@venizia/ignis-kernel 0.2.0-0

package/dist/cjs/base/auth/authorize/builders/grant.builder.js

@@ -0,0 +1,229 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrantBuilder = void 0;
+const singleton_realm_1 = require("../../../../helpers/singleton-realm");
+const core_1 = require("@venizia/ignis-helpers/core");
+const common_1 = require("../common");
+const policy_builder_1 = require("./policy.builder");
+/** One closure pass over the action lattice: adds every child reachable from an already-covered parent, reporting whether the set grew. */
+const expandCoveredActions = (opts) => {
+    const { covered } = opts;
+    let grew = false;
+    for (const edge of common_1.AuthorizationActions.LATTICE) {
+        if (!covered.has(edge.parent) || covered.has(edge.child)) {
+            continue;
+        }
+        covered.add(edge.child);
+        grew = true;
+    }
+    return grew;
+};
+class GrantBuilder extends core_1.BaseHelper {
+    static { this.SINGLETON_REAL_KEY = 'grant-builder'; }
+    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
+    static { this.PLANNABLE_TIERS = new Set([
+        common_1.AuthorizationActions.READ,
+        common_1.AuthorizationActions.WRITE,
+        common_1.AuthorizationActions.EXECUTE,
+        common_1.AuthorizationActions.MANAGE,
+    ]); }
+    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
+    static { this.NARROW_TIERS = [
+        common_1.AuthorizationActions.READ,
+        common_1.AuthorizationActions.WRITE,
+        common_1.AuthorizationActions.EXECUTE,
+    ]; }
+    constructor() {
+        super({ scope: GrantBuilder.name });
+    }
+    static getInstance() {
+        return singleton_realm_1.SingletonRealm.resolve({
+            key: GrantBuilder.SINGLETON_REAL_KEY,
+            create: () => new GrantBuilder(),
+        });
+    }
+    decodeMetadata(opts) {
+        if (typeof opts.metadata !== 'string') {
+            return opts.metadata;
+        }
+        try {
+            return JSON.parse(opts.metadata);
+        }
+        catch (error) {
+            this.logger
+                .for(this.decodeMetadata.name)
+                .error('Failed to parse metadata | Error: %s', error);
+            return null;
+        }
+    }
+    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
+    parseCustomGrantMetadata(opts) {
+        const decoded = this.decodeMetadata(opts);
+        if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {
+            return null;
+        }
+        const ops = decoded.ops;
+        if (!Array.isArray(ops) || ops.length === 0) {
+            return null;
+        }
+        const seen = new Set();
+        const unique = [];
+        for (const op of ops) {
+            if (typeof op !== 'string' || op.length === 0) {
+                return null;
+            }
+            if (!seen.has(op)) {
+                seen.add(op);
+                unique.push(op);
+            }
+        }
+        return { ops: unique };
+    }
+    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
+    validateCustomGrantOps(opts) {
+        const known = new Set();
+        for (const entry of opts.catalog) {
+            if (entry.subject === opts.subject) {
+                known.add(entry.method);
+            }
+        }
+        const valid = [];
+        const unknown = [];
+        for (const op of opts.ops) {
+            if (known.has(op)) {
+                valid.push(op);
+                continue;
+            }
+            unknown.push(op);
+        }
+        return { valid, unknown };
+    }
+    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
+    actionsCoveredBy(opts) {
+        const covered = new Set([opts.tier]);
+        let grew = true;
+        while (grew) {
+            grew = expandCoveredActions({ covered });
+        }
+        return covered;
+    }
+    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
+    planGrant(opts) {
+        const effect = opts.effect ?? common_1.AuthorizationDecisions.ALLOW;
+        const domain = opts.domain ?? null;
+        if ('tier' in opts.intent) {
+            if (!GrantBuilder.PLANNABLE_TIERS.has(opts.intent.tier)) {
+                throw (0, core_1.getError)({
+                    message: `[planGrant] Invalid tier: ${opts.intent.tier} | Valids: [${[...GrantBuilder.PLANNABLE_TIERS].join(', ')}]`,
+                });
+            }
+            return [
+                policy_builder_1.AuthorizationPolicyBuilder.grant({
+                    subject: opts.subject,
+                    permission: { type: opts.resource.type, id: opts.resource.id },
+                    action: opts.intent.tier,
+                    domain,
+                    effect,
+                }),
+            ];
+        }
+        const seen = new Set();
+        const ops = [];
+        for (const op of opts.intent.ops) {
+            if (seen.has(op)) {
+                continue;
+            }
+            seen.add(op);
+            ops.push(op);
+        }
+        if (!ops.length) {
+            throw (0, core_1.getError)({ message: '[planGrant] intent.ops must not be empty.' });
+        }
+        const subjectCatalog = opts.catalog.filter(entry => entry.subject === opts.resource.subject);
+        const byMethod = new Map(subjectCatalog.map(entry => [entry.method, entry]));
+        const unknown = ops.filter(op => !byMethod.has(op));
+        if (unknown.length) {
+            throw (0, core_1.getError)({
+                message: `[planGrant] Unknown operations for resource "${opts.resource.subject}": ${unknown.join(', ')}`,
+            });
+        }
+        const tierRow = (tier) => policy_builder_1.AuthorizationPolicyBuilder.grant({
+            subject: opts.subject,
+            permission: { type: opts.resource.type, id: opts.resource.id },
+            action: tier,
+            domain,
+            effect,
+        });
+        const rows = [];
+        const remaining = new Set(ops);
+        if (opts.exact !== true) {
+            this.collapseRemainingIntoTiers({ subjectCatalog, remaining, rows, tierRow });
+        }
+        const leftover = ops.filter(op => remaining.has(op));
+        if (!leftover.length) {
+            return rows;
+        }
+        const isPerOperationGrant = leftover.length === 1 || opts.supportsCustomMetadata === false;
+        if (!isPerOperationGrant) {
+            rows.push(policy_builder_1.AuthorizationPolicyBuilder.customGrant({
+                subject: opts.subject,
+                permission: { type: opts.resource.type, id: opts.resource.id },
+                ops: leftover,
+                domain,
+                effect,
+            }));
+            return rows;
+        }
+        for (const op of leftover) {
+            const entry = byMethod.get(op);
+            if (!entry) {
+                throw (0, core_1.getError)({ message: `[planGrant] No catalog entry for operation "${op}".` });
+            }
+            rows.push(policy_builder_1.AuthorizationPolicyBuilder.grant({
+                subject: opts.subject,
+                permission: { type: opts.resource.type, id: entry.code },
+                action: entry.action,
+                domain,
+                effect,
+            }));
+        }
+        return rows;
+    }
+    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
+    collapseRemainingIntoTiers(opts) {
+        const { subjectCatalog, remaining, rows, tierRow } = opts;
+        // manage equals read+write+execute only when the subject has at least one operation in EACH narrow tier; otherwise manage also covers a future tier, which is more than the narrow tiers confer today.
+        const spansAllNarrowTiers = GrantBuilder.NARROW_TIERS.every(tier => {
+            const covered = this.actionsCoveredBy({ tier });
+            return subjectCatalog.some(entry => covered.has(entry.action));
+        });
+        const manageCovered = this.actionsCoveredBy({ tier: common_1.AuthorizationActions.MANAGE });
+        const manageOps = subjectCatalog
+            .filter(entry => manageCovered.has(entry.action))
+            .map(entry => entry.method);
+        if (spansAllNarrowTiers &&
+            manageOps.length &&
+            manageOps.every(method => remaining.has(method))) {
+            rows.push(tierRow(common_1.AuthorizationActions.MANAGE));
+            for (const method of manageOps) {
+                remaining.delete(method);
+            }
+            return;
+        }
+        for (const tier of GrantBuilder.NARROW_TIERS) {
+            const covered = this.actionsCoveredBy({ tier });
+            const methods = subjectCatalog
+                .filter(entry => covered.has(entry.action))
+                .map(entry => entry.method);
+            if (!methods.length || !methods.every(method => remaining.has(method))) {
+                continue;
+            }
+            rows.push(tierRow(tier));
+            for (const method of methods) {
+                remaining.delete(method);
+            }
+        }
+    }
+}
+exports.GrantBuilder = GrantBuilder;
+//# sourceMappingURL=grant.builder.js.map

