@futdevpro/fsm-dynamo 1.20.67 → 1.20.69

package/build/_collections/utils/operation-authz.util.d.ts

@@ -1,6 +1,17 @@
 import { DyFM_OperationContext_ControlModel } from '../../_models/control-models/operation-context.control-model';
 import { DyFM_OperationSettings_ControlModel } from '../../_models/control-models/operation-settings.control-model';
 import { DyFM_OperationAuthz_Result } from '../../_models/interfaces/operation-authz-result.interface';
+/**
+ * The scope that grants EVERY operation (owner decision D-9, 2026-09-18: "legyen all scope").
+ *
+ * ⚠️ **What it means, stated plainly:** a key holding this scope passes every scope check — including the
+ * checks of operations that DO NOT EXIST YET. A capability added next month is granted to it automatically,
+ * with nobody re-approving. That is the deliberate trade of this decision: one token instead of a list.
+ *
+ * ⛔ It can not collide with a real scope: an operation scope always names a domain and an action
+ * (`note:read`), so no declared `apiKeyScope` can ever be this token.
+ */
+export declare const DyFM_operationAllScope: string;
 /**
  * Transport-independent authorization checks of an operation call (HP-DOPL MP-1.4).
  *
@@ -37,6 +48,13 @@ export declare class DyFM_OperationAuthz_Util {
     /** Same as `checkOwnership`, but throws a coded `DyFM_Error` (with `status`) on denial. */
     static assertOwnership(operation: DyFM_OperationSettings_ControlModel<unknown, unknown[], unknown>, ctx: DyFM_OperationContext_ControlModel, target: object): DyFM_OperationAuthz_Result;
     /** Builds a denial result. */
+    /**
+     * Whether a key's scope list covers the required scope — either exactly, or through the all-scope (D-9).
+     *
+     * @param scopes - the scopes the key carries
+     * @param requiredScope - the scope the operation declares
+     */
+    static grantsScope(scopes: string[] | undefined, requiredScope: string): boolean;
     private static deny;
     /** Converts a denial into a thrown `DyFM_Error`; the identity is logged by requestId only. */
     private static throwIfDenied;

package/build/_collections/utils/operation-authz.util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IA8C7B;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAM7B;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IA6B7B,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAM7B,8BAA8B;IAC9B,OAAO,CAAC,MAAM,CAAC,IAAI;IAInB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,aAAa;CAoB7B"}
+{"version":3,"file":"operation-authz.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EACL,mCAAmC,EACpC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAGvG;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAY,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAkD7B;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,GACtC,0BAA0B;IAM7B;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAgC7B,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAAS,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAC3E,GAAG,EAAE,kCAAkC,EACvC,MAAM,EAAE,MAAM,GACb,0BAA0B;IAM7B,8BAA8B;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAMhF,OAAO,CAAC,MAAM,CAAC,IAAI;IAQnB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,aAAa;CAsB7B"}

