@venizia/ignis-kernel 0.2.0-2 → 0.2.0-20

package/dist/cjs/base/auth/authenticate/common/{types.d.ts → types/jwt.d.ts}

@@ -1,61 +1,9 @@
-import type { TContext } from '../../../../base/controllers/common/types';
-import type { IdType } from '../../../../base/models/common/types';
-import type { TAnyObjectSchema } from '../../../../utilities/schema.utility';
-import type { AnyObject, ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { IdType } from '../../../../models/common';
+import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
 import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';
-import type { Env } from 'hono';
-import { type MiddlewareHandler } from 'hono';
 import type { JWTPayload } from 'jose';
-import type { TChangePasswordRequest, TSignInRequest, TSignUpRequest } from '../../models/requests';
-import type { JOSEStandards, JWKSModes } from './constants';
-import { type TAuthMode, type TJWKSKeyDriver, type TJWKSKeyFormat } from './constants';
-export type TDefineAuthControllerOpts = {
-    restPath?: string;
-    serviceKey: string;
-    requireAuthenticatedSignUp?: boolean;
-    payload?: {
-        signIn?: {
-            request: {
-                schema: TAnyObjectSchema;
-            };
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        signUp?: {
-            request: {
-                schema: TAnyObjectSchema;
-            };
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        changePassword?: {
-            request: {
-                schema?: TAnyObjectSchema;
-            };
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        refreshToken?: {
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        getUserInformation?: {
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-    };
-};
-export type TAuthenticationRestOptions = {} & ({
-    useAuthController?: false | undefined;
-} | {
-    useAuthController: true;
-    controllerOpts: TDefineAuthControllerOpts;
-});
+import type { JOSEStandards, JWKSModes, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';
+import type { IAuthUser } from './strategy';
 /**
  * Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`
  * exactly, so this is a pass-through with no translation layer.
@@ -163,25 +111,6 @@ export type TJWTTokenServiceOptions = {
     standard: typeof JOSEStandards.JWKS;
     options: TJWKSTokenServiceOptions;
 };
-export type TBasicTokenServiceOptions<E extends Env = Env> = {
-    /** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
-    verifyCredentials: (opts: {
-        credentials: {
-            username: string;
-            password: string;
-        };
-        context: TContext<E, string>;
-    }) => Promise<IAuthUser | null>;
-};
-export interface IAuthenticateOptions {
-    restOptions?: TAuthenticationRestOptions;
-    jwtOptions?: TJWTTokenServiceOptions;
-    basicOptions?: TBasicTokenServiceOptions;
-}
-export interface IAuthUser {
-    userId: IdType;
-    [extra: string | symbol]: any;
-}
 export interface IJWTTokenPayload extends JWTPayload, IAuthUser {
     userId: IdType;
     roles: {
@@ -205,19 +134,4 @@ export interface IPayloadFieldCodec<T = unknown> {
     }): T;
 }
 export type TGetTokenExpiresFn = () => ValueOrPromise<number>;
-export interface IAuthenticationStrategy<E extends Env = Env> {
-    name: string;
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-export type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {
-    strategies: string[];
-    mode?: TAuthMode;
-}) => MiddlewareHandler<RouteEnv>;
-export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest = TSignInRequest, SIRS = AnyObject, SURQ extends TSignUpRequest = TSignUpRequest, SURS = AnyObject, CPRQ extends TChangePasswordRequest = TChangePasswordRequest, CPRS = AnyObject, UIRQ = AnyObject, UIRS = AnyObject, RTRS = AnyObject> {
-    signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;
-    signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;
-    changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;
-    getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
-    refreshToken?(context: TContext<E>): Promise<RTRS>;
-}
-//# sourceMappingURL=types.d.ts.map
+//# sourceMappingURL=jwt.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC"}

package/dist/cjs/base/auth/authenticate/common/types/jwt.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=jwt.js.map

package/dist/cjs/base/auth/authenticate/common/types/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authenticate/common/types/options.d.ts

@@ -0,0 +1,15 @@
+import type { TBasicTokenServiceOptions } from './basic';
+import type { TJWTTokenServiceOptions } from './jwt';
+import type { TAuthenticationRestOptions } from './rest';
+import type { IServiceAuthOptions } from './service';
+/**
+ * Composes the four topic option types into the framework's single authenticate config knob.
+ * The only file in this folder allowed more than one sibling import - it is their parent.
+ */
+export interface IAuthenticateOptions {
+    restOptions?: TAuthenticationRestOptions;
+    jwtOptions?: TJWTTokenServiceOptions;
+    basicOptions?: TBasicTokenServiceOptions;
+    serviceOptions?: IServiceAuthOptions;
+}
+//# sourceMappingURL=options.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,OAAO,CAAC;AACrD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,0BAA0B,CAAC;IACzC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC"}

package/dist/cjs/base/auth/authenticate/common/types/options.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=options.js.map

package/dist/cjs/base/auth/authenticate/common/types/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/options.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authenticate/common/types/rest.d.ts

@@ -0,0 +1,49 @@
+import type { TAnyObjectSchema } from '../../../../../utilities/schema.utility';
+export type TDefineAuthControllerOpts = {
+    restPath?: string;
+    serviceKey: string;
+    requireAuthenticatedSignUp?: boolean;
+    payload?: {
+        signIn?: {
+            request: {
+                schema: TAnyObjectSchema;
+            };
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        signUp?: {
+            request: {
+                schema: TAnyObjectSchema;
+            };
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        changePassword?: {
+            request: {
+                schema?: TAnyObjectSchema;
+            };
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        refreshToken?: {
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        getUserInformation?: {
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+    };
+};
+export type TAuthenticationRestOptions = {} & ({
+    useAuthController?: false | undefined;
+} | {
+    useAuthController: true;
+    controllerOpts: TDefineAuthControllerOpts;
+});
+//# sourceMappingURL=rest.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/rest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/rest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,cAAc,CAAC,EAAE;YACf,OAAO,EAAE;gBAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACvC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,YAAY,CAAC,EAAE;YACb,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,kBAAkB,CAAC,EAAE;YACnB,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,EAAE,GAAG,CAC1C;IAAE,iBAAiB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GACzC;IACE,iBAAiB,EAAE,IAAI,CAAC;IACxB,cAAc,EAAE,yBAAyB,CAAC;CAC3C,CACJ,CAAC"}

package/dist/cjs/base/auth/authenticate/common/types/rest.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rest.js.map

package/dist/cjs/base/auth/authenticate/common/types/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/rest.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authenticate/common/types/service.d.ts

@@ -0,0 +1,95 @@
+import type { TContext } from '../../../../controllers/common/types';
+import type { TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { Env } from 'hono';
+import type { JWTPayload } from 'jose';
+import type { TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';
+import type { IAuthUser } from './strategy';
+/**
+ * The request binding, following RFC 9449's `htm`/`htu`. A captured assertion cannot be replayed
+ * against a different method or path.
+ *
+ * `htu` is the percent-ENCODED pathname on both ends. Compare it against
+ * `new URL(context.req.url).pathname`, never `context.req.path` - Hono hands that one back DECODED,
+ * so any route carrying a space or a non-ASCII slug would never match what the caller signed.
+ */
+export interface IServiceAssertionClaims extends JWTPayload {
+    htm: string;
+    htu: string;
+}
+/**
+ * One entry in the caller allowlist: the JWKS url, or that url plus settings for this caller alone.
+ */
+export type TServiceCallerEntry = string | {
+    jwksUrl: string;
+    /** Widens the accepted age for THIS caller only. Falls back to the service-wide setting. */
+    acceptMaxAgeSeconds?: number;
+};
+/** Service-to-service authentication: an Ed25519 assertion per request, verified against the caller's JWKS. */
+export interface IServiceAuthOptions<E extends Env = Env> {
+    /** What this service calls itself: the `iss` it stamps, and the `aud` it demands. */
+    name: string;
+    /**
+     * Present only on a service that CALLS OUT. Absent means verify-only, and no certs route is
+     * mounted - which is the common case, since most services are called and never call.
+     */
+    keys?: {
+        driver: TJWKSKeyDriver;
+        format: TJWKSKeyFormat;
+        /** PEM or JWK by `format`; content for the `text` driver, a path for `file`. */
+        private: string;
+        public: string;
+        kid?: string;
+    };
+    /**
+     * Caller name to its JWKS url. THIS IS ALSO THE ALLOWLIST - a name absent from the map cannot
+     * call, and an empty map correctly allows nobody.
+     *
+     * The bare-string form is the common case. The object form exists to widen the accepted age for
+     * ONE caller: a nightly batch may legitimately need more slack than an interactive service, and
+     * granting it per caller keeps the concession named and visible in config.
+     */
+    callers?: Record<string, TServiceCallerEntry>;
+    /** Where the certs route is mounted. Defaults to `ServiceAssertion.DEFAULT_REST_PATH`. */
+    rest?: {
+        path: string;
+    };
+    /**
+     * How long the assertions this service MINTS stay valid. Only meaningful where `keys` is set.
+     */
+    signLifetimeSeconds?: number;
+    /**
+     * The oldest assertion this service ACCEPTS, measured from `iat`.
+     *
+     * Deliberately separate from `signLifetimeSeconds`, and deliberately not requestable by the
+     * caller. The caller already controls `exp` - it signs the token - so this is the only bound that
+     * survives a compromised caller. A per-caller override belongs in {@link callers}, never in the
+     * assertion.
+     *
+     * Composes with `clockToleranceSeconds`: the real acceptance window is the sum of the two.
+     */
+    acceptMaxAgeSeconds?: number;
+    /**
+     * Clock skew allowance. A SECURITY knob, not an operational one.
+     *
+     * Its job is the future case: two machines never agree to the second, and without it a caller one
+     * second ahead is refused outright. But it also widens the REPLAY window second for second - a
+     * callee accepting an `iat` 5s in its own future keeps accepting that token for the rest of the
+     * window too. Measured at the defaults: 65s accepted on our clock, 70s of wall-clock life for a
+     * capture minted by a caller running the full tolerance fast.
+     */
+    clockToleranceSeconds?: number;
+    jwks?: {
+        cacheMaxAgeMs?: number;
+        cooldownMs?: number;
+    };
+    /**
+     * WHO a verified assertion acts as. The framework has already proven the caller; this only maps a
+     * caller name onto an application principal. Return `null` to refuse a caller the allowlist
+     * admits but the application does not recognise.
+     */
+    resolvePrincipal: (opts: {
+        issuer: string;
+        context: TContext<E, string>;
+    }) => ValueOrPromise<TNullable<IAuthUser>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACtD,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;CAC5C"}

package/dist/cjs/base/auth/authenticate/common/types/service.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=service.js.map

package/dist/cjs/base/auth/authenticate/common/types/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authenticate/common/types/strategy.d.ts

@@ -0,0 +1,26 @@
+import type { TContext } from '../../../../controllers/common/types';
+import type { IdType } from '../../../../models/common';
+import type { AnyObject } from '@venizia/ignis-helpers/common';
+import type { Env, MiddlewareHandler } from 'hono';
+import type { TChangePasswordRequest, TSignInRequest, TSignUpRequest } from '../../../models/requests';
+import type { TAuthMode } from '../constants';
+export interface IAuthUser {
+    userId: IdType;
+    [extra: string | symbol]: any;
+}
+export interface IAuthenticationStrategy<E extends Env = Env> {
+    name: string;
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+export type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {
+    strategies: string[];
+    mode?: TAuthMode;
+}) => MiddlewareHandler<RouteEnv>;
+export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest = TSignInRequest, SIRS = AnyObject, SURQ extends TSignUpRequest = TSignUpRequest, SURS = AnyObject, CPRQ extends TChangePasswordRequest = TChangePasswordRequest, CPRS = AnyObject, UIRQ = AnyObject, UIRS = AnyObject, RTRS = AnyObject> {
+    signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;
+    signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;
+    changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;
+    getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
+    refreshToken?(context: TContext<E>): Promise<RTRS>;
+}
+//# sourceMappingURL=strategy.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,GAAG,GAAG,GAAG,EAEnB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,sBAAsB,GAAG,sBAAsB,EAC5D,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS;IAEhB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/cjs/base/auth/authenticate/common/types/strategy.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=strategy.js.map

package/dist/cjs/base/auth/authenticate/common/types/strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authorize/builders/grant.builder.d.ts

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../..';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { type TNullable } from '@venizia/ignis-helpers/common';
 import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common';

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../..';
 import type { TNullable } from '@venizia/ignis-helpers/common';
 import type { TAuthorizationAction } from '../common/constants';
 /** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts

@@ -1,15 +1,49 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../..';
 import type { TNullable } from '@venizia/ignis-helpers/common';
 import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';
+import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants';
 /** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
 export type TPolicyDomainInput = string | {
     type: string;
     id: IdType;
 };
+/**
+ * Explicit on purpose: `TAuthorizationDecision` is `Extract<ValueOf<T>, string | number>`, and its
+ * literal members widen to `string` when a method's return type is inferred rather than declared.
+ * Without this annotation `grant()`'s `effect` stops satisfying `PolicyDefinition`'s narrowed column.
+ * Not exported - `TGrantRow`/`TCustomGrantRow` already name unrelated adapter-side row shapes
+ * downstream; consumers derive this shape via `ReturnType<typeof AuthorizationPolicyBuilder.grant>`.
+ */
+type TBuilderGrantRow = {
+    variant: typeof AuthorizationPolicyVariants.GRANT.action;
+    subjectType: string;
+    subjectId: IdType;
+    targetType: string;
+    targetId: IdType;
+    action: string;
+    effect: TAuthorizationDecision;
+    domainType: TNullable<string>;
+    domainId: TNullable<IdType>;
+};
+/**
+ * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read
+ * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own
+ * metadata has a different shape points the adapter at a different column
+ * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.
+ *
+ * Declared here, beside the only writer, so the column type and the row type cannot drift.
+ */
+export type TSubsetGrantMetadata = {
+    ops: string[];
+};
+type TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {
+    action: typeof AuthorizationActions.CUSTOM;
+    metadata: TSubsetGrantMetadata;
+};
 export declare class AuthorizationPolicyBuilder {
     static readonly ACTION_PRINCIPAL = "Action";
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    private static serializeDomain;
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
+    private static splitDomain;
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts: {
         subject: {
@@ -23,16 +57,7 @@ export declare class AuthorizationPolicyBuilder {
         action: string;
         domain?: TNullable<TPolicyDomainInput>;
         effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    };
+    }): TBuilderGrantRow;
     /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
     static customGrant(opts: {
         subject: {
@@ -46,19 +71,7 @@ export declare class AuthorizationPolicyBuilder {
         ops: string[];
         domain?: TNullable<TPolicyDomainInput>;
         effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-        metadata: {
-            ops: string[];
-        };
-    };
+    }): TBuilderCustomGrantRow;
     /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
     static assignRole(opts: {
         user: {
@@ -71,12 +84,13 @@ export declare class AuthorizationPolicyBuilder {
         };
         domain?: TNullable<TPolicyDomainInput>;
     }): {
+        domainType: TNullable<string>;
+        domainId: TNullable<IdType>;
         variant: "assign_role";
         subjectType: string;
         subjectId: IdType;
         targetType: string;
         targetId: IdType;
-        domain: TNullable<string>;
     };
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
     static joinDomain(opts: {
@@ -181,15 +195,7 @@ export declare class AuthorizationPolicyBuilder {
             domain?: TNullable<TPolicyDomainInput>;
             effect: TAuthorizationDecision;
         }>;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    }[];
+    }): TBuilderGrantRow[];
 }
+export {};
 //# sourceMappingURL=policy.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,yNAAyN;IACzN,OAAO,CAAC,MAAM,CAAC,eAAe;IAY9B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;IAaD,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;;;;IAcD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;;;;;;;;IAWD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;;;;;;;;;;CAsBF"}
+{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,oBAAoB,EAEpB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;GAMG;AACH,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,KAAK,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IAC/D,MAAM,EAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEF,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,sJAAsJ;IACtJ,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,gBAAgB;IAapB,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,sBAAsB;IAc1B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;oBA5Da,SAAS,CAAC,MAAM,CAAC;kBACnB,SAAS,CAAC,MAAM,CAAC;;;;;;;IAsE7B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;CAsBF"}

package/dist/cjs/base/auth/authorize/builders/policy.builder.js

@@ -4,15 +4,15 @@ exports.AuthorizationPolicyBuilder = void 0;
 const constants_1 = require("../common/constants");
 class AuthorizationPolicyBuilder {
     static { this.ACTION_PRINCIPAL = 'Action'; }
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    static serializeDomain(domain) {
-        if (domain == null) {
-            return null;
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
+    static splitDomain(domain) {
+        if (domain == null || domain === constants_1.AuthorizationDomainScopes.ANY_MEMBER) {
+            return { domainType: null, domainId: null };
         }
         if (typeof domain === 'string') {
-            return domain;
+            return { domainType: domain, domainId: null };
         }
-        return [domain.type, domain.id].join('_');
+        return { domainType: domain.type, domainId: domain.id };
     }
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts) {
@@ -24,7 +24,7 @@ class AuthorizationPolicyBuilder {
             targetId: opts.permission.id,
             action: opts.action,
             effect: opts.effect,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
         };
     }
     /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
@@ -37,7 +37,7 @@ class AuthorizationPolicyBuilder {
             targetId: opts.permission.id,
             action: constants_1.AuthorizationActions.CUSTOM,
             effect: opts.effect,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
             metadata: { ops: opts.ops },
         };
     }
@@ -49,7 +49,7 @@ class AuthorizationPolicyBuilder {
             subjectId: opts.user.id,
             targetType: opts.role.type,
             targetId: opts.role.id,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
         };
     }
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */

package/dist/cjs/base/auth/authorize/builders/policy.builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAAwF;AAKxF,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,yNAAyN;IACjN,MAAM,CAAC,eAAe,CAAC,MAAsC;QACnE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AApLH,gEAqLC"}
+{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAI6B;AAuC7B,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,sJAAsJ;IAC9I,MAAM,CAAC,WAAW,CAAC,MAAsC;QAI/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,qCAAyB,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AAvLH,gEAwLC"}