@sapl/nestjs 1.0.0

package/dist/PostEnforceAspect.d.ts

@@ -0,0 +1,15 @@
+import { LazyDecorator, WrapParams } from '@toss/nestjs-aop';
+import { ClsService } from 'nestjs-cls';
+import { EnforceOptions } from './EnforceOptions';
+import { PdpService } from './pdp.service';
+import { ConstraintEnforcementService } from './constraints/ConstraintEnforcementService';
+export declare class PostEnforceAspect implements LazyDecorator<any, EnforceOptions> {
+    private readonly pdpService;
+    private readonly cls;
+    private readonly constraintService;
+    private readonly logger;
+    constructor(pdpService: PdpService, cls: ClsService, constraintService: ConstraintEnforcementService);
+    wrap({ method, metadata, methodName, instance }: WrapParams<any, EnforceOptions>): (...args: any[]) => Promise<any>;
+    private handlePermit;
+}
+//# sourceMappingURL=PostEnforceAspect.d.ts.map

package/dist/PostEnforceAspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostEnforceAspect.d.ts","sourceRoot":"","sources":["../lib/PostEnforceAspect.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F,qBACa,iBAAkB,YAAW,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC;IAIxE,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAG1C,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,iBAAiB,EAAE,4BAA4B;IAGlE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,IAIhE,GAAG,MAAM,GAAG,EAAE;IAqB9B,OAAO,CAAC,YAAY;CA8BrB"}

package/dist/PostEnforceAspect.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var PostEnforceAspect_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostEnforceAspect = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+const nestjs_cls_1 = require("nestjs-cls");
+const PostEnforce_1 = require("./PostEnforce");
+const pdp_service_1 = require("./pdp.service");
+const SubscriptionBuilder_1 = require("./SubscriptionBuilder");
+const ConstraintEnforcementService_1 = require("./constraints/ConstraintEnforcementService");
+const enforcement_utils_1 = require("./enforcement-utils");
+let PostEnforceAspect = PostEnforceAspect_1 = class PostEnforceAspect {
+    constructor(pdpService, cls, constraintService) {
+        this.pdpService = pdpService;
+        this.cls = cls;
+        this.constraintService = constraintService;
+        this.logger = new common_1.Logger(PostEnforceAspect_1.name);
+    }
+    wrap({ method, metadata, methodName, instance }) {
+        const aspect = this;
+        const className = instance.constructor.name;
+        return async (...args) => {
+            const handlerResult = await method(...args);
+            const ctx = (0, SubscriptionBuilder_1.buildContext)(aspect.cls, methodName, className, args);
+            ctx.returnValue = handlerResult;
+            const subscription = (0, SubscriptionBuilder_1.buildSubscriptionFromContext)(metadata, ctx);
+            const { secrets, ...safeForLog } = subscription;
+            aspect.logger.debug(`Subscription: ${JSON.stringify(safeForLog)}`);
+            const decision = await aspect.pdpService.decideOnce(subscription);
+            aspect.logger.debug(`Decision: ${JSON.stringify(decision)}`);
+            if (decision.decision === 'PERMIT') {
+                return aspect.handlePermit(decision, metadata, ctx, handlerResult);
+            }
+            return (0, enforcement_utils_1.handleDeny)(aspect.logger, aspect.constraintService, decision, metadata, ctx);
+        };
+    }
+    handlePermit(decision, options, ctx, handlerResult) {
+        let bundle;
+        try {
+            bundle = this.constraintService.postEnforceBundleFor(decision);
+        }
+        catch (error) {
+            this.logger.warn(`Obligation handling failed on PERMIT: ${error}`);
+            return (0, enforcement_utils_1.applyDeny)(options, ctx, decision);
+        }
+        try {
+            bundle.handleOnDecisionConstraints();
+            return bundle.handleAllOnNextConstraints(handlerResult);
+        }
+        catch (error) {
+            const asError = error instanceof Error ? error : new Error(String(error));
+            let mappedError = asError;
+            try {
+                mappedError = bundle.handleAllOnErrorConstraints(asError);
+            }
+            catch (handlerError) {
+                this.logger.warn(`Error handler failed while handling obligation failure: ${handlerError}`);
+            }
+            this.logger.warn(`Obligation handling failed on PERMIT: ${mappedError}`);
+            return (0, enforcement_utils_1.applyDeny)(options, ctx, decision);
+        }
+    }
+};
+exports.PostEnforceAspect = PostEnforceAspect;
+exports.PostEnforceAspect = PostEnforceAspect = PostEnforceAspect_1 = __decorate([
+    (0, nestjs_aop_1.Aspect)(PostEnforce_1.POST_ENFORCE_SYMBOL),
+    __metadata("design:paramtypes", [pdp_service_1.PdpService,
+        nestjs_cls_1.ClsService,
+        ConstraintEnforcementService_1.ConstraintEnforcementService])
+], PostEnforceAspect);
+//# sourceMappingURL=PostEnforceAspect.js.map