package/build/_collections/utils/operation-authz.util.js

@@ -1,9 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyFM_OperationAuthz_Util = void 0;
+exports.DyFM_OperationAuthz_Util = exports.DyFM_operationAllScope = void 0;
 const operation_auth_type_enum_1 = require("../../_enums/operation-auth.type-enum");
 const operation_context_control_model_1 = require("../../_models/control-models/operation-context.control-model");
 const error_control_model_1 = require("../../_models/control-models/error.control-model");
+/**
+ * The scope that grants EVERY operation (owner decision D-9, 2026-09-18: "legyen all scope").
+ *
+ * ⚠️ **What it means, stated plainly:** a key holding this scope passes every scope check — including the
+ * checks of operations that DO NOT EXIST YET. A capability added next month is granted to it automatically,
+ * with nobody re-approving. That is the deliberate trade of this decision: one token instead of a list.
+ *
+ * ⛔ It can not collide with a real scope: an operation scope always names a domain and an action
+ * (`note:read`), so no declared `apiKeyScope` can ever be this token.
+ */
+exports.DyFM_operationAllScope = '*';
 /**
  * Transport-independent authorization checks of an operation call (HP-DOPL MP-1.4).
  *
@@ -29,7 +40,7 @@ class DyFM_OperationAuthz_Util {
         const authKind = ctx?.authKind ?? operation_auth_type_enum_1.DyFM_OperationAuth_Type.none;
         // a missing identity is 401, the caller may retry with credentials
         if (issuerRequired && (authKind === operation_auth_type_enum_1.DyFM_OperationAuth_Type.none || !ctx?.issuer)) {
-            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-UNA', 401, `operation "${operation?.name}" requires an authenticated caller`);
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-UNA', 401, `operation "${operation?.name}" requires an authenticated caller`, 'This operation needs an authenticated caller — send an API key or a token.');
         }
         // scopes only restrict API keys; a token call is not scope-limited
         if (authKind !== operation_auth_type_enum_1.DyFM_OperationAuth_Type.apiKey) {
@@ -46,11 +57,12 @@ class DyFM_OperationAuthz_Util {
         }
         // least privilege: a scoped key can not reach a protected operation that belongs to no scope
         if (!requiredScope) {
-            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-NSC', 403, `operation "${operation?.name}" declares no apiKeyScope, a scoped API key can not call it`);
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-NSC', 403, `operation "${operation?.name}" declares no apiKeyScope, a scoped API key can not call it`, 'This operation can not be called with an API key. Call it with a user token.');
         }
-        // exact match only — no wildcard until it is an explicit decision
-        if (!(ctx.apiKeyScopes ?? []).includes(requiredScope)) {
-            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-SCP', 403, `API key lacks scope "${requiredScope}" for operation "${operation?.name}"`);
+        // the all-scope grants every operation (D-9); otherwise the match is EXACT — a scope is never a prefix
+        if (!DyFM_OperationAuthz_Util.grantsScope(ctx.apiKeyScopes, requiredScope)) {
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-SCP', 403, `API key lacks scope "${requiredScope}" for operation "${operation?.name}"`, `The API key is missing the "${requiredScope}" scope, which this operation needs. ` +
+                'Create a key that has it (an existing key\'s scopes can not be widened).');
         }
         return { allowed: true };
     }
@@ -75,12 +87,14 @@ class DyFM_OperationAuthz_Util {
         }
         // a declared ownership check without a caller identity must fail closed, not pass
         if (!ctx?.clientUserId) {
-            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `operation "${operation?.name}" requires the caller's clientUserId for the ownership check`);
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `operation "${operation?.name}" requires the caller's clientUserId for the ownership check`, 'This operation works on your own data, so it needs to know which user you are.');
         }
         const owner = target ? Reflect.get(target, ownershipField) : undefined;
         // strict equality: an entity without owner is not owned by anybody
         if (owner === undefined || owner === null || String(owner) !== ctx.clientUserId) {
-            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `caller does not own the target of operation "${operation?.name}" (field: ${ownershipField})`);
+            return DyFM_OperationAuthz_Util.deny('DyFM-OPZ-OWN', 403, `caller does not own the target of operation "${operation?.name}" (field: ${ownershipField})`, 
+            // ⛔ the owner and the field name stay inside: the caller only learns that it is not theirs
+            'This item belongs to somebody else.');
         }
         return { allowed: true };
     }
@@ -89,8 +103,20 @@ class DyFM_OperationAuthz_Util {
         return DyFM_OperationAuthz_Util.throwIfDenied(DyFM_OperationAuthz_Util.checkOwnership(operation, ctx, target), operation, ctx);
     }
     /** Builds a denial result. */
-    static deny(errorCode, status, reason) {
-        return { allowed: false, errorCode: errorCode, status: status, reason: reason };
+    /**
+     * Whether a key's scope list covers the required scope — either exactly, or through the all-scope (D-9).
+     *
+     * @param scopes - the scopes the key carries
+     * @param requiredScope - the scope the operation declares
+     */
+    static grantsScope(scopes, requiredScope) {
+        const held = scopes ?? [];
+        return held.includes(requiredScope) || held.includes(exports.DyFM_operationAllScope);
+    }
+    static deny(errorCode, status, reason, userMessage) {
+        return {
+            allowed: false, errorCode: errorCode, status: status, reason: reason, userMessage: userMessage,
+        };
     }
     /** Converts a denial into a thrown `DyFM_Error`; the identity is logged by requestId only. */
     static throwIfDenied(result, operation, ctx) {
@@ -101,6 +127,8 @@ class DyFM_OperationAuthz_Util {
             errorCode: result.errorCode,
             status: result.status,
             message: `Operation authorization failed: ${result.reason}`,
+            // ⛔ the internal `message` never reaches the caller — this is the text written FOR them
+            userMessage: result.userMessage,
             additionalContent: {
                 operation: operation?.name,
                 requestId: ctx?.requestId,

