@futdevpro/fsm-dynamo 1.20.57 → 1.20.59

package/build/_collections/utils/operation-authz.util.d.ts

@@ -0,0 +1,44 @@
+import { DyFM_OperationContext_ControlModel } from '../../_models/control-models/operation-context.control-model';
+import { DyFM_OperationSettings_ControlModel } from '../../_models/control-models/operation-settings.control-model';
+import { DyFM_OperationAuthz_Result } from '../../_models/interfaces/operation-authz-result.interface';
+/**
+ * Transport-independent authorization checks of an operation call (HP-DOPL MP-1.4).
+ *
+ * Two phases, because ownership needs the loaded entity:
+ * 1. `check` / `assert` — identity + API key scope, BEFORE the operation runs;
+ * 2. `checkOwnership` / `assertOwnership` — inside `run`, once the target entity is loaded.
+ *
+ * @example
+ * ```ts
+ * DyFM_OperationAuthz_Util.assert(operation, ctx);
+ * const task: Task = await loadTask(id);
+ * DyFM_OperationAuthz_Util.assertOwnership(operation, ctx, task);
+ * ```
+ */
+export declare class DyFM_OperationAuthz_Util {
+    /**
+     * Checks the identity and API key scope requirements of the operation.
+     * @param operation - the operation being called
+     * @param ctx - the call context built by the transport adapter
+     */
+    static check(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>, ctx: DyFM_OperationContext_ControlModel): DyFM_OperationAuthz_Result;
+    /**
+     * Same as `check`, but throws a coded `DyFM_Error` (with `status`) on denial.
+     * @returns the allowed result, so a `warning` can still be surfaced by the adapter
+     */
+    static assert(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>, ctx: DyFM_OperationContext_ControlModel): DyFM_OperationAuthz_Result;
+    /**
+     * Checks that the caller owns the loaded target entity, when the operation declares `authz.ownership`.
+     * @param operation - the operation being called
+     * @param ctx - the call context; its `clientUserId` is the owner identity (never `issuer`)
+     * @param target - the loaded entity the operation acts on
+     */
+    static checkOwnership(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>, ctx: DyFM_OperationContext_ControlModel, target: object): DyFM_OperationAuthz_Result;
+    /** Same as `checkOwnership`, but throws a coded `DyFM_Error` (with `status`) on denial. */
+    static assertOwnership(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>, ctx: DyFM_OperationContext_ControlModel, target: object): DyFM_OperationAuthz_Result;
+    /** Builds a denial result. */
+    private static deny;
+    /** Converts a denial into a thrown `DyFM_Error`; the identity is logged by requestId only. */
+    private static throwIfDenied;
+}
+//# sourceMappingURL=operation-authz.util.d.ts.map

package/build/_collections/utils/operation-authz.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAyC7B;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAM7B;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IA6B7B,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAM7B,8BAA8B;IAC9B,OAAO,CAAC,MAAM,CAAC,IAAI;IAInB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,aAAa;CAoB7B"}

package/build/_collections/utils/operation-authz.util.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_OperationAuthz_Util = void 0;
+const operation_auth_type_enum_1 = require("../../_enums/operation-auth.type-enum");
+const operation_context_control_model_1 = require("../../_models/control-models/operation-context.control-model");
+const error_control_model_1 = require("../../_models/control-models/error.control-model");
+/**
+ * Transport-independent authorization checks of an operation call (HP-DOPL MP-1.4).
+ *
+ * Two phases, because ownership needs the loaded entity:
+ * 1. `check` / `assert` — identity + API key scope, BEFORE the operation runs;
+ * 2. `checkOwnership` / `assertOwnership` — inside `run`, once the target entity is loaded.
+ *
+ * @example
+ * ```ts
+ * DyFM_OperationAuthz_Util.assert(operation, ctx);
+ * const task: Task = await loadTask(id);
+ * DyFM_OperationAuthz_Util.assertOwnership(operation, ctx, task);
+ * ```
+ */
+class DyFM_OperationAuthz_Util {
+    /**
+     * Checks the identity and API key scope requirements of the operation.
+     * @param operation - the operation being called
+     * @param ctx - the call context built by the transport adapter
+     */
+    static check(operation, ctx) {
+        const issuerRequired = operation?.authz?.issuerRequired !== false;
+        const authKind = ctx?.authKind ?? operation_auth_type_enum_1.DyFM_OperationAuth_Type.none;
+        // a missing identity is 401, the caller may retry with credentials
+        if (issuerRequired && (authKind === operation_auth_type_enum_1.DyFM_OperationAuth_Type.none || !ctx?.issuer)) {
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-UNA', 401, `operation "${operation?.name}" requires an authenticated caller`);
+        }
+        // scopes only restrict API keys; a token call is not scope-limited
+        if (authKind !== operation_auth_type_enum_1.DyFM_OperationAuth_Type.apiKey) {
+            return { allowed: true };
+        }
+        // legacy key (created before scopes): full access, but the adapter must surface the warning
+        if (operation_context_control_model_1.DyFM_OperationContext_ControlModel.isLegacyApiKey(ctx)) {
+            return { allowed: true, warning: 'legacy-api-key' };
+        }
+        const requiredScope = operation?.authz?.apiKeyScope;
+        // least privilege: a scoped key can not reach an operation that belongs to no scope
+        if (!requiredScope) {
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-NSC', 403, `operation "${operation?.name}" declares no apiKeyScope, a scoped API key can not call it`);
+        }
+        // exact match only — no wildcard until it is an explicit decision
+        if (!(ctx.apiKeyScopes ?? []).includes(requiredScope)) {
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-SCP', 403, `API key lacks scope "${requiredScope}" for operation "${operation?.name}"`);
+        }
+        return { allowed: true };
+    }
+    /**
+     * Same as `check`, but throws a coded `DyFM_Error` (with `status`) on denial.
+     * @returns the allowed result, so a `warning` can still be surfaced by the adapter
+     */
+    static assert(operation, ctx) {
+        return DyFM_OperationAuthz_Util.throwIfDenied(DyFM_OperationAuthz_Util.check(operation, ctx), operation, ctx);
+    }
+    /**
+     * Checks that the caller owns the loaded target entity, when the operation declares `authz.ownership`.
+     * @param operation - the operation being called
+     * @param ctx - the call context; its `clientUserId` is the owner identity (never `issuer`)
+     * @param target - the loaded entity the operation acts on
+     */
+    static checkOwnership(operation, ctx, target) {
+        const ownershipField = operation?.authz?.ownership;
+        // no ownership declared: nothing to check
+        if (!ownershipField) {
+            return { allowed: true };
+        }
+        // a declared ownership check without a caller identity must fail closed, not pass
+        if (!ctx?.clientUserId) {
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `operation "${operation?.name}" requires the caller's clientUserId for the ownership check`);
+        }
+        const owner = target ? Reflect.get(target, ownershipField) : undefined;
+        // strict equality: an entity without owner is not owned by anybody
+        if (owner === undefined || owner === null || String(owner) !== ctx.clientUserId) {
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `caller does not own the target of operation "${operation?.name}" (field: ${ownershipField})`);
+        }
+        return { allowed: true };
+    }
+    /** Same as `checkOwnership`, but throws a coded `DyFM_Error` (with `status`) on denial. */
+    static assertOwnership(operation, ctx, target) {
+        return DyFM_OperationAuthz_Util.throwIfDenied(DyFM_OperationAuthz_Util.checkOwnership(operation, ctx, target), operation, ctx);
+    }
+    /** Builds a denial result. */
+    static deny(errorCode, status, reason) {
+        return { allowed: false, errorCode: errorCode, status: status, reason: reason };
+    }
+    /** Converts a denial into a thrown `DyFM_Error`; the identity is logged by requestId only. */
+    static throwIfDenied(result, operation, ctx) {
+        if (result.allowed) {
+            return result;
+        }
+        throw new error_control_model_1.DyFM_Error({
+            errorCode: result.errorCode,
+            status: result.status,
+            message: `Operation authorization failed: ${result.reason}`,
+            additionalContent: {
+                operation: operation?.name,
+                requestId: ctx?.requestId,
+                authKind: ctx?.authKind,
+            },
+        });
+    }
+}
+exports.DyFM_OperationAuthz_Util = DyFM_OperationAuthz_Util;
+//# sourceMappingURL=operation-authz.util.js.map