package/dist/cjs/base/auth/authorize/builders/grant.builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":";;;AAAA,+DAA2D;AAE3D,sDAAmE;AAEnE,sCAOmB;AACnB,qDAAuF;AAEvF,2IAA2I;AAC3I,MAAM,oBAAoB,GAAG,CAAC,IAA8B,EAAW,EAAE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,6BAAoB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAa,YAAa,SAAQ,iBAAU;aAC1B,uBAAkB,GAAG,eAAe,CAAC;IAErD,8FAA8F;aACtE,oBAAe,GAAG,IAAI,GAAG,CAAS;QACxD,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;QAC5B,6BAAoB,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,oGAAoG;aAC5E,iBAAY,GAAwC;QAC1E,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;KAC7B,CAAC;IAEF;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,YAAY,CAAC,kBAAkB;YACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAyB,IAAgC;QACrE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+JAA+J;IAC/J,wBAAwB,CAAC,IAA2B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,uMAAuM;IACvM,sBAAsB,CAAC,IAItB;QACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAoC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gSAAgS;IAChS,SAAS,CAAC,IAST;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,+BAAsB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,2CAA0B,CAAC,KAAK,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxB,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gDAAgD,IAAI,CAAC,QAAQ,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAA0B,EAAE,EAAE,CAC7C,2CAA0B,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEL,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC;QAE3F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,WAAW,CAAC;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9D,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sGAAsG;IAC5F,0BAA0B,CAAC,IAKpC;QACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAE1D,uMAAuM;QACvM,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,6BAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,cAAc;aAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9B,IACE,mBAAmB;YACnB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,6BAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc;iBAC3B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;;AAvRH,oCAwRC"}