package/dist/PostEnforceAspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostEnforceAspect.js","sourceRoot":"","sources":["../lib/PostEnforceAspect.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAwC;AACxC,iDAAqE;AACrE,2CAAwC;AACxC,+CAAoD;AAEpD,+CAA2C;AAC3C,+DAAmF;AAEnF,6FAA0F;AAC1F,2DAA4D;AAGrD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAG5B,YACmB,UAAsB,EACtB,GAAe,EACf,iBAA+C;QAF/C,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,sBAAiB,GAAjB,iBAAiB,CAA8B;QALjD,WAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAM1D,CAAC;IAEJ,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAmC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAE5C,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;YAC9B,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAE5C,MAAM,GAAG,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAClE,GAAG,CAAC,WAAW,GAAG,aAAa,CAAC;YAEhC,MAAM,YAAY,GAAG,IAAA,kDAA4B,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAEnE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAE7D,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnC,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,IAAA,8BAAU,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,QAAa,EACb,OAAuB,EACvB,GAAwB,EACxB,aAAkB;QAElB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,IAAA,6BAAS,EAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,IAAI,WAAW,GAAU,OAAO,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,YAAY,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;YACzE,OAAO,IAAA,6BAAS,EAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CAEF,CAAA;AAhEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAM,EAAC,iCAAmB,CAAC;qCAKK,wBAAU;QACjB,uBAAU;QACI,2DAA4B;GANvD,iBAAiB,CAgE7B"}

package/dist/PreEnforce.d.ts

@@ -0,0 +1,21 @@
+import { EnforceOptions } from './EnforceOptions';
+export declare const PRE_ENFORCE_SYMBOL: unique symbol;
+/**
+ * Decorator that marks a method for SAPL pre-enforcement.
+ *
+ * Works on any injectable class method (controllers, services, etc.) via
+ * AOP aspects. The actual authorization check is performed by
+ * PreEnforceAspect, which builds an authorization subscription, calls
+ * the PDP, and blocks the invocation if the decision is not PERMIT.
+ *
+ * Because the aspect runs before the method, the method only executes
+ * on PERMIT. Use this for methods with side effects that should not
+ * execute when access is denied.
+ *
+ * Example:
+ *   @PreEnforce({ action: 'read', resource: 'exportData' })
+ *   @Get('exportData/:id')
+ *   async getExportData(@Param('id') id: string) { ... }
+ */
+export declare const PreEnforce: (options?: EnforceOptions) => MethodDecorator;
+//# sourceMappingURL=PreEnforce.d.ts.map

package/dist/PreEnforce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreEnforce.d.ts","sourceRoot":"","sources":["../lib/PreEnforce.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,eAAO,MAAM,kBAAkB,eAA6B,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,UAAS,cAAmB,oBACT,CAAC"}

package/dist/PreEnforce.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreEnforce = exports.PRE_ENFORCE_SYMBOL = void 0;
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+exports.PRE_ENFORCE_SYMBOL = Symbol('sapl:pre-enforce');
+/**
+ * Decorator that marks a method for SAPL pre-enforcement.
+ *
+ * Works on any injectable class method (controllers, services, etc.) via
+ * AOP aspects. The actual authorization check is performed by
+ * PreEnforceAspect, which builds an authorization subscription, calls
+ * the PDP, and blocks the invocation if the decision is not PERMIT.
+ *
+ * Because the aspect runs before the method, the method only executes
+ * on PERMIT. Use this for methods with side effects that should not
+ * execute when access is denied.
+ *
+ * Example:
+ *   @PreEnforce({ action: 'read', resource: 'exportData' })
+ *   @Get('exportData/:id')
+ *   async getExportData(@Param('id') id: string) { ... }
+ */
+const PreEnforce = (options = {}) => (0, nestjs_aop_1.createDecorator)(exports.PRE_ENFORCE_SYMBOL, options);
+exports.PreEnforce = PreEnforce;
+//# sourceMappingURL=PreEnforce.js.map