package/build/_collections/utils/operation-authz.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,CACvF,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4FAA4F;QAC5F,IAAI,oEAAkC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAuB,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;QAExE,oFAAoF;QACpF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,6DAA6D,CAC3F,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtD,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,wBAAwB,aAAa,oBAAoB,SAAS,EAAE,IAAI,GAAG,CACjG,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAA2E,EAC3E,GAAuC;QAEvC,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,MAAM,cAAc,GAAuB,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC;YACvB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,8DAA8D,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;YAChF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,gDAAgD,SAAS,EAAE,IAAI,aAAa,cAAc,GAAG,CAC9F,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,8BAA8B;IACtB,MAAM,CAAC,IAAI,CAAC,SAAiB,EAAE,MAAiB,EAAE,MAAc;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClF,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,aAAa,CAC1B,MAAkC,EAClC,SAA2E,EAC3E,GAAuC;QAEvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,gCAAU,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,EAAE;YAC3D,iBAAiB,EAAE;gBACjB,SAAS,EAAE,SAAS,EAAE,IAAI;gBAC1B,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB;SACF,CAAC,CAAC;IACL,CAAC;CACF;AA3ID,4DA2IC"}

package/build/_enums/operation-auth.type-enum.d.ts

@@ -0,0 +1,19 @@
+/**
+ * How the caller of an operation authenticated.
+ *
+ * @example
+ * ```ts
+ * if (ctx.authKind === DyFM_OperationAuth_Type.apiKey) {
+ *   // scope checks apply
+ * }
+ * ```
+ */
+export declare enum DyFM_OperationAuth_Type {
+    /** Anonymous call: no authenticated identity. */
+    none = "none",
+    /** Authenticated with a user (session/JWT) token. */
+    token = "token",
+    /** Authenticated with an API key; `apiKeyScopes` may restrict what it can call. */
+    apiKey = "api-key"
+}
+//# sourceMappingURL=operation-auth.type-enum.d.ts.map

package/build/_enums/operation-auth.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-auth.type-enum.d.ts","sourceRoot":"","sources":["../../src/_enums/operation-auth.type-enum.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,oBAAY,uBAAuB;IACjC,iDAAiD;IACjD,IAAI,SAAS;IACb,qDAAqD;IACrD,KAAK,UAAU;IACf,mFAAmF;IACnF,MAAM,YAAY;CACnB"}

package/build/_enums/operation-auth.type-enum.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_OperationAuth_Type = void 0;
+/**
+ * How the caller of an operation authenticated.
+ *
+ * @example
+ * ```ts
+ * if (ctx.authKind === DyFM_OperationAuth_Type.apiKey) {
+ *   // scope checks apply
+ * }
+ * ```
+ */
+var DyFM_OperationAuth_Type;
+(function (DyFM_OperationAuth_Type) {
+    /** Anonymous call: no authenticated identity. */
+    DyFM_OperationAuth_Type["none"] = "none";
+    /** Authenticated with a user (session/JWT) token. */
+    DyFM_OperationAuth_Type["token"] = "token";
+    /** Authenticated with an API key; `apiKeyScopes` may restrict what it can call. */
+    DyFM_OperationAuth_Type["apiKey"] = "api-key";
+})(DyFM_OperationAuth_Type || (exports.DyFM_OperationAuth_Type = DyFM_OperationAuth_Type = {}));
+//# sourceMappingURL=operation-auth.type-enum.js.map

package/build/_enums/operation-auth.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-auth.type-enum.js","sourceRoot":"","sources":["../../src/_enums/operation-auth.type-enum.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACH,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,iDAAiD;IACjD,wCAAa,CAAA;IACb,qDAAqD;IACrD,0CAAe,CAAA;IACf,mFAAmF;IACnF,6CAAkB,CAAA;AACpB,CAAC,EAPW,uBAAuB,uCAAvB,uBAAuB,QAOlC"}