package/dist/cjs/base/auth/authorize/builders/index.d.ts

@@ -0,0 +1,4 @@
+export * from './grant.builder';
+export * from './permission.builder';
+export * from './policy.builder';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/builders/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/cjs/base/auth/authorize/builders/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./grant.builder"), exports);
+__exportStar(require("./permission.builder"), exports);
+__exportStar(require("./policy.builder"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/builders/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,uDAAqC;AACrC,mDAAiC"}

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts

@@ -0,0 +1,80 @@
+import type { IdType } from '../../../../base';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+import type { TAuthorizationAction } from '../common/constants';
+/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
+export declare class AuthorizationPermissionBuilder {
+    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
+    static readonly RESOURCE_NODE_METHOD = "*";
+    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
+    static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>>;
+    /** The CRUD methods {@link crud} generates by default. */
+    static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string>;
+    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
+    static actionForMethod(method: string): TAuthorizationAction;
+    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
+    static operation<TName>(opts: {
+        subject: string;
+        method: string;
+        scope: string;
+        name: TName;
+        description?: TNullable<TName>;
+        action?: TAuthorizationAction;
+        parentId?: TNullable<IdType>;
+    }): {
+        code: string;
+        subject: string;
+        method: string;
+        action: string;
+        scope: string;
+        description: NonNullable<TName> | null;
+        parentId: IdType | null;
+        name: TName;
+    };
+    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
+    static resourceNode<TName>(opts: {
+        code: string;
+        subject?: string;
+        scope: string;
+        name: TName;
+        description?: TNullable<TName>;
+        action?: TAuthorizationAction;
+        parentId?: TNullable<IdType>;
+    }): {
+        code: string;
+        subject: string;
+        method: string;
+        action: string;
+        scope: string;
+        description: NonNullable<TName> | null;
+        parentId: IdType | null;
+        name: TName;
+    };
+    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
+    static crud<TName>(opts: {
+        subject: string;
+        scope: string;
+        name: (ctx: {
+            subject: string;
+            method: string;
+            action: TAuthorizationAction;
+        }) => TName;
+        description?: (ctx: {
+            subject: string;
+            method: string;
+            action: TAuthorizationAction;
+        }) => TNullable<TName>;
+        methods?: ReadonlyArray<string>;
+    }): {
+        code: string;
+        subject: string;
+        method: string;
+        action: string;
+        scope: string;
+        description: NonNullable<TName> | null;
+        parentId: IdType | null;
+        name: TName;
+    }[];
+    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
+    static objectMatch(requested: string, granted: string): boolean;
+}
+//# sourceMappingURL=permission.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,+RAA+R;AAC/R,qBAAa,8BAA8B;IACzC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,oBAAoB,OAAO;IAE3C,gHAAgH;IAChH,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAU5E;IAEF,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAUzD;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB;IAI5D,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,oBAAoB,CAAA;SAAE,KAAK,KAAK,CAAC;QACxF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,oBAAoB,CAAC;SAC9B,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KACjC;;;;;;;;;;IAsBD,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;CAWhE"}

