@venizia/ignis-kernel 0.2.0-13 → 0.2.0-15

package/dist/esm/base/auth/authorize/common/{constants.d.ts → constants/authorization.d.ts}

@@ -1,5 +1,5 @@
 import type { TConstValue } from '@venizia/ignis-helpers/common';
-import { AuthorizationRole } from '../models/authorization-role.model.js';
+import { AuthorizationRole } from '../../models/authorization-role.model.js';
 export declare class Authorization {
     static readonly RULES = "authorization.rules";
     static readonly SKIP_AUTHORIZATION = "authorization.skip";
@@ -44,41 +44,6 @@ export declare class AuthorizationRoles {
     static readonly SCHEME_SET: Set<string>;
     static isValid(input: string): boolean;
 }
-export declare class AuthorizationEnforcerTypes {
-    static readonly CASBIN = "casbin";
-    static readonly CUSTOM = "custom";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
-export declare class CasbinEnforcerCachedDrivers {
-    static readonly REDIS = "redis";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
-export declare class CasbinEnforcerModelDrivers {
-    static readonly FILE = "file";
-    static readonly TEXT = "text";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
-export declare class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static readonly KEY_MATCH = "keyMatch";
-    /** Adds URL-path `:param` segment matching. */
-    static readonly KEY_MATCH_2 = "keyMatch2";
-    /** Adds `{param}` segment matching. */
-    static readonly KEY_MATCH_3 = "keyMatch3";
-    /** `{param}` matching with repeated-name equality checks. */
-    static readonly KEY_MATCH_4 = "keyMatch4";
-    /** Treats the stored/policy value as a full regular expression. */
-    static readonly REGEX_MATCH = "regexMatch";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
 export declare class AuthorizationDomainScopes {
     /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
     static readonly ANY_MEMBER = "ANY_MEMBER";
@@ -88,23 +53,6 @@ export declare class AuthorizationDomainScopes {
     static isValid(input: string): boolean;
 }
 export type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-export declare class CasbinRuleVariants {
-    /** Permission policy line. */
-    static readonly P = "p";
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static readonly G = "g";
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static readonly G2 = "g2";
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static readonly G3 = "g3";
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static readonly G4 = "g4";
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static readonly G5 = "g5";
-}
-export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
 /** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
 export declare class AuthorizationPolicyVariants {
     /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
@@ -172,9 +120,4 @@ export declare class AuthorizationPolicyVariants {
 }
 /** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
 export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
-export declare class AuthorizeBindingKeys {
-    static readonly OPTIONS = "@app/authorize/options";
-    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
-    static enforcerOptions(name: string): string;
-}
-//# sourceMappingURL=constants.d.ts.map
+//# sourceMappingURL=authorization.d.ts.map

package/dist/esm/base/auth/authorize/common/constants/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,sIAAsI;IACtI,MAAM,CAAC,QAAQ,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;OAQR;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAA+D;IAEhG,MAAM,CAAC,QAAQ,CAAC,eAAe,cAA6D;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AAED,6IAA6I;AAC7I,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC"}

package/dist/esm/base/auth/authorize/common/{constants.js → constants/authorization.js}