package/build/_models/control-models/operation-context.control-model.d.ts

@@ -0,0 +1,57 @@
+import { DyFM_OperationAuth_Type } from '../../_enums/operation-auth.type-enum';
+import { DyFM_Operation_Exposure } from '../interfaces/operation-exposure.interface';
+/**
+ * Transport-independent context of ONE operation call (HP-DOPL MP-1.3).
+ *
+ * The REST, MCP and CLI adapters build this object from their own request shape, so the operation's
+ * `run(ctx, ...inputs)` never sees Express, JSON-RPC or commander objects.
+ *
+ * 🔴 `issuer` is ALWAYS the accountId, NEVER a user id (`fdp-issuer-is-account-id`). The service's own
+ * user id — the content-ownership identity — travels separately in `clientUserId`.
+ *
+ * @example
+ * ```ts
+ * const ctx: DyFM_Operation_Context = new DyFM_Operation_Context({
+ *   transport: 'mcp',
+ *   authKind: DyFM_OperationAuth_Type.apiKey,
+ *   issuer: accountId,
+ *   clientUserId: userId,
+ *   apiKeyScopes: [ 'task:read' ],
+ * });
+ * ```
+ */
+export declare class DyFM_OperationContext_ControlModel {
+    /** Transport the call arrived on. */
+    transport?: keyof DyFM_Operation_Exposure;
+    /** How the caller authenticated (default: `none`). */
+    authKind?: DyFM_OperationAuth_Type;
+    /** The authenticated FDP accountId — never a user id. Required unless `authKind` is `none`. */
+    issuer?: string;
+    /** The service's own user id of the caller (content ownership); resolved server-side, never from input. */
+    clientUserId?: string;
+    /**
+     * Scopes granted to the API key. Only valid with `authKind: apiKey`.
+     * `undefined` marks a LEGACY key without scopes (full access with a warning, decision D-6);
+     * an empty array means the key grants nothing.
+     */
+    apiKeyScopes?: string[];
+    /** When `true`, the operation must validate and report, but not persist anything (default: `false`). */
+    dryRun?: boolean;
+    /** Optimistic-concurrency token (etag) the caller expects the target to still have. */
+    ifMatch?: string;
+    /** Correlation id of the call; generated when not given. */
+    requestId?: string;
+    /**
+     * Validates the identity combination and applies the defaults.
+     * @param input - the call context; throws a coded `DyFM_Error` when the identity combination is invalid
+     */
+    constructor(input?: DyFM_OperationContext_ControlModel);
+    /** `true` when the call uses an API key created before scopes existed (legacy full access, D-6). */
+    static isLegacyApiKey(ctx: DyFM_OperationContext_ControlModel): boolean;
+    /** Checks for a non-blank string. */
+    private static isFilled;
+    /** Builds the construction error with a stable error code and the construction location. */
+    private static invalid;
+}
+export { DyFM_OperationContext_ControlModel as DyFM_Operation_Context };
+//# sourceMappingURL=operation-context.control-model.d.ts.map

package/build/_models/control-models/operation-context.control-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-context.control-model.d.ts","sourceRoot":"","sources":["../../../src/_models/control-models/operation-context.control-model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAKrF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kCAAkC;IAK7C,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2GAA2G;IAC3G,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,wGAAwG;IACxG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;gBACS,KAAK,CAAC,EAAE,kCAAkC;IAgEtD,oGAAoG;IACpG,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,kCAAkC,GAAG,OAAO;IAIvE,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,OAAO;CAOvB;AAED,OAAO,EACL,kCAAkC,IAAI,sBAAsB,EAC7D,CAAC"}