package/dist/cjs/base/auth/authorize/builders/permission.builder.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationPermissionBuilder = void 0;
+const constants_1 = require("../common/constants");
+/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
+class AuthorizationPermissionBuilder {
+    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
+    static { this.RESOURCE_NODE_METHOD = '*'; }
+    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
+    static { this.METHOD_ACTIONS = {
+        find: constants_1.AuthorizationActions.READ,
+        findById: constants_1.AuthorizationActions.READ,
+        findOne: constants_1.AuthorizationActions.READ,
+        count: constants_1.AuthorizationActions.READ,
+        create: constants_1.AuthorizationActions.CREATE,
+        updateById: constants_1.AuthorizationActions.UPDATE,
+        updateBy: constants_1.AuthorizationActions.UPDATE,
+        deleteById: constants_1.AuthorizationActions.DELETE,
+        deleteBy: constants_1.AuthorizationActions.DELETE,
+    }; }
+    /** The CRUD methods {@link crud} generates by default. */
+    static { this.DEFAULT_CRUD_METHODS = [
+        'find',
+        'findById',
+        'findOne',
+        'count',
+        'create',
+        'updateById',
+        'updateBy',
+        'deleteById',
+        'deleteBy',
+    ]; }
+    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
+    static actionForMethod(method) {
+        return AuthorizationPermissionBuilder.METHOD_ACTIONS[method] ?? constants_1.AuthorizationActions.EXECUTE;
+    }
+    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
+    static operation(opts) {
+        return {
+            code: [opts.subject, opts.method].join('.'),
+            subject: opts.subject,
+            method: opts.method,
+            action: opts.action ?? AuthorizationPermissionBuilder.actionForMethod(opts.method),
+            scope: opts.scope,
+            description: opts.description ?? null,
+            parentId: opts.parentId ?? null,
+            name: opts.name,
+        };
+    }
+    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
+    static resourceNode(opts) {
+        return {
+            code: opts.code,
+            subject: opts.subject ?? opts.code,
+            method: AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD,
+            action: opts.action ?? constants_1.AuthorizationActions.MANAGE,
+            scope: opts.scope,
+            description: opts.description ?? null,
+            parentId: opts.parentId ?? null,
+            name: opts.name,
+        };
+    }
+    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
+    static crud(opts) {
+        const methods = opts.methods ?? AuthorizationPermissionBuilder.DEFAULT_CRUD_METHODS;
+        return methods.map(method => {
+            const action = AuthorizationPermissionBuilder.actionForMethod(method);
+            const ctx = {
+                subject: opts.subject,
+                method,
+                action,
+            };
+            return AuthorizationPermissionBuilder.operation({
+                subject: opts.subject,
+                method,
+                scope: opts.scope,
+                action,
+                name: opts.name(ctx),
+                description: opts.description ? opts.description(ctx) : undefined,
+            });
+        });
+    }
+    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
+    static objectMatch(requested, granted) {
+        if (granted === '*') {
+            return true;
+        }
+        if (requested === granted) {
+            return true;
+        }
+        return requested.startsWith(`${granted}.`);
+    }
+}
+exports.AuthorizationPermissionBuilder = AuthorizationPermissionBuilder;
+//# sourceMappingURL=permission.builder.js.map