@@ -1,4 +1,5 @@
-import { AuthorizationRole } from '../models/authorization-role.model.js';
+import { AuthorizationRole } from '../../models/authorization-role.model.js';
+import { CasbinRuleVariants } from './enforcer.js';
 export class Authorization {
     static { this.RULES = 'authorization.rules'; }
     static { this.SKIP_AUTHORIZATION = 'authorization.skip'; }
@@ -96,51 +97,6 @@ export class AuthorizationRoles {
         return this.SCHEME_SET.has(input);
     }
 }
-export class AuthorizationEnforcerTypes {
-    static { this.CASBIN = 'casbin'; }
-    static { this.CUSTOM = 'custom'; }
-    static { this.SCHEME_SET = new Set([this.CASBIN, this.CUSTOM]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class CasbinEnforcerCachedDrivers {
-    static { this.REDIS = 'redis'; }
-    static { this.SCHEME_SET = new Set([this.REDIS]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class CasbinEnforcerModelDrivers {
-    static { this.FILE = 'file'; }
-    static { this.TEXT = 'text'; }
-    static { this.SCHEME_SET = new Set([this.FILE, this.TEXT]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static { this.KEY_MATCH = 'keyMatch'; }
-    /** Adds URL-path `:param` segment matching. */
-    static { this.KEY_MATCH_2 = 'keyMatch2'; }
-    /** Adds `{param}` segment matching. */
-    static { this.KEY_MATCH_3 = 'keyMatch3'; }
-    /** `{param}` matching with repeated-name equality checks. */
-    static { this.KEY_MATCH_4 = 'keyMatch4'; }
-    /** Treats the stored/policy value as a full regular expression. */
-    static { this.REGEX_MATCH = 'regexMatch'; }
-    static { this.SCHEME_SET = new Set([
-        this.KEY_MATCH,
-        this.KEY_MATCH_2,
-        this.KEY_MATCH_3,
-        this.KEY_MATCH_4,
-        this.REGEX_MATCH,
-    ]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
 export class AuthorizationDomainScopes {
     /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
     static { this.ANY_MEMBER = 'ANY_MEMBER'; }
@@ -151,22 +107,6 @@ export class AuthorizationDomainScopes {
         return this.SCHEME_SET.has(input);
     }
 }
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-export class CasbinRuleVariants {
-    /** Permission policy line. */
-    static { this.P = 'p'; }
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static { this.G = 'g'; }
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static { this.G2 = 'g2'; }
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static { this.G3 = 'g3'; }
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static { this.G4 = 'g4'; }
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static { this.G5 = 'g5'; }
-}
 /** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
 export class AuthorizationPolicyVariants {
     /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
@@ -211,11 +151,4 @@ export class AuthorizationPolicyVariants {
         return this.RULE_SCHEME_SET.has(input);
     }
 }
-export class AuthorizeBindingKeys {
-    static { this.OPTIONS = '@app/authorize/options'; }
-    static { this.ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles'; }
-    static enforcerOptions(name) {
-        return `@app/authorize/enforcers/${name}/options`;
-    }
-}
-//# sourceMappingURL=constants.js.map
+//# sourceMappingURL=authorization.js.map

package/dist/esm/base/auth/authorize/common/constants/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,OAAO,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAGlD,MAAM,OAAO,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAIH,MAAM,OAAO,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AAIH,MAAM,OAAO,kBAAkB;aACb,gBAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAGH,MAAM,OAAO,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAIH,sRAAsR;AACtR,MAAM,OAAO,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,kBAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,kBAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,kBAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAEhF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/binding-keys.d.ts

@@ -0,0 +1,6 @@
+export declare class AuthorizeBindingKeys {
+    static readonly OPTIONS = "@app/authorize/options";
+    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
+    static enforcerOptions(name: string): string;
+}
+//# sourceMappingURL=binding-keys.d.ts.map

package/dist/esm/base/auth/authorize/common/constants/binding-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-keys.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,4BAA4B;IACnD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uCAAuC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7C"}

package/dist/esm/base/auth/authorize/common/constants/binding-keys.js

@@ -0,0 +1,8 @@
+export class AuthorizeBindingKeys {
+    static { this.OPTIONS = '@app/authorize/options'; }
+    static { this.ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles'; }
+    static enforcerOptions(name) {
+        return `@app/authorize/enforcers/${name}/options`;
+    }
+}
+//# sourceMappingURL=binding-keys.js.map

package/dist/esm/base/auth/authorize/common/constants/binding-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-keys.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,oBAAoB;aACf,YAAO,GAAG,wBAAwB,CAAC;aACnC,uBAAkB,GAAG,mCAAmC,CAAC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,4BAA4B,IAAI,UAAU,CAAC;IACpD,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/enforcer.d.ts