package/build/_models/control-models/operation-context.control-model.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_Operation_Context = exports.DyFM_OperationContext_ControlModel = void 0;
+const stack_util_1 = require("../../_collections/utils/stack.util");
+const uuid_util_1 = require("../../_collections/utils/uuid.util");
+const operation_auth_type_enum_1 = require("../../_enums/operation-auth.type-enum");
+const error_control_model_1 = require("./error.control-model");
+/**
+ * Transport-independent context of ONE operation call (HP-DOPL MP-1.3).
+ *
+ * The REST, MCP and CLI adapters build this object from their own request shape, so the operation's
+ * `run(ctx, ...inputs)` never sees Express, JSON-RPC or commander objects.
+ *
+ * 🔴 `issuer` is ALWAYS the accountId, NEVER a user id (`fdp-issuer-is-account-id`). The service's own
+ * user id — the content-ownership identity — travels separately in `clientUserId`.
+ *
+ * @example
+ * ```ts
+ * const ctx: DyFM_Operation_Context = new DyFM_Operation_Context({
+ *   transport: 'mcp',
+ *   authKind: DyFM_OperationAuth_Type.apiKey,
+ *   issuer: accountId,
+ *   clientUserId: userId,
+ *   apiKeyScopes: [ 'task:read' ],
+ * });
+ * ```
+ */
+class DyFM_OperationContext_ControlModel {
+    static {
+        Object.defineProperty(this, 'name', { value: 'DyFM_Operation_Context' });
+    }
+    /** Transport the call arrived on. */
+    transport;
+    /** How the caller authenticated (default: `none`). */
+    authKind;
+    /** The authenticated FDP accountId — never a user id. Required unless `authKind` is `none`. */
+    issuer;
+    /** The service's own user id of the caller (content ownership); resolved server-side, never from input. */
+    clientUserId;
+    /**
+     * Scopes granted to the API key. Only valid with `authKind: apiKey`.
+     * `undefined` marks a LEGACY key without scopes (full access with a warning, decision D-6);
+     * an empty array means the key grants nothing.
+     */
+    apiKeyScopes;
+    /** When `true`, the operation must validate and report, but not persist anything (default: `false`). */
+    dryRun;
+    /** Optimistic-concurrency token (etag) the caller expects the target to still have. */
+    ifMatch;
+    /** Correlation id of the call; generated when not given. */
+    requestId;
+    /**
+     * Validates the identity combination and applies the defaults.
+     * @param input - the call context; throws a coded `DyFM_Error` when the identity combination is invalid
+     */
+    constructor(input) {
+        const set = input ?? {};
+        // the construction location identifies the faulty adapter in the error
+        const stackLocation = (0, stack_util_1.DyFM_getConstructionStackLocation)();
+        const authKind = set.authKind ?? operation_auth_type_enum_1.DyFM_OperationAuth_Type.none;
+        // authKind must be a known value
+        if (!Object.values(operation_auth_type_enum_1.DyFM_OperationAuth_Type).includes(authKind)) {
+            throw DyFM_OperationContext_ControlModel.invalid('DyFM-OPC-AUT', `unknown authKind (got: ${JSON.stringify(set.authKind)})`, stackLocation);
+        }
+        // transport must be one of the exposure keys
+        if (set.transport !== undefined && !['rest', 'mcp', 'cli'].includes(set.transport)) {
+            throw DyFM_OperationContext_ControlModel.invalid('DyFM-OPC-TRN', `unknown transport (got: ${JSON.stringify(set.transport)})`, stackLocation);
+        }
+        const authenticated = authKind !== operation_auth_type_enum_1.DyFM_OperationAuth_Type.none;
+        // an authenticated call without an accountId is an adapter defect, not an anonymous call
+        if (authenticated && !DyFM_OperationContext_ControlModel.isFilled(set.issuer)) {
+            throw DyFM_OperationContext_ControlModel.invalid('DyFM-OPC-ISS', `authKind "${authKind}" requires the issuer (accountId)`, stackLocation);
+        }
+        // an anonymous call must not carry an identity
+        if (!authenticated && (set.issuer !== undefined || set.clientUserId !== undefined)) {
+            throw DyFM_OperationContext_ControlModel.invalid('DyFM-OPC-ANO', 'authKind "none" can not carry an issuer or a clientUserId', stackLocation);
+        }
+        // scopes belong to API keys only; every scope must be a non-empty string
+        if (set.apiKeyScopes !== undefined) {
+            if (authKind !== operation_auth_type_enum_1.DyFM_OperationAuth_Type.apiKey) {
+                throw DyFM_OperationContext_ControlModel.invalid('DyFM-OPC-SCP', `apiKeyScopes are only valid with authKind "api-key" (got: "${authKind}")`, stackLocation);
+            }
+            if (!Array.isArray(set.apiKeyScopes) ||
+                !set.apiKeyScopes.every((scope) => DyFM_OperationContext_ControlModel.isFilled(scope))) {
+                throw DyFM_OperationContext_ControlModel.invalid('DyFM-OPC-SCP', 'apiKeyScopes must be an array of non-empty strings', stackLocation);
+            }
+        }
+        Object.assign(this, set);
+        this.authKind = authKind;
+        this.dryRun = set.dryRun === true;
+        this.requestId = DyFM_OperationContext_ControlModel.isFilled(set.requestId) ?
+            set.requestId : uuid_util_1.DyFM_UUID.generate();
+        // a copy, so a later mutation of the adapter's array can not widen the granted scopes
+        this.apiKeyScopes = set.apiKeyScopes ? [...set.apiKeyScopes] : undefined;
+    }
+    /** `true` when the call uses an API key created before scopes existed (legacy full access, D-6). */
+    static isLegacyApiKey(ctx) {
+        return ctx?.authKind === operation_auth_type_enum_1.DyFM_OperationAuth_Type.apiKey && ctx.apiKeyScopes === undefined;
+    }
+    /** Checks for a non-blank string. */
+    static isFilled(value) {
+        return typeof value === 'string' && !!value.trim();
+    }
+    /** Builds the construction error with a stable error code and the construction location. */
+    static invalid(errorCode, reason, stackLocation) {
+        return new error_control_model_1.DyFM_Error({
+            errorCode: errorCode,
+            message: `DyFM_Operation_Context construction failed: ${reason}`,
+            additionalContent: { stackLocation: stackLocation },
+        });
+    }
+}
+exports.DyFM_OperationContext_ControlModel = DyFM_OperationContext_ControlModel;
+exports.DyFM_Operation_Context = DyFM_OperationContext_ControlModel;
+//# sourceMappingURL=operation-context.control-model.js.map

package/build/_models/control-models/operation-context.control-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-context.control-model.js","sourceRoot":"","sources":["../../../src/_models/control-models/operation-context.control-model.ts"],"names":[],"mappings":";;;AAAA,oEAAwF;AACxF,kEAA+D;AAC/D,oFAAgF;AAGhF,+DAAmD;AAGnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kCAAkC;IAC7C;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,qCAAqC;IACrC,SAAS,CAAiC;IAC1C,sDAAsD;IACtD,QAAQ,CAA2B;IACnC,+FAA+F;IAC/F,MAAM,CAAU;IAChB,2GAA2G;IAC3G,YAAY,CAAU;IACtB;;;;OAIG;IACH,YAAY,CAAY;IACxB,wGAAwG;IACxG,MAAM,CAAW;IACjB,uFAAuF;IACvF,OAAO,CAAU;IACjB,4DAA4D;IAC5D,SAAS,CAAU;IAEnB;;;OAGG;IACH,YAAY,KAA0C;QACpD,MAAM,GAAG,GAAuC,KAAK,IAAI,EAAE,CAAC;QAC5D,uEAAuE;QACvE,MAAM,aAAa,GAAW,IAAA,8CAAiC,GAAE,CAAC;QAClE,MAAM,QAAQ,GAA4B,GAAG,CAAC,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAEvF,iCAAiC;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kDAAuB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,kCAAkC,CAAC,OAAO,CAC9C,cAAc,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CACzF,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,MAAM,kCAAkC,CAAC,OAAO,CAC9C,cAAc,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,QAAQ,KAAK,kDAAuB,CAAC,IAAI,CAAC;QAEzE,yFAAyF;QACzF,IAAI,aAAa,IAAI,CAAC,kCAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9E,MAAM,kCAAkC,CAAC,OAAO,CAC9C,cAAc,EAAE,aAAa,QAAQ,mCAAmC,EAAE,aAAa,CACxF,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;YACnF,MAAM,kCAAkC,CAAC,OAAO,CAC9C,cAAc,EAAE,2DAA2D,EAAE,aAAa,CAC3F,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,kCAAkC,CAAC,OAAO,CAC9C,cAAc,EAAE,8DAA8D,QAAQ,IAAI,EAAE,aAAa,CAC1G,CAAC;YACJ,CAAC;YAED,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;gBAChC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,kCAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACvG,CAAC;gBACD,MAAM,kCAAkC,CAAC,OAAO,CAC9C,cAAc,EAAE,oDAAoD,EAAE,aAAa,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,kCAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAS,CAAC,QAAQ,EAAE,CAAC;QACvC,sFAAsF;QACtF,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAE,GAAG,GAAG,CAAC,YAAY,CAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAED,oGAAoG;IACpG,MAAM,CAAC,cAAc,CAAC,GAAuC;QAC3D,OAAO,GAAG,EAAE,QAAQ,KAAK,kDAAuB,CAAC,MAAM,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC;IAC5F,CAAC;IAED,qCAAqC;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAyB;QAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAC,OAAO,CAAC,SAAiB,EAAE,MAAc,EAAE,aAAqB;QAC7E,OAAO,IAAI,gCAAU,CAAC;YACpB,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,+CAA+C,MAAM,EAAE;YAChE,iBAAiB,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;CACF;AAhHD,gFAgHC;AAGuC,oEAAsB"}

