@venizia/ignis-kernel 0.3.0 → 0.3.1

package/dist/cjs/base/auth/authenticate/common/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":";;;AAAA,0DAAqD;AAErD,sDAA0D;AAE1D,kJAAkJ;AACrI,QAAA,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":";;;AAAA,0DAAqD;AAErD,sDAA0D;AAE1D,kJAAkJ;AACrI,QAAA,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;CACkD,CAAC","sourcesContent":["import { HTTP } from '@venizia/ignis-helpers/common';\nimport type { TErrorDefinition, TRegisterErrors } from '@venizia/ignis-helpers/core';\nimport { ErrorScopes } from '@venizia/ignis-helpers/core';\n\n/** Codes a client branches on for a failed authentication. A throw site may override `message` for detail; the code and status come from here. */\nexport const AuthenticationErrors = {\n  HEADER_MISSING: {\n    message: {\n      text: 'Missing authorization header',\n      code: 'core.authentication.header_missing',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  SCHEME_INVALID: {\n    message: {\n      text: 'Unsupported authorization scheme',\n      code: 'core.authentication.scheme_invalid',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  HEADER_MALFORMED: {\n    message: {\n      text: 'Malformed authorization header',\n      code: 'core.authentication.header_malformed',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  TOKEN_MISSING: {\n    message: { text: 'Missing request token', code: 'core.authentication.token_missing' },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  /** Covers expiry, a bad signature and a malformed token alike - the reason rides in `cause`, never in the code a client sees. */\n  TOKEN_INVALID: {\n    message: { text: 'Invalid or expired token', code: 'core.authentication.token_invalid' },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  TOKEN_PAYLOAD_INVALID: {\n    message: {\n      text: 'Invalid token payload',\n      code: 'core.authentication.token_payload_invalid',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  CREDENTIALS_MALFORMED: {\n    message: {\n      text: 'Malformed credentials',\n      code: 'core.authentication.credentials_malformed',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  CREDENTIALS_INVALID: {\n    message: {\n      text: 'Invalid username or password',\n      code: 'core.authentication.credentials_invalid',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  FAILED: {\n    message: { text: 'Authentication failed', code: 'core.authentication.failed' },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  USER_UNRESOLVED: {\n    message: {\n      text: 'Failed to identify authenticated user',\n      code: 'core.authentication.user_unresolved',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  ASSERTION_MISSING: {\n    message: {\n      text: 'Missing service assertion',\n      code: 'core.authentication.service.assertion_missing',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  ASSERTION_INVALID: {\n    message: {\n      text: 'Invalid service assertion',\n      code: 'core.authentication.service.assertion_invalid',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  CALLER_NOT_ALLOWED: {\n    message: {\n      text: 'Service caller is not allowed',\n      code: 'core.authentication.service.caller_not_allowed',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  REQUEST_BINDING_MISMATCH: {\n    message: {\n      text: 'Service assertion does not match this request',\n      code: 'core.authentication.service.request_binding_mismatch',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  PRINCIPAL_UNRESOLVED: {\n    message: {\n      text: 'Service caller resolved to no principal',\n      code: 'core.authentication.service.principal_unresolved',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n} as const satisfies Record<string, TErrorDefinition>;\n\ndeclare module '@venizia/ignis-helpers/core' {\n  interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthenticationErrors> {}\n}\n"]}

package/dist/cjs/base/auth/authenticate/common/index.d.ts

@@ -3,4 +3,3 @@ export * from './codecs';
 export * from './constants';
 export * from './keys';
 export * from './types';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,2CAAyB;AACzB,8CAA4B;AAC5B,yCAAuB;AACvB,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,2CAAyB;AACzB,8CAA4B;AAC5B,yCAAuB;AACvB,0CAAwB","sourcesContent":["export * from './errors';\nexport * from './codecs';\nexport * from './constants';\nexport * from './keys';\nexport * from './types';\n"]}

package/dist/cjs/base/auth/authenticate/common/keys.d.ts

@@ -6,4 +6,3 @@ export declare class AuthenticateBindingKeys {
     static readonly SERVICE_OPTIONS = "@app/authenticate/service-options";
     static readonly SERVICE_CERTS_PATH = "@app/authenticate/service-certs-path";
 }
-//# sourceMappingURL=keys.d.ts.map

package/dist/cjs/base/auth/authenticate/common/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC;;AAN9E,0DAOC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC;;AAN9E,0DAOC","sourcesContent":["export class AuthenticateBindingKeys {\n  static readonly REST_OPTIONS = '@app/authenticate/rest