package/dist/cjs/base/auth/authorize/builders/permission.builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":";;;AAGA,mDAA2D;AAE3D,+RAA+R;AAC/R,MAAa,8BAA8B;IACzC,yFAAyF;aACzE,yBAAoB,GAAG,GAAG,CAAC;IAE3C,gHAAgH;aAChG,mBAAc,GAAmD;QAC/E,IAAI,EAAE,gCAAoB,CAAC,IAAI;QAC/B,QAAQ,EAAE,gCAAoB,CAAC,IAAI;QACnC,OAAO,EAAE,gCAAoB,CAAC,IAAI;QAClC,KAAK,EAAE,gCAAoB,CAAC,IAAI;QAChC,MAAM,EAAE,gCAAoB,CAAC,MAAM;QACnC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;QACrC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;KACtC,CAAC;IAEF,0DAA0D;aAC1C,yBAAoB,GAA0B;QAC5D,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,UAAU;KACX,CAAC;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAc;QACnC,OAAO,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,gCAAoB,CAAC,OAAO,CAAC;IAC/F,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAQ,IAQvB;QACC,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAQ,IAQ1B;QACC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;YAClC,MAAM,EAAE,8BAA8B,CAAC,oBAAoB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gCAAoB,CAAC,MAAM;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAQ,IAUlB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,8BAA8B,CAAC,oBAAoB,CAAC;QAEpF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM,MAAM,GAAG,8BAA8B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,GAAG,GAAsE;gBAC7E,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,MAAM;aACP,CAAC;YAEF,OAAO,8BAA8B,CAAC,SAAS,CAAQ;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QACnD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC;;AA3HH,wEA4HC"}

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts

@@ -0,0 +1,195 @@
+import type { IdType } from '../../../../base';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';
+/** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
+export type TPolicyDomainInput = string | {
+    type: string;
+    id: IdType;
+};
+export declare class AuthorizationPolicyBuilder {
+    static readonly ACTION_PRINCIPAL = "Action";
+    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
+    private static serializeDomain;
+    /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
+    static grant(opts: {
+        subject: {
+            type: string;
+            id: IdType;
+        };
+        permission: {
+            type: string;
+            id: IdType;
+        };
+        action: string;
+        domain?: TNullable<TPolicyDomainInput>;
+        effect: TAuthorizationDecision;
+    }): {
+        variant: "grant";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        action: string;
+        effect: string;
+        domain: TNullable<string>;
+    };
+    /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
+    static customGrant(opts: {
+        subject: {
+            type: string;
+            id: IdType;
+        };
+        permission: {
+            type: string;
+            id: IdType;
+        };
+        ops: string[];
+        domain?: TNullable<TPolicyDomainInput>;
+        effect: TAuthorizationDecision;
+    }): {
+        variant: "grant";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        action: string;
+        effect: string;
+        domain: TNullable<string>;
+        metadata: {
+            ops: string[];
+        };
+    };
+    /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
+    static assignRole(opts: {
+        user: {
+            type: string;
+            id: IdType;
+        };
+        role: {
+            type: string;
+            id: IdType;
+        };
+        domain?: TNullable<TPolicyDomainInput>;
+    }): {
+        variant: "assign_role";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        domain: TNullable<string>;
+    };
+    /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
+    static joinDomain(opts: {
+        user: {
+            type: string;
+            id: IdType;
+        };
+        domain: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "join_domain";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** A role inherits another role (casbin `g`, shared relation with assign_role). */
+    static roleInherits(opts: {
+        child: {
+            type: string;
+            id: IdType;
+        };
+        parent: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "role_inherits";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */
+    static resourceInherits(opts: {
+        child: {
+            type: string;
+            id: IdType;
+        };
+        parent: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "resource_inherits";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */
+    static actionInherits(opts: {
+        child: TAuthorizationAction;
+        parent: TAuthorizationAction;
+    }): {
+        variant: "action_inherits";
+        subjectType: string;
+        subjectId: string;
+        targetType: string;
+        targetId: string;
+    };
+    /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */
+    static actionLattice(): {
+        variant: "action_inherits";
+        subjectType: string;
+        subjectId: string;
+        targetType: string;
+        targetId: string;
+    }[];
+    /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */
+    static domainInherits(opts: {
+        child: {
+            type: string;
+            id: IdType;
+        };
+        parent: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "domain_inherits";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */
+    static roleGrants(opts: {
+        role: {
+            type: string;
+            id: IdType;
+        };
+        permission: {
+            type: string;
+            idByCode: ReadonlyMap<string, string>;
+        };
+        grants: ReadonlyArray<{
+            resourceCode: string;
+            action: string;
+            domain?: TNullable<TPolicyDomainInput>;
+            effect: TAuthorizationDecision;
+        }>;
+    }): {
+        variant: "grant";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        action: string;
+        effect: string;
+        domain: TNullable<string>;
+    }[];
+}
+//# sourceMappingURL=policy.builder.d.ts.map