package/dist/PreEnforce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreEnforce.js","sourceRoot":"","sources":["../lib/PreEnforce.ts"],"names":[],"mappings":";;;AAAA,iDAAmD;AAGtC,QAAA,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,UAAU,GAAG,CAAC,UAA0B,EAAE,EAAE,EAAE,CACzD,IAAA,4BAAe,EAAC,0BAAkB,EAAE,OAAO,CAAC,CAAC;AADlC,QAAA,UAAU,cACwB"}

package/dist/PreEnforceAspect.d.ts

@@ -0,0 +1,15 @@
+import { LazyDecorator, WrapParams } from '@toss/nestjs-aop';
+import { ClsService } from 'nestjs-cls';
+import { EnforceOptions } from './EnforceOptions';
+import { PdpService } from './pdp.service';
+import { ConstraintEnforcementService } from './constraints/ConstraintEnforcementService';
+export declare class PreEnforceAspect implements LazyDecorator<any, EnforceOptions> {
+    private readonly pdpService;
+    private readonly cls;
+    private readonly constraintService;
+    private readonly logger;
+    constructor(pdpService: PdpService, cls: ClsService, constraintService: ConstraintEnforcementService);
+    wrap({ method, metadata, methodName, instance }: WrapParams<any, EnforceOptions>): (...args: any[]) => Promise<any>;
+    private handlePermit;
+}
+//# sourceMappingURL=PreEnforceAspect.d.ts.map

package/dist/PreEnforceAspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreEnforceAspect.d.ts","sourceRoot":"","sources":["../lib/PreEnforceAspect.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F,qBACa,gBAAiB,YAAW,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC;IAIvE,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAGzC,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,iBAAiB,EAAE,4BAA4B;IAGlE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,IAIhE,GAAG,MAAM,GAAG,EAAE;IAiB9B,OAAO,CAAC,YAAY;CAqErB"}