package/build/_models/control-models/operation-settings.control-model.d.ts

@@ -1,3 +1,4 @@
+import { DyFM_Operation_Authz } from '../interfaces/operation-authz.interface';
 import { DyFM_Operation_Exposure } from '../interfaces/operation-exposure.interface';
 import { DyFM_OperationInput_Settings } from '../interfaces/operation-input-settings.interface';
 import { DyFM_DataModel_Params } from './data-model-params.control-model';
@@ -39,6 +40,8 @@ export declare class DyFM_OperationSettings_ControlModel<T_Result = unknown, T_I
     bodyParams?: DyFM_DataModel_Params<any>;
     /** Transports the operation is exposed on; missing flags default to `true`. */
     expose?: DyFM_Operation_Exposure;
+    /** Declarative authorization; `issuerRequired` defaults to `true`. */
+    authz?: DyFM_Operation_Authz;
     /** Source location of the construction, for debugging duplicated or misconfigured operations. */
     stackLocation?: string;
     /**

package/build/_models/control-models/operation-settings.control-model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-settings.control-model.d.ts","sourceRoot":"","sources":["../../../src/_models/control-models/operation-settings.control-model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAEhG,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAU1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mCAAmC,CAC9C,QAAQ,GAAG,OAAO,EAClB,QAAQ,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,EACtC,MAAM,GAAG,SAAS;IAMlB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAM;IAC3D,oEAAoE;IACpE,UAAU,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;gBAED,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;IAuFtE,mEAAmE;IACnE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAKzC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,OAAO;CAOvB;AAED,OAAO,EACL,mCAAmC,IAAI,uBAAuB,EAC/D,CAAC"}
+{"version":3,"file":"operation-settings.control-model.d.ts","sourceRoot":"","sources":["../../../src/_models/control-models/operation-settings.control-model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAEhG,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAU1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mCAAmC,CAC9C,QAAQ,GAAG,OAAO,EAClB,QAAQ,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,EACtC,MAAM,GAAG,SAAS;IAMlB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAM;IAC3D,oEAAoE;IACpE,UAAU,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,sEAAsE;IACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;gBAED,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;IA2GtE,mEAAmE;IACnE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAKzC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,OAAO;CAOvB;AAED,OAAO,EACL,mCAAmC,IAAI,uBAAuB,EAC/D,CAAC"}

package/build/_models/control-models/operation-settings.control-model.js

@@ -49,6 +49,8 @@ class DyFM_OperationSettings_ControlModel {
     bodyParams;
     /** Transports the operation is exposed on; missing flags default to `true`. */
     expose;
+    /** Declarative authorization; `issuerRequired` defaults to `true`. */
+    authz;
     /** Source location of the construction, for debugging duplicated or misconfigured operations. */
     stackLocation;
     /**
@@ -91,6 +93,15 @@ class DyFM_OperationSettings_ControlModel {
                 throw DyFM_OperationSettings_ControlModel.invalid('DyFM-OPS-INT', `input "${inputName}" has an invalid type (got: ${JSON.stringify(input?.type)}) (${label})`, stackLocation);
             }
         });
+        // authz: the declared fields must be usable, and ownership needs an authenticated caller
+        const authz = { issuerRequired: true, ...set.authz };
+        if ((authz.ownership !== undefined && !DyFM_operationInputName.test(authz.ownership)) ||
+            (authz.apiKeyScope !== undefined && (typeof authz.apiKeyScope !== 'string' || !authz.apiKeyScope.trim()))) {
+            throw DyFM_OperationSettings_ControlModel.invalid('DyFM-OPS-AZF', `authz.ownership must be a field name and authz.apiKeyScope a non-empty string (${label})`, stackLocation);
+        }
+        if (authz.ownership !== undefined && authz.issuerRequired === false) {
+            throw DyFM_OperationSettings_ControlModel.invalid('DyFM-OPS-AZO', `authz.ownership can not be combined with issuerRequired: false (${label})`, stackLocation);
+        }
         Object.assign(this, set);
         this.domain = set.domain;
         this.action = set.action;
@@ -99,6 +110,7 @@ class DyFM_OperationSettings_ControlModel {
         this.inputs = inputs;
         // a missing expose flag means: exposed on that transport
         this.expose = { rest: true, mcp: true, cli: true, ...set.expose };
+        this.authz = authz;
         this.stackLocation = stackLocation;
     }
     /** Checks the `name` format: dot-separated kebab-case segments. */

