actor-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-actor-error.d.ts","sourceRoot":"","sources":["../../src/errors/missing-actor-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,mGAAmG;AACnG,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAI,EAAE,WAAW,EAM5B;CACF"}