@@ -0,0 +1,54 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+export declare class AuthorizationEnforcerTypes {
+    static readonly CASBIN = "casbin";
+    static readonly CUSTOM = "custom";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
+export declare class CasbinEnforcerCachedDrivers {
+    static readonly REDIS = "redis";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
+export declare class CasbinEnforcerModelDrivers {
+    static readonly FILE = "file";
+    static readonly TEXT = "text";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
+export declare class CasbinDomainMatchingFunctions {
+    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
+    static readonly KEY_MATCH = "keyMatch";
+    /** Adds URL-path `:param` segment matching. */
+    static readonly KEY_MATCH_2 = "keyMatch2";
+    /** Adds `{param}` segment matching. */
+    static readonly KEY_MATCH_3 = "keyMatch3";
+    /** `{param}` matching with repeated-name equality checks. */
+    static readonly KEY_MATCH_4 = "keyMatch4";
+    /** Treats the stored/policy value as a full regular expression. */
+    static readonly REGEX_MATCH = "regexMatch";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
+/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
+export declare class CasbinRuleVariants {
+    /** Permission policy line. */
+    static readonly P = "p";
+    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
+    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
+    static readonly G = "g";
+    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
+    static readonly G2 = "g2";
+    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
+    static readonly G3 = "g3";
+    /** Grouping #4 - resource hierarchy. The `obj` axis. */
+    static readonly G4 = "g4";
+    /** Grouping #5 - action hierarchy. The `act` axis. */
+    static readonly G5 = "g5";
+}
+export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
+//# sourceMappingURL=enforcer.d.ts.map

package/dist/esm/base/auth/authorize/common/constants/enforcer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAuC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF,qBAAa,2BAA2B;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyB;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,2BAA2B,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAE1F,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF,qBAAa,6BAA6B;IACxC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc;IAEvC,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,uCAAuC;IACvC,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,6DAA6D;IAC7D,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,mEAAmE;IACnE,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;IAE3C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,6BAA6B,GAAG,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE9F,+MAA+M;AAC/M,qBAAa,kBAAkB;IAC7B,8BAA8B;IAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO;IAExB,4GAA4G;IAE5G,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO;IAExB,uFAAuF;IACvF,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,wDAAwD;IACxD,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,sDAAsD;IACtD,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;CAC3B;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/enforcer.js

@@ -0,0 +1,62 @@
+export class AuthorizationEnforcerTypes {
+    static { this.CASBIN = 'casbin'; }
+    static { this.CUSTOM = 'custom'; }
+    static { this.SCHEME_SET = new Set([this.CASBIN, this.CUSTOM]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+export class CasbinEnforcerCachedDrivers {
+    static { this.REDIS = 'redis'; }
+    static { this.SCHEME_SET = new Set([this.REDIS]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+export class CasbinEnforcerModelDrivers {
+    static { this.FILE = 'file'; }
+    static { this.TEXT = 'text'; }
+    static { this.SCHEME_SET = new Set([this.FILE, this.TEXT]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+export class CasbinDomainMatchingFunctions {
+    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
+    static { this.KEY_MATCH = 'keyMatch'; }
+    /** Adds URL-path `:param` segment matching. */
+    static { this.KEY_MATCH_2 = 'keyMatch2'; }
+    /** Adds `{param}` segment matching. */
+    static { this.KEY_MATCH_3 = 'keyMatch3'; }
+    /** `{param}` matching with repeated-name equality checks. */
+    static { this.KEY_MATCH_4 = 'keyMatch4'; }
+    /** Treats the stored/policy value as a full regular expression. */
+    static { this.REGEX_MATCH = 'regexMatch'; }
+    static { this.SCHEME_SET = new Set([
+        this.KEY_MATCH,
+        this.KEY_MATCH_2,
+        this.KEY_MATCH_3,
+        this.KEY_MATCH_4,
+        this.REGEX_MATCH,
+    ]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
+export class CasbinRuleVariants {
+    /** Permission policy line. */
+    static { this.P = 'p'; }
+    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
+    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
+    static { this.G = 'g'; }
+    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
+    static { this.G2 = 'g2'; }
+    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
+    static { this.G3 = 'g3'; }
+    /** Grouping #4 - resource hierarchy. The `obj` axis. */
+    static { this.G4 = 'g4'; }
+    /** Grouping #5 - action hierarchy. The `act` axis. */
+    static { this.G5 = 'g5'; }
+}
+//# sourceMappingURL=enforcer.js.map