package/build/_models/control-models/operation-settings.control-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-settings.control-model.js","sourceRoot":"","sources":["../../../src/_models/control-models/operation-settings.control-model.ts"],"names":[],"mappings":";;;AAAA,oEAAwF;AACxF,oFAAgF;AAKhF,+DAAmD;AAGnD,gFAAgF;AAChF,MAAM,0BAA0B,GAAW,+BAA+B,CAAC;AAE3E,6FAA6F;AAC7F,MAAM,uBAAuB,GAAW,wBAAwB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,mCAAmC;IAK9C;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAU;IACd,qDAAqD;IACrD,MAAM,CAAS;IACf,0FAA0F;IAC1F,MAAM,CAAS;IACf,wFAAwF;IACxF,WAAW,CAAS;IACpB,qDAAqD;IACrD,MAAM,GAAkD,EAAE,CAAC;IAC3D,oEAAoE;IACpE,UAAU,CAA8B;IACxC,+EAA+E;IAC/E,MAAM,CAA2B;IACjC,iGAAiG;IACjG,aAAa,CAAU;IAEvB;;;OAGG;IACH,YACE,GAAoE;QAEpE,0EAA0E;QAC1E,MAAM,aAAa,GAAW,GAAG,EAAE,aAAa,IAAI,IAAA,8CAAiC,GAAE,CAAC;QAExF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EAAE,4BAA4B,EAAE,aAAa,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAEhE,sCAAsC;QACtC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,6CAA6C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,EACrF,aAAa,CACd,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,IACE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACpG,CAAC;YACD,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,0DAA0D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,EAClG,aAAa,CACd,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACnE,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EAAE,4BAA4B,KAAK,GAAG,EAAE,aAAa,CACpE,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,wDAAwD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EACnF,aAAa,CACd,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,MAAM,MAAM,GAAiD,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAE9E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,SAAS,EAAE,KAAK,CAA0C,EAAQ,EAAE;YACpG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,mDAAmD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,EAC1F,aAAa,CACd,CAAC;YACJ,CAAC;YAED,IACE,CAAC,KAAK;gBACN,CAAC,MAAM,CAAC,MAAM,CAAC,kDAAuB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5D,KAAK,CAAC,IAAI,KAAK,kDAAuB,CAAC,QAAQ,EAC/C,CAAC;gBACD,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,UAAU,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,GAAG,EAC3F,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,yDAAyD;QACzD,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,WAAW,CAAC,IAAY;QAC7B,OAAO,OAAO,IAAI,KAAK,QAAQ;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAC,OAAO,CAAC,SAAiB,EAAE,MAAc,EAAE,aAAqB;QAC7E,OAAO,IAAI,gCAAU,CAAC;YACpB,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,gDAAgD,MAAM,EAAE;YACjE,iBAAiB,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;CACF;AApID,kFAoIC;AAGwC,sEAAuB"}
+{"version":3,"file":"operation-settings.control-model.js","sourceRoot":"","sources":["../../../src/_models/control-models/operation-settings.control-model.ts"],"names":[],"mappings":";;;AAAA,oEAAwF;AACxF,oFAAgF;AAMhF,+DAAmD;AAGnD,gFAAgF;AAChF,MAAM,0BAA0B,GAAW,+BAA+B,CAAC;AAE3E,6FAA6F;AAC7F,MAAM,uBAAuB,GAAW,wBAAwB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,mCAAmC;IAK9C;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAU;IACd,qDAAqD;IACrD,MAAM,CAAS;IACf,0FAA0F;IAC1F,MAAM,CAAS;IACf,wFAAwF;IACxF,WAAW,CAAS;IACpB,qDAAqD;IACrD,MAAM,GAAkD,EAAE,CAAC;IAC3D,oEAAoE;IACpE,UAAU,CAA8B;IACxC,+EAA+E;IAC/E,MAAM,CAA2B;IACjC,sEAAsE;IACtE,KAAK,CAAwB;IAC7B,iGAAiG;IACjG,aAAa,CAAU;IAEvB;;;OAGG;IACH,YACE,GAAoE;QAEpE,0EAA0E;QAC1E,MAAM,aAAa,GAAW,GAAG,EAAE,aAAa,IAAI,IAAA,8CAAiC,GAAE,CAAC;QAExF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EAAE,4BAA4B,EAAE,aAAa,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAEhE,sCAAsC;QACtC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,6CAA6C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,EACrF,aAAa,CACd,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,IACE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACpG,CAAC;YACD,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,0DAA0D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,EAClG,aAAa,CACd,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACnE,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EAAE,4BAA4B,KAAK,GAAG,EAAE,aAAa,CACpE,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,wDAAwD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EACnF,aAAa,CACd,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,MAAM,MAAM,GAAiD,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAE9E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,SAAS,EAAE,KAAK,CAA0C,EAAQ,EAAE;YACpG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,mDAAmD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,EAC1F,aAAa,CACd,CAAC;YACJ,CAAC;YAED,IACE,CAAC,KAAK;gBACN,CAAC,MAAM,CAAC,MAAM,CAAC,kDAAuB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5D,KAAK,CAAC,IAAI,KAAK,kDAAuB,CAAC,QAAQ,EAC/C,CAAC;gBACD,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EACd,UAAU,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,GAAG,EAC3F,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,yFAAyF;QACzF,MAAM,KAAK,GAAyB,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;QAE3E,IACE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACjF,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,EACzG,CAAC;YACD,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EAAE,kFAAkF,KAAK,GAAG,EAC1G,aAAa,CACd,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YACpE,MAAM,mCAAmC,CAAC,OAAO,CAC/C,cAAc,EAAE,mEAAmE,KAAK,GAAG,EAAE,aAAa,CAC3G,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,yDAAyD;QACzD,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,WAAW,CAAC,IAAY;QAC7B,OAAO,OAAO,IAAI,KAAK,QAAQ;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAC,OAAO,CAAC,SAAiB,EAAE,MAAc,EAAE,aAAqB;QAC7E,OAAO,IAAI,gCAAU,CAAC;YACpB,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,gDAAgD,MAAM,EAAE;YACjE,iBAAiB,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;CACF;AA1JD,kFA0JC;AAGwC,sEAAuB"}

package/build/_models/interfaces/operation-authz-result.interface.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Outcome of an operation authorization check; `allowed: false` always carries a code and a status.
+ *
+ * @example
+ * ```ts
+ * const result: DyFM_OperationAuthz_Result = DyFM_OperationAuthz_Util.check(operation, ctx);
+ * if (!result.allowed) {
+ *   res.status(result.status).send(result.errorCode);
+ * }
+ * ```
+ */
+export interface DyFM_OperationAuthz_Result {
+    allowed: boolean;
+    /** Stable error code of the denial (`DyFM-OPZ-*`). */
+    errorCode?: string;
+    /** HTTP-equivalent status of the denial: 401 (not authenticated) or 403 (not permitted). */
+    status?: 401 | 403;
+    /** Human-readable reason of the denial. */
+    reason?: string;
+    /** Set when the call is allowed only through the legacy, scope-less API key path (D-6). */
+    warning?: 'legacy-api-key';
+}
+//# sourceMappingURL=operation-authz-result.interface.d.ts.map

package/build/_models/interfaces/operation-authz-result.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-authz-result.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz-result.interface.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B"}

package/build/_models/interfaces/operation-authz-result.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=operation-authz-result.interface.js.map

package/build/_models/interfaces/operation-authz-result.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-authz-result.interface.js","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz-result.interface.ts"],"names":[],"mappings":""}