package/build/_collections/utils/operation-authz.util.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,CACvF,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4FAA4F;QAC5F,IAAI,oEAAkC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAuB,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;QAExE,mGAAmG;QACnG,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,6FAA6F;QAC7F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,6DAA6D,CAC3F,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtD,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,wBAAwB,aAAa,oBAAoB,SAAS,EAAE,IAAI,GAAG,CACjG,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAA2E,EAC3E,GAAuC;QAEvC,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,MAAM,cAAc,GAAuB,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC;YACvB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,8DAA8D,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;YAChF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,gDAAgD,SAAS,EAAE,IAAI,aAAa,cAAc,GAAG,CAC9F,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,8BAA8B;IACtB,MAAM,CAAC,IAAI,CAAC,SAAiB,EAAE,MAAiB,EAAE,MAAc;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClF,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,aAAa,CAC1B,MAAkC,EAClC,SAA2E,EAC3E,GAAuC;QAEvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,gCAAU,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,EAAE;YAC3D,iBAAiB,EAAE;gBACjB,SAAS,EAAE,SAAS,EAAE,IAAI;gBAC1B,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAhJD,4DAgJC"}
+{"version":3,"file":"operation-authz.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/operation-authz.util.ts"],"names":[],"mappings":";;;AAAA,oFAAgF;AAChF,kHAEsE;AACtE,0FAA8E;AAO9E;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAW,GAAG,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IACnC;;;;OAIG;IACH,MAAM,CAAC,KAAK,CACV,SAA2E,EAC3E,GAAuC;QAEvC,MAAM,cAAc,GAAY,SAAS,EAAE,KAAK,EAAE,cAAc,KAAK,KAAK,CAAC;QAC3E,MAAM,QAAQ,GAA4B,GAAG,EAAE,QAAQ,IAAI,kDAAuB,CAAC,IAAI,CAAC;QAExF,mEAAmE;QACnE,IAAI,cAAc,IAAI,CAAC,QAAQ,KAAK,kDAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,IAAI,oCAAoC,EACtF,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,QAAQ,KAAK,kDAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,4FAA4F;QAC5F,IAAI,oEAAkC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAuB,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;QAExE,mGAAmG;QACnG,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,6FAA6F;QAC7F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,6DAA6D,EAC1F,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,uGAAuG;QACvG,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YAC3E,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EAAE,wBAAwB,aAAa,oBAAoB,SAAS,EAAE,IAAI,GAAG,EAChG,+BAA+B,aAAa,uCAAuC;gBACnF,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,SAA2E,EAC3E,GAAuC;QAEvC,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CACnB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,MAAM,cAAc,GAAuB,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC;YACvB,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,cAAc,SAAS,EAAE,IAAI,8DAA8D,EAC3F,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;YAChF,OAAO,wBAAwB,CAAC,IAAI,CAClC,cAAc,EAAE,GAAG,EACnB,gDAAgD,SAAS,EAAE,IAAI,aAAa,cAAc,GAAG;YAC7F,2FAA2F;YAC3F,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,eAAe,CACpB,SAA2E,EAC3E,GAAuC,EACvC,MAAc;QAEd,OAAO,wBAAwB,CAAC,aAAa,CAC3C,wBAAwB,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,MAA4B,EAAE,aAAqB;QACpE,MAAM,IAAI,GAAa,MAAM,IAAI,EAAE,CAAC;QAEpC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAAsB,CAAC,CAAC;IAC/E,CAAC;IAEO,MAAM,CAAC,IAAI,CACjB,SAAiB,EAAE,MAAiB,EAAE,MAAc,EAAE,WAAmB;QAEzE,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW;SAC/F,CAAC;IACJ,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,aAAa,CAC1B,MAAkC,EAClC,SAA2E,EAC3E,GAAuC;QAEvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,gCAAU,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,EAAE;YAC3D,wFAAwF;YACxF,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,iBAAiB,EAAE;gBACjB,SAAS,EAAE,SAAS,EAAE,IAAI;gBAC1B,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAzKD,4DAyKC"}

package/build/_models/interfaces/operation-authz-result.interface.d.ts

@@ -17,6 +17,13 @@ export interface DyFM_OperationAuthz_Result {
     status?: 401 | 403;
     /** Human-readable reason of the denial. */
     reason?: string;
+    /**
+     * What the CALLER is told (HP-DOPL MP-5 closing review). The internal `reason` never leaves the server, so
+     * without this the caller only sees a generic text with the error code — and a key-based integration would
+     * not learn the ONE actionable fact: which scope it is missing. The scope name is part of the operation's
+     * own contract, not a secret (this is what `WWW-Authenticate: scope="…"` does).
+     */
+    userMessage?: string;
     /** Set when the call is allowed only through the legacy, scope-less API key path (D-6). */
     warning?: 'legacy-api-key';
 }

package/build/_models/interfaces/operation-authz-result.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-authz-result.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz-result.interface.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B"}
+{"version":3,"file":"operation-authz-result.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/operation-authz-result.interface.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/fsm-dynamo",
-  "version": "1.20.67",
+  "version": "1.20.69",
   "description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
   "DyBu_settings": {
     "packageType": "full-stack-package",