package/dist/esm/base/auth/authorize/common/constants/enforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/enforcer.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,0BAA0B;aACrB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,2BAA2B;aACtB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,0BAA0B;aACrB,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,6BAA6B;IACxC,+FAA+F;aAC/E,cAAS,GAAG,UAAU,CAAC;IAEvC,+CAA+C;aAC/B,gBAAW,GAAG,WAAW,CAAC;IAE1C,uCAAuC;aACvB,gBAAW,GAAG,WAAW,CAAC;IAE1C,6DAA6D;aAC7C,gBAAW,GAAG,WAAW,CAAC;IAE1C,mEAAmE;aACnD,gBAAW,GAAG,YAAY,CAAC;aAE3B,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,+MAA+M;AAC/M,MAAM,OAAO,kBAAkB;IAC7B,8BAA8B;aACd,MAAC,GAAG,GAAG,CAAC;IAExB,4GAA4G;IAE5G,+FAA+F;aAC/E,MAAC,GAAG,GAAG,CAAC;IAExB,uFAAuF;aACvE,OAAE,GAAG,IAAI,CAAC;IAE1B,gEAAgE;aAChD,OAAE,GAAG,IAAI,CAAC;IAE1B,wDAAwD;aACxC,OAAE,GAAG,IAAI,CAAC;IAE1B,sDAAsD;aACtC,OAAE,GAAG,IAAI,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/index.d.ts

@@ -0,0 +1,4 @@
+export * from './authorization.js';
+export * from './binding-keys.js';
+export * from './enforcer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/common/constants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/index.js

@@ -0,0 +1,4 @@
+export * from './authorization.js';
+export * from './binding-keys.js';
+export * from './enforcer.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/common/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/esm/base/auth/authorize/common/index.d.ts

@@ -1,4 +1,4 @@
 export * from './errors.js';
-export * from './constants.js';
-export * from './types.js';
+export * from './constants/index.js';
+export * from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/common/index.js

@@ -1,4 +1,4 @@
 export * from './errors.js';
-export * from './constants.js';
-export * from './types.js';
+export * from './constants/index.js';
+export * from './types/index.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/common/{types.d.ts → types/enforcer.d.ts}

@@ -1,48 +1,17 @@
-import type { IdType } from '../../../../base/index.js';
-import type { TContext } from '../../../../base/controllers/common/types.js';
-import { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
 import { type IRedisHelper } from '@venizia/ignis-helpers/core';
 import type { Adapter } from 'casbin';
 import type { Env } from 'hono';
 import { type MiddlewareHandler } from 'hono';
-import type { IAuthUser } from '../../authenticate/common/types.js';
-import type { CasbinEnforcerCachedDrivers, CasbinEnforcerModelDrivers, TAuthorizationAction, TAuthorizationDecision, TCasbinDomainMatchingFunction } from './constants.js';
-import type { AuthorizationPolicyBuilder } from '../builders/policy.builder.js';
-export interface IAuthorizationRole {
-    readonly name: string;
-    readonly priority: number;
-    readonly identifier: string;
-}
-/** Key-value conditions for attribute-based access control. Values compared with strict equality. */
-export type TAuthorizationConditions<KeyType extends string | symbol = string | symbol, ValueType = string | number | boolean | null> = Record<KeyType, ValueType>;
-export interface IAuthorizationRequest<TAction = string, TResource = string> {
-    action: TAction;
-    resource: TResource;
-    conditions?: TAuthorizationConditions;
-    /** Resolved domain scope for this request as a casbin domain string `"<DomainType>_<id>"` (e.g. `"Merchant_7"`), or the `"SYSTEM_WIDE"` sentinel to enforce across all domains. */
-    domain?: string;
-}
-export interface IAuthorizationUser extends IAuthUser {
-    principalType: string;
-}
+import type { IAuthUser } from '../../../authenticate/common/types/index.js';
+import type { CasbinEnforcerCachedDrivers, CasbinEnforcerModelDrivers, TAuthorizationDecision, TCasbinDomainMatchingFunction } from '../constants/index.js';
+import type { IAuthorizationDomainSource, IAuthorizationRequest, IAuthorizationUser, TAuthorizationConditions, TAuthorizationDomainResolver } from './request.js';
 /** What CasbinAuthorizationEnforcer.buildRules returns and evaluate consumes. */
 export interface ICasbinRules {
     user: IAuthorizationUser;
     lines: string[];
 }
-/** Declarative description of where to read the request domain from. */
-export interface IAuthorizationDomainSource {
-    from: 'param' | 'header' | 'query' | 'context';
-    key: string;
-    type: string;
-}
-/** Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */
-export type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {
-    context: TContext<E, string>;
-}) => ValueOrPromise<TNullable<{
-    type: string;
-    id: IdType;
-}>>;
 /** Builds rules and evaluates requests. Cache management (`invalidateUserCache`/`rebuildUserCache`) is OPTIONAL - only on per-user-caching enforcers; the registry feature-detects it at runtime. */
 export interface IAuthorizationEnforcer<E extends Env = Env, TAction = string, TResource = string, TRules = unknown, TBuildRulesReturn = ValueOrPromise<TRules>, TEvaluateReturn = ValueOrPromise<TAuthorizationDecision>> {
     name: string;
@@ -141,19 +110,4 @@ export interface IAuthorizeOptions {
     /** Fallback domain resolver used when a route's spec has no `domain`. */
     domainResolver?: TAuthorizationDomainResolver;
 }
-/** Shape of `PolicyDefinition.metadata` on a subset ("custom") grant. `ops` holds bare method names (e.g. `"find"`), not full permission codes. */
-export type TCustomGrantMetadata = {
-    ops: string[];
-};
-export type TGrantIntent = {
-    tier: TAuthorizationAction;
-} | {
-    ops: string[];
-};
-/** Per-operation rows carry `targetId` = the operation's code, not a database id; the consumer resolves codes to ids when persisting. */
-export type TPlannedGrantRow = ReturnType<typeof AuthorizationPolicyBuilder.grant> & {
-    metadata?: {
-        ops: string[];
-    };
-};
-//# sourceMappingURL=types.d.ts.map
+//# sourceMappingURL=enforcer.d.ts.map