package/build/_models/interfaces/operation-authz.interface.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Declarative authorization of an operation, checked by `DyFM_OperationAuthz_Util` in the same way on
+ * every transport (REST, MCP, CLI).
+ *
+ * @example
+ * ```ts
+ * const authz: DyFM_Operation_Authz = {
+ *   ownership: 'userId',
+ *   apiKeyScope: 'task:write',
+ * };
+ * ```
+ */
+export interface DyFM_Operation_Authz {
+    /** The caller must be authenticated (default: `true` — an operation is public only when stated). */
+    issuerRequired?: boolean;
+    /**
+     * Field name on the target entity that holds its owner's `clientUserId` (e.g. `userId`).
+     * When set, the entity may only be touched by its owner. The owner is compared with
+     * `ctx.clientUserId`, never with `ctx.issuer` (`fdp-issuer-is-account-id`).
+     */
+    ownership?: string;
+    /**
+     * Scope an API key must grant to call the operation (e.g. `task:write`).
+     * A scoped API key can not call an operation that declares no scope.
+     */
+    apiKeyScope?: string;
+}
+//# sourceMappingURL=operation-authz.interface.d.ts.map

package/build/_models/interfaces/operation-authz.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-authz.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz.interface.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,oGAAoG;IACpG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/build/_models/interfaces/operation-authz.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=operation-authz.interface.js.map

package/build/_models/interfaces/operation-authz.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-authz.interface.js","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz.interface.ts"],"names":[],"mappings":""}

package/build/index.d.ts

@@ -19,6 +19,7 @@ export * from './_collections/utils/string-case.util';
 export * from './_collections/utils/time.util';
 export * from './_collections/utils/type-cloning-facility.util';
 export * from './_collections/utils/utilities.util';
+export * from './_collections/utils/operation-authz.util';
 export * from './_collections/utils/uuid.util';
 export * from './_collections/utils/math/box-bounds.util';
 export * from './_collections/utils/math/math.util';
@@ -34,6 +35,7 @@ export * from './_enums/environment-flag.enum';
 export * from './_enums/error-level.enum';
 export * from './_enums/error-status.enum';
 export * from './_enums/log-style.enum';
+export * from './_enums/operation-auth.type-enum';
 export * from './_enums/server-connection-status.enum';
 export * from './_enums/http/http-call-type.enum';
 export * from './_enums/http/http-event-type.enum';
@@ -44,6 +46,7 @@ export * from './_enums/time/relative-date.enum';
 export * from './_models/control-models/data-model-params.control-model';
 export * from './_models/control-models/data-property-params.control-model';
 export * from './_models/control-models/error.control-model';
+export * from './_models/control-models/operation-context.control-model';
 export * from './_models/control-models/operation-settings.control-model';
 export * from './_models/control-models/poll.control-model';
 export * from './_models/control-models/range-value.control-model';
@@ -56,6 +59,8 @@ export * from './_models/data-models/errors.data-model';
 export * from './_models/data-models/metadata.data-model';
 export * from './_models/interfaces/box-bounds.interface';
 export * from './_models/interfaces/error-defaults.interface';
+export * from './_models/interfaces/operation-authz-result.interface';
+export * from './_models/interfaces/operation-authz.interface';
 export * from './_models/interfaces/operation-exposure.interface';
 export * from './_models/interfaces/operation-input-settings.interface';
 export * from './_models/interfaces/paged.interface';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AAGrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAG/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAI/D,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AAGvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AAGtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AAKjD,cAAc,0DAA0D,CAAC;AACzE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AAGtF,cAAc,iEAAiE,CAAC;AAChF,cAAc,0DAA0D,CAAC;AACzE,cAAc,wDAAwD,CAAC;AAGvE,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAG1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mDAAmD,CAAC;AAClE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wDAAwD,CAAC;AACvE,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gEAAgE,CAAC;AAC/E,cAAc,4DAA4D,CAAC;AAG3E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AAGrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AACpD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gCAAgC,CAAC;AAG/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAI/D,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,wCAAwC,CAAC;AAGvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AAGtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AAKjD,cAAc,0DAA0D,CAAC;AACzE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0DAA0D,CAAC;AACzE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AAGtF,cAAc,iEAAiE,CAAC;AAChF,cAAc,0DAA0D,CAAC;AACzE,cAAc,wDAAwD,CAAC;AAGvE,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAG1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uDAAuD,CAAC;AACtE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,mDAAmD,CAAC;AAClE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wDAAwD,CAAC;AACvE,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gEAAgE,CAAC;AAC/E,cAAc,4DAA4D,CAAC;AAG3E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC"}