package/dist/PreEnforceAspect.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var PreEnforceAspect_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreEnforceAspect = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+const nestjs_cls_1 = require("nestjs-cls");
+const PreEnforce_1 = require("./PreEnforce");
+const pdp_service_1 = require("./pdp.service");
+const SubscriptionBuilder_1 = require("./SubscriptionBuilder");
+const ConstraintEnforcementService_1 = require("./constraints/ConstraintEnforcementService");
+const enforcement_utils_1 = require("./enforcement-utils");
+let PreEnforceAspect = PreEnforceAspect_1 = class PreEnforceAspect {
+    constructor(pdpService, cls, constraintService) {
+        this.pdpService = pdpService;
+        this.cls = cls;
+        this.constraintService = constraintService;
+        this.logger = new common_1.Logger(PreEnforceAspect_1.name);
+    }
+    wrap({ method, metadata, methodName, instance }) {
+        const aspect = this;
+        const className = instance.constructor.name;
+        return async (...args) => {
+            const ctx = (0, SubscriptionBuilder_1.buildContext)(aspect.cls, methodName, className, args);
+            const subscription = (0, SubscriptionBuilder_1.buildSubscriptionFromContext)(metadata, ctx);
+            const { secrets, ...safeForLog } = subscription;
+            aspect.logger.debug(`Subscription: ${JSON.stringify(safeForLog)}`);
+            const decision = await aspect.pdpService.decideOnce(subscription);
+            aspect.logger.debug(`Decision: ${JSON.stringify(decision)}`);
+            if (decision.decision === 'PERMIT') {
+                return aspect.handlePermit(decision, metadata, ctx, method, args, methodName, className);
+            }
+            return (0, enforcement_utils_1.handleDeny)(aspect.logger, aspect.constraintService, decision, metadata, ctx);
+        };
+    }
+    handlePermit(decision, options, ctx, method, args, methodName, className) {
+        let bundle;
+        try {
+            bundle = this.constraintService.preEnforceBundleFor(decision);
+        }
+        catch (error) {
+            this.logger.warn(`Obligation handling failed on PERMIT: ${error}`);
+            return (0, enforcement_utils_1.applyDeny)(options, ctx, decision);
+        }
+        // Phase 1: pre-method obligation handlers -- failure denies access
+        const invocationContext = {
+            request: ctx.request,
+            args,
+            methodName,
+            className,
+        };
+        try {
+            bundle.handleOnDecisionConstraints();
+            bundle.handleMethodInvocationHandlers(invocationContext);
+        }
+        catch (error) {
+            this.logger.warn(`Obligation handling failed on PERMIT: ${error}`);
+            return (0, enforcement_utils_1.applyDeny)(options, ctx, decision);
+        }
+        // Phase 2: method execution -- errors propagate after error handler mapping
+        let result;
+        try {
+            result = method(...invocationContext.args);
+        }
+        catch (methodError) {
+            throw bundle.handleAllOnErrorConstraints(methodError instanceof Error ? methodError : new Error(String(methodError)));
+        }
+        // Phase 3: post-method obligation handlers -- failure denies access
+        if (result instanceof Promise) {
+            return result.then((value) => {
+                try {
+                    return bundle.handleAllOnNextConstraints(value);
+                }
+                catch (obligationError) {
+                    this.logger.warn(`Obligation handling failed on PERMIT: ${obligationError}`);
+                    return (0, enforcement_utils_1.applyDeny)(options, ctx, decision);
+                }
+            }, (methodError) => {
+                throw bundle.handleAllOnErrorConstraints(methodError instanceof Error ? methodError : new Error(String(methodError)));
+            });
+        }
+        try {
+            return bundle.handleAllOnNextConstraints(result);
+        }
+        catch (obligationError) {
+            this.logger.warn(`Obligation handling failed on PERMIT: ${obligationError}`);
+            return (0, enforcement_utils_1.applyDeny)(options, ctx, decision);
+        }
+    }
+};
+exports.PreEnforceAspect = PreEnforceAspect;
+exports.PreEnforceAspect = PreEnforceAspect = PreEnforceAspect_1 = __decorate([
+    (0, nestjs_aop_1.Aspect)(PreEnforce_1.PRE_ENFORCE_SYMBOL),
+    __metadata("design:paramtypes", [pdp_service_1.PdpService,
+        nestjs_cls_1.ClsService,
+        ConstraintEnforcementService_1.ConstraintEnforcementService])
+], PreEnforceAspect);
+//# sourceMappingURL=PreEnforceAspect.js.map

package/dist/PreEnforceAspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreEnforceAspect.js","sourceRoot":"","sources":["../lib/PreEnforceAspect.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAwC;AACxC,iDAAqE;AACrE,2CAAwC;AACxC,6CAAkD;AAGlD,+CAA2C;AAC3C,+DAAmF;AAEnF,6FAA0F;AAC1F,2DAA4D;AAGrD,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAG3B,YACmB,UAAsB,EACtB,GAAe,EACf,iBAA+C;QAF/C,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,sBAAiB,GAAjB,iBAAiB,CAA8B;QALjD,WAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAMzD,CAAC;IAEJ,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAmC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAE5C,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,IAAA,kDAA4B,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAEnE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAE7D,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnC,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC3F,CAAC;YAED,OAAO,IAAA,8BAAU,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,QAAa,EACb,OAAuB,EACvB,GAAwB,EACxB,MAA+B,EAC/B,IAAW,EACX,UAAkB,EAClB,SAAiB;QAEjB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,IAAA,6BAAS,EAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,mEAAmE;QACnE,MAAM,iBAAiB,GAA4B;YACjD,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI;YACJ,UAAU;YACV,SAAS;SACV,CAAC;QACF,IAAI,CAAC;YACH,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrC,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,IAAA,6BAAS,EAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,4EAA4E;QAC5E,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,2BAA2B,CACtC,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAC5E,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;gBACR,IAAI,CAAC;oBACH,OAAO,MAAM,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC;gBAAC,OAAO,eAAe,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,eAAe,EAAE,CAAC,CAAC;oBAC7E,OAAO,IAAA,6BAAS,EAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC,EACD,CAAC,WAAW,EAAE,EAAE;gBACd,MAAM,MAAM,CAAC,2BAA2B,CACtC,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAC5E,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,eAAe,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAA,6BAAS,EAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CAEF,CAAA;AAnGY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAM,EAAC,+BAAkB,CAAC;qCAKM,wBAAU;QACjB,uBAAU;QACI,2DAA4B;GANvD,gBAAgB,CAmG5B"}

package/dist/StreamingEnforceOptions.d.ts

@@ -0,0 +1,22 @@
+import { SubscriptionOptions } from './EnforceOptions';
+import { AuthorizationDecision } from './types';
+/**
+ * Restricted emitter passed to streaming callbacks. Only exposes `.next()` to
+ * prevent user code from interfering with the stream lifecycle (error/complete)
+ * which is managed by the enforcement aspect.
+ */
+export interface StreamEventEmitter {
+    next(value: any): void;
+}
+export type OnStreamDenyHandler = (decision: AuthorizationDecision, emitter: StreamEventEmitter) => void;
+export type OnStreamRecoverHandler = (decision: AuthorizationDecision, emitter: StreamEventEmitter) => void;
+export interface EnforceTillDeniedOptions extends SubscriptionOptions {
+    onStreamDeny?: OnStreamDenyHandler;
+}
+export interface EnforceDropWhileDeniedOptions extends SubscriptionOptions {
+}
+export interface EnforceRecoverableOptions extends SubscriptionOptions {
+    onStreamDeny?: OnStreamDenyHandler;
+    onStreamRecover?: OnStreamRecoverHandler;
+}
+//# sourceMappingURL=StreamingEnforceOptions.d.ts.map

package/dist/StreamingEnforceOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StreamingEnforceOptions.d.ts","sourceRoot":"","sources":["../lib/StreamingEnforceOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;AACzG,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAE5G,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,WAAW,6BAA8B,SAAQ,mBAAmB;CACzE;AAED,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C"}

package/dist/StreamingEnforceOptions.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=StreamingEnforceOptions.js.map

package/dist/StreamingEnforceOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StreamingEnforceOptions.js","sourceRoot":"","sources":["../lib/StreamingEnforceOptions.ts"],"names":[],"mappings":""}

package/dist/SubscriptionBuilder.d.ts

@@ -0,0 +1,17 @@
+import { ClsService } from 'nestjs-cls';
+import { SubscriptionContext } from './SubscriptionContext';
+import { SubscriptionOptions } from './EnforceOptions';
+import { AuthorizationSubscription } from './types';
+/**
+ * Build a SubscriptionContext from the current CLS request and method metadata.
+ */
+export declare function buildContext(cls: ClsService, methodName: string, className: string, args: any[]): SubscriptionContext;
+/**
+ * Build a complete SAPL authorization subscription from SubscriptionOptions
+ * and a pre-built SubscriptionContext.
+ *
+ * For each field: if the user provided a value (literal or callback), use it.
+ * Otherwise apply the sensible default.
+ */
+export declare function buildSubscriptionFromContext(options: SubscriptionOptions, ctx: SubscriptionContext): AuthorizationSubscription;
+//# sourceMappingURL=SubscriptionBuilder.d.ts.map

package/dist/SubscriptionBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriptionBuilder.d.ts","sourceRoot":"","sources":["../lib/SubscriptionBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAW,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAqDpD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,GAAG,EAAE,GACV,mBAAmB,CAWrB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,mBAAmB,GACvB,yBAAyB,CAY3B"}

package/dist/SubscriptionBuilder.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildContext = buildContext;
+exports.buildSubscriptionFromContext = buildSubscriptionFromContext;
+const nestjs_cls_1 = require("nestjs-cls");
+/**
+ * Resolve a SubscriptionField: if it's a function, call it with the context.
+ * Otherwise return it as a literal value.
+ */
+function resolve(field, ctx) {
+    return typeof field === 'function' ? field(ctx) : field;
+}
+/**
+ * Build the default subject: the decoded JWT claims from request.user,
+ * falling back to "anonymous" if no auth guard populated it.
+ */
+function defaultSubject(ctx) {
+    return ctx.request.user ?? 'anonymous';
+}
+/**
+ * Build the default action: HTTP method + controller/handler coordinates.
+ */
+function defaultAction(ctx) {
+    return {
+        method: ctx.request.method,
+        controller: ctx.controller,
+        handler: ctx.handler,
+    };
+}
+/**
+ * Build the default resource: route path pattern + resolved parameters.
+ */
+function defaultResource(ctx) {
+    return {
+        path: ctx.request.route?.path ?? ctx.request.url,
+        params: ctx.params,
+    };
+}
+/**
+ * Build the default environment: server-side request metadata only.
+ * Client-controlled headers (Date, X-Forwarded-For, X-Request-Id,
+ * X-Correlation-Id) are deliberately excluded because they can be forged.
+ * Use the environment callback in EnforceOptions to include them explicitly
+ * if needed.
+ */
+function defaultEnvironment(ctx) {
+    return {
+        ip: ctx.request.ip,
+        hostname: ctx.request.hostname,
+    };
+}
+/**
+ * Build a SubscriptionContext from the current CLS request and method metadata.
+ */
+function buildContext(cls, methodName, className, args) {
+    const request = cls.get(nestjs_cls_1.CLS_REQ) ?? {};
+    return {
+        request,
+        params: request.params ?? {},
+        query: request.query ?? {},
+        body: request.body,
+        handler: methodName,
+        controller: className,
+        args,
+    };
+}
+/**
+ * Build a complete SAPL authorization subscription from SubscriptionOptions
+ * and a pre-built SubscriptionContext.
+ *
+ * For each field: if the user provided a value (literal or callback), use it.
+ * Otherwise apply the sensible default.
+ */
+function buildSubscriptionFromContext(options, ctx) {
+    const subject = options.subject !== undefined ? resolve(options.subject, ctx) : defaultSubject(ctx);
+    const action = options.action !== undefined ? resolve(options.action, ctx) : defaultAction(ctx);
+    const resource = options.resource !== undefined ? resolve(options.resource, ctx) : defaultResource(ctx);
+    const environment = options.environment !== undefined ? resolve(options.environment, ctx) : defaultEnvironment(ctx);
+    const secrets = options.secrets !== undefined ? resolve(options.secrets, ctx) : undefined;
+    const subscription = { subject, action, resource, environment };
+    if (secrets !== undefined) {
+        subscription.secrets = secrets;
+    }
+    return subscription;
+}
+//# sourceMappingURL=SubscriptionBuilder.js.map

package/dist/SubscriptionBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriptionBuilder.js","sourceRoot":"","sources":["../lib/SubscriptionBuilder.ts"],"names":[],"mappings":";;AA2DA,oCAgBC;AASD,oEAeC;AAnGD,2CAAiD;AAKjD;;;GAGG;AACH,SAAS,OAAO,CAAC,KAAoC,EAAE,GAAwB;IAC7E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAwB;IAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAwB;IAC7C,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,GAAwB;IAC/C,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG;QAChD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAwB;IAClD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAC1B,GAAe,EACf,UAAkB,EAClB,SAAiB,EACjB,IAAW;IAEX,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,oBAAO,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,SAAS;QACrB,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC1C,OAA4B,EAC5B,GAAwB;IAExB,MAAM,OAAO,GAAO,OAAO,CAAC,OAAO,KAAS,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAK,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAChH,MAAM,MAAM,GAAQ,OAAO,CAAC,MAAM,KAAU,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAM,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAM,OAAO,CAAC,QAAQ,KAAQ,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAI,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACpH,MAAM,OAAO,GAAO,OAAO,CAAC,OAAO,KAAS,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAK,CAAC,CAAC,SAAS,CAAC;IAEtG,MAAM,YAAY,GAA8B,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC;IACjC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/SubscriptionContext.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Minimal structural type for the HTTP request. Covers properties used by
+ * the library's default subscription builders. Compatible with both Express
+ * and Fastify request objects.
+ */
+export interface SaplRequest {
+    user?: unknown;
+    method?: string;
+    url?: string;
+    ip?: string;
+    hostname?: string;
+    route?: {
+        path?: string;
+    };
+    params?: Record<string, string>;
+    query?: Record<string, string | string[]>;
+    body?: unknown;
+    headers?: Record<string, string | string[] | undefined>;
+    [key: string]: unknown;
+}
+/**
+ * Context available to subscription field callbacks at request time.
+ *
+ * Passed to any EnforceOptions field that is a function, allowing dynamic
+ * subscription construction based on the current request.
+ *
+ * Example:
+ *   @PreEnforce({ resource: (ctx) => ({ pilotId: ctx.params.pilotId }) })
+ */
+export interface SubscriptionContext {
+    /** The full HTTP request object (has .user, .headers, .cookies, etc.) */
+    request: SaplRequest;
+    /** Route parameters -- @Get(':pilotId') -> ctx.params.pilotId */
+    params: Record<string, string>;
+    /** Query string parameters -- ?page=2 -> ctx.query.page */
+    query: Record<string, string | string[]>;
+    /** Request body (POST/PUT) */
+    body: any;
+    /** Handler method name on the controller */
+    handler: string;
+    /** Controller class name */
+    controller: string;
+    /** Handler return value (only populated in @PostEnforce context) */
+    returnValue?: any;
+    /** Method arguments (available for service methods outside HTTP context) */
+    args?: any[];
+}
+//# sourceMappingURL=SubscriptionContext.d.ts.map

package/dist/SubscriptionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriptionContext.d.ts","sourceRoot":"","sources":["../lib/SubscriptionContext.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,OAAO,EAAE,WAAW,CAAC;IACrB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACzC,8BAA8B;IAC9B,IAAI,EAAE,GAAG,CAAC;IACV,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;CACd"}

package/dist/SubscriptionContext.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=SubscriptionContext.js.map

package/dist/SubscriptionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriptionContext.js","sourceRoot":"","sources":["../lib/SubscriptionContext.ts"],"names":[],"mappings":""}

package/dist/constraints/ConstraintEnforcementService.d.ts

@@ -0,0 +1,22 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DiscoveryService } from '@nestjs/core';
+import { ConstraintHandlerBundle } from './ConstraintHandlerBundle';
+import { StreamingConstraintHandlerBundle } from './StreamingConstraintHandlerBundle';
+import { AuthorizationDecision } from '../types';
+export declare class ConstraintEnforcementService implements OnModuleInit {
+    private readonly discovery;
+    private readonly logger;
+    private readonly handlers;
+    constructor(discovery: DiscoveryService);
+    onModuleInit(): void;
+    preEnforceBundleFor(decision: AuthorizationDecision): ConstraintHandlerBundle;
+    postEnforceBundleFor(decision: AuthorizationDecision): ConstraintHandlerBundle;
+    bestEffortBundleFor(decision: AuthorizationDecision): ConstraintHandlerBundle;
+    streamingBundleFor(decision: AuthorizationDecision): StreamingConstraintHandlerBundle;
+    streamingBestEffortBundleFor(decision: AuthorizationDecision): StreamingConstraintHandlerBundle;
+    private processHandlers;
+    private collectHandlers;
+    private buildBundle;
+    private buildStreamingBundle;
+}
+//# sourceMappingURL=ConstraintEnforcementService.d.ts.map

package/dist/constraints/ConstraintEnforcementService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConstraintEnforcementService.d.ts","sourceRoot":"","sources":["../../lib/constraints/ConstraintEnforcementService.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAwHjD,qBACa,4BAA6B,YAAW,YAAY;IAYnD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAXtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAQvB;gBAE2B,SAAS,EAAE,gBAAgB;IAExD,YAAY;IAwBZ,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,uBAAuB;IAI7E,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,uBAAuB;IAI9E,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,uBAAuB;IAI7E,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,gCAAgC;IAIrF,4BAA4B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,gCAAgC;IAI/F,OAAO,CAAC,eAAe;IAkCvB,OAAO,CAAC,eAAe;IA2EvB,OAAO,CAAC,WAAW;IAkBnB,OAAO,CAAC,oBAAoB;CAsB7B"}