package/dist/esm/base/auth/authorize/common/types/enforcer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,6BAA6B,EAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,WAAW,CAAC;AAEnB,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,qMAAqM;AACrM,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,MAAM,GAAG,OAAO,EAChB,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,EAC1C,eAAe,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAExD,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IAElC,UAAU,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,iBAAiB,CAAC;IAEhG,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,eAAe,CAAC;IAEpB,4EAA4E;IAC5E,mBAAmB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE/F,sFAAsF;IACtF,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAED,MAAM,MAAM,mBAAmB,CAC7B,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,IAChB,CAAC,IAAI,EAAE;IACT,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,sBAAsB,CAAC,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IAC3F,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACtD,qGAAqG;IACrG,MAAM,CAAC,EAAE,0BAA0B,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE;IAC3F,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,KAAK,iBAAiB,CAAC;AAExB,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC;IACjD,OAAO,EAAE;QACP,UAAU,EAAE,YAAY,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,kBAAkB,CAAA;SAAE,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,QAAQ,GAAG,OAAO;IAElB,KAAK,EACD;QAAE,MAAM,EAAE,OAAO,0BAA0B,CAAC,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACtE;QAAE,MAAM,EAAE,OAAO,0BAA0B,CAAC,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,MAAM,EAAE;QAAE,GAAG,EAAE,KAAK,CAAA;KAAE,GAAG,CAAC,0BAA0B,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAEnB,cAAc,CAAC,EAAE;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,EAAE,EAAE,6BAA6B,CAAC;KACnC,CAAC;IAEF,kBAAkB,CAAC,CAAC,IAAI,EAAE;QACxB,IAAI,EAAE,SAAS,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,EAAE,SAAS,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG;QACF,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF,2YAA2Y;IAC3Y,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,4BAA4B,CAAC;CAC/C"}

package/dist/esm/base/auth/authorize/common/types/enforcer.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=enforcer.js.map

package/dist/esm/base/auth/authorize/common/types/enforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/enforcer.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authorize/common/types/grant.d.ts

@@ -0,0 +1,18 @@
+import type { AuthorizationPolicyBuilder } from '../../builders/policy.builder.js';
+import type { TAuthorizationAction } from '../constants/index.js';
+/** Shape of `PolicyDefinition.metadata` on a subset ("custom") grant. `ops` holds bare method names (e.g. `"find"`), not full permission codes. */
+export type TCustomGrantMetadata = {
+    ops: string[];
+};
+export type TGrantIntent = {
+    tier: TAuthorizationAction;
+} | {
+    ops: string[];
+};
+/** Per-operation rows carry `targetId` = the operation's code, not a database id; the consumer resolves codes to ids when persisting. */
+export type TPlannedGrantRow = ReturnType<typeof AuthorizationPolicyBuilder.grant> & {
+    metadata?: {
+        ops: string[];
+    };
+};
+//# sourceMappingURL=grant.d.ts.map

package/dist/esm/base/auth/authorize/common/types/grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,mJAAmJ;AACnJ,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE9E,yIAAyI;AACzI,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,KAAK,CAAC,GAAG;IACnF,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC9B,CAAC"}

package/dist/esm/base/auth/authorize/common/types/grant.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=grant.js.map

package/dist/esm/base/auth/authorize/common/types/grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/grant.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authorize/common/types/index.d.ts