package/build/index.js

@@ -25,6 +25,7 @@ tslib_1.__exportStar(require("./_collections/utils/string-case.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/time.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/type-cloning-facility.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/utilities.util"), exports);
+tslib_1.__exportStar(require("./_collections/utils/operation-authz.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/uuid.util"), exports);
 // collections/utils/MATH
 tslib_1.__exportStar(require("./_collections/utils/math/box-bounds.util"), exports);
@@ -43,6 +44,7 @@ tslib_1.__exportStar(require("./_enums/environment-flag.enum"), exports);
 tslib_1.__exportStar(require("./_enums/error-level.enum"), exports);
 tslib_1.__exportStar(require("./_enums/error-status.enum"), exports);
 tslib_1.__exportStar(require("./_enums/log-style.enum"), exports);
+tslib_1.__exportStar(require("./_enums/operation-auth.type-enum"), exports);
 tslib_1.__exportStar(require("./_enums/server-connection-status.enum"), exports);
 // enums/HTTP
 tslib_1.__exportStar(require("./_enums/http/http-call-type.enum"), exports);
@@ -57,6 +59,7 @@ tslib_1.__exportStar(require("./_enums/time/relative-date.enum"), exports);
 tslib_1.__exportStar(require("./_models/control-models/data-model-params.control-model"), exports);
 tslib_1.__exportStar(require("./_models/control-models/data-property-params.control-model"), exports);
 tslib_1.__exportStar(require("./_models/control-models/error.control-model"), exports);
+tslib_1.__exportStar(require("./_models/control-models/operation-context.control-model"), exports);
 tslib_1.__exportStar(require("./_models/control-models/operation-settings.control-model"), exports);
 tslib_1.__exportStar(require("./_models/control-models/poll.control-model"), exports);
 tslib_1.__exportStar(require("./_models/control-models/range-value.control-model"), exports);
@@ -72,6 +75,8 @@ tslib_1.__exportStar(require("./_models/data-models/metadata.data-model"), expor
 // models/INTERFACES
 tslib_1.__exportStar(require("./_models/interfaces/box-bounds.interface"), exports);
 tslib_1.__exportStar(require("./_models/interfaces/error-defaults.interface"), exports);
+tslib_1.__exportStar(require("./_models/interfaces/operation-authz-result.interface"), exports);
+tslib_1.__exportStar(require("./_models/interfaces/operation-authz.interface"), exports);
 tslib_1.__exportStar(require("./_models/interfaces/operation-exposure.interface"), exports);
 tslib_1.__exportStar(require("./_models/interfaces/operation-input-settings.interface"), exports);
 tslib_1.__exportStar(require("./_models/interfaces/paged.interface"), exports);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,cAAc;AACd,wBAAwB;AACxB,oFAA0D;AAC1D,wFAA8D;AAC9D,yFAA+D;AAC/D,iFAAuD;AACvD,+EAAqD;AAErD,oBAAoB;AACpB,0EAAgD;AAChD,0EAAgD;AAChD,yEAA+C;AAC/C,0FAAgE;AAChE,sFAA4D;AAC5D,wEAA8C;AAC9C,+EAAqD;AACrD,gFAAsD;AACtD,2EAAiD;AACjD,gFAAsD;AACtD,0EAAgD;AAChD,2EAAiD;AACjD,gFAAsD;AACtD,yEAA+C;AAC/C,0FAAgE;AAChE,8EAAoD;AACpD,yEAA+C;AAE/C,yBAAyB;AACzB,oFAA0D;AAC1D,8EAAoD;AACpD,gFAAsD;AACtD,sFAA4D;AAC5D,iFAAuD;AAEvD,2BAA2B;AAC3B,yFAA+D;AAC/D,gFAAsD;AACtD,yFAA+D;AAG/D,QAAQ;AACR,4EAAkD;AAClD,wEAA8C;AAC9C,yEAA+C;AAC/C,oEAA0C;AAC1C,qEAA2C;AAC3C,kEAAwC;AACxC,iFAAuD;AAEvD,aAAa;AACb,4EAAkD;AAClD,6EAAmD;AACnD,gFAAsD;AAEtD,aAAa;AACb,yEAA+C;AAC/C,mEAAyC;AACzC,2EAAiD;AAGjD,SAAS;AACT,wBAAwB;AACxB,mGAAyE;AACzE,sGAA4E;AAC5E,uFAA6D;AAC7D,oGAA0E;AAC1E,sFAA4D;AAC5D,6FAAmE;AACnE,+FAAqE;AACrE,gHAAsF;AAEtF,6BAA6B;AAC7B,0GAAgF;AAChF,mGAAyE;AACzE,iGAAuE;AAEvE,qBAAqB;AACrB,kFAAwD;AACxD,oFAA0D;AAE1D,oBAAoB;AACpB,oFAA0D;AAC1D,wFAA8D;AAC9D,4FAAkE;AAClE,kGAAwE;AACxE,+EAAqD;AACrD,uFAA6D;AAC7D,wFAA8D;AAC9D,sFAA4D;AAC5D,uFAA6D;AAC7D,iGAAuE;AACvE,iFAAuD;AAEvD,gCAAgC;AAChC,yGAA+E;AAC/E,qGAA2E;AAE3E,eAAe;AACf,yEAA+C;AAC/C,uEAA6C;AAC7C,yEAA+C;AAC/C,uEAA6C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,cAAc;AACd,wBAAwB;AACxB,oFAA0D;AAC1D,wFAA8D;AAC9D,yFAA+D;AAC/D,iFAAuD;AACvD,+EAAqD;AAErD,oBAAoB;AACpB,0EAAgD;AAChD,0EAAgD;AAChD,yEAA+C;AAC/C,0FAAgE;AAChE,sFAA4D;AAC5D,wEAA8C;AAC9C,+EAAqD;AACrD,gFAAsD;AACtD,2EAAiD;AACjD,gFAAsD;AACtD,0EAAgD;AAChD,2EAAiD;AACjD,gFAAsD;AACtD,yEAA+C;AAC/C,0FAAgE;AAChE,8EAAoD;AACpD,oFAA0D;AAC1D,yEAA+C;AAE/C,yBAAyB;AACzB,oFAA0D;AAC1D,8EAAoD;AACpD,gFAAsD;AACtD,sFAA4D;AAC5D,iFAAuD;AAEvD,2BAA2B;AAC3B,yFAA+D;AAC/D,gFAAsD;AACtD,yFAA+D;AAG/D,QAAQ;AACR,4EAAkD;AAClD,wEAA8C;AAC9C,yEAA+C;AAC/C,oEAA0C;AAC1C,qEAA2C;AAC3C,kEAAwC;AACxC,4EAAkD;AAClD,iFAAuD;AAEvD,aAAa;AACb,4EAAkD;AAClD,6EAAmD;AACnD,gFAAsD;AAEtD,aAAa;AACb,yEAA+C;AAC/C,mEAAyC;AACzC,2EAAiD;AAGjD,SAAS;AACT,wBAAwB;AACxB,mGAAyE;AACzE,sGAA4E;AAC5E,uFAA6D;AAC7D,mGAAyE;AACzE,oGAA0E;AAC1E,sFAA4D;AAC5D,6FAAmE;AACnE,+FAAqE;AACrE,gHAAsF;AAEtF,6BAA6B;AAC7B,0GAAgF;AAChF,mGAAyE;AACzE,iGAAuE;AAEvE,qBAAqB;AACrB,kFAAwD;AACxD,oFAA0D;AAE1D,oBAAoB;AACpB,oFAA0D;AAC1D,wFAA8D;AAC9D,gGAAsE;AACtE,yFAA+D;AAC/D,4FAAkE;AAClE,kGAAwE;AACxE,+EAAqD;AACrD,uFAA6D;AAC7D,wFAA8D;AAC9D,sFAA4D;AAC5D,uFAA6D;AAC7D,iGAAuE;AACvE,iFAAuD;AAEvD,gCAAgC;AAChC,yGAA+E;AAC/E,qGAA2E;AAE3E,eAAe;AACf,yEAA+C;AAC/C,uEAA6C;AAC7C,yEAA+C;AAC/C,uEAA6C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/fsm-dynamo",
-  "version": "1.20.57",
+  "version": "1.20.59",
   "description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
   "DyBu_settings": {
     "packageType": "full-stack-package",