@@ -0,0 +1,4 @@
+export * from './enforcer.js';
+export * from './grant.js';
+export * from './request.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/common/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC"}

package/dist/esm/base/auth/authorize/common/types/index.js

@@ -0,0 +1,4 @@
+export * from './enforcer.js';
+export * from './grant.js';
+export * from './request.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/common/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC"}

package/dist/esm/base/auth/authorize/common/types/request.d.ts

@@ -0,0 +1,36 @@
+import type { IdType } from '../../../../index.js';
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { Env } from 'hono';
+import type { IAuthUser } from '../../../authenticate/common/types/index.js';
+export interface IAuthorizationRole {
+    readonly name: string;
+    readonly priority: number;
+    readonly identifier: string;
+}
+/** Key-value conditions for attribute-based access control. Values compared with strict equality. */
+export type TAuthorizationConditions<KeyType extends string | symbol = string | symbol, ValueType = string | number | boolean | null> = Record<KeyType, ValueType>;
+export interface IAuthorizationRequest<TAction = string, TResource = string> {
+    action: TAction;
+    resource: TResource;
+    conditions?: TAuthorizationConditions;
+    /** Resolved domain scope for this request as a casbin domain string `"<DomainType>_<id>"` (e.g. `"Merchant_7"`), or the `"SYSTEM_WIDE"` sentinel to enforce across all domains. */
+    domain?: string;
+}
+export interface IAuthorizationUser extends IAuthUser {
+    principalType: string;
+}
+/** Declarative description of where to read the request domain from. */
+export interface IAuthorizationDomainSource {
+    from: 'param' | 'header' | 'query' | 'context';
+    key: string;
+    type: string;
+}
+/** Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */
+export type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {
+    context: TContext<E, string>;
+}) => ValueOrPromise<TNullable<{
+    type: string;
+    id: IdType;
+}>>;
+//# sourceMappingURL=request.d.ts.map

package/dist/esm/base/auth/authorize/common/types/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EACjD,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE/B,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,mLAAmL;IACnL,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACrE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,SAAS,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC"}

package/dist/esm/base/auth/authorize/common/types/request.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=request.js.map

package/dist/esm/base/auth/authorize/common/types/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authorize/enforcers/enforcer-registry.d.ts

@@ -1,6 +1,6 @@
 import type { Container } from '../../../../helpers/inversion/container.js';
 import type { TClass } from '@venizia/ignis-helpers/common';
-import type { IAuthUser } from '../../authenticate/common/types.js';
+import type { IAuthUser } from '../../authenticate/common/types/index.js';
 import { AbstractAuthRegistry } from '../../base/index.js';
 import type { AuthorizationEnforcerTypes, IAuthorizationEnforcer, IAuthorizationUser, IAuthorizeOptions, ICasbinEnforcerOptions } from '../common/index.js';
 export declare class AuthorizationEnforcerRegistry extends AbstractAuthRegistry<IAuthorizationEnforcer> {

package/dist/esm/base/auth/authorize/providers/authorization.provider.js

@@ -1,8 +1,8 @@
-import { asTypedContext } from '../../../../base/controllers/common/types.js';
+import { asTypedContext } from '../../../controllers/context.js';
 import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
 import { createMiddleware } from 'hono/factory';
 // Deep import (not the authenticate barrel): the barrel re-exports ./controllers, whose factory extends BaseRestController - a value import here forms the base/controllers <-> auth init cycle.
-import { Authentication } from '../../authenticate/common/constants.js';
+import { Authentication } from '../../authenticate/common/constants/index.js';
 import { Authorization, AuthorizationDecisions, AuthorizationErrors } from '../common/index.js';
 import { AuthorizationEnforcerRegistry } from '../enforcers/enforcer-registry.js';
 import { resolveRequestDomain } from './request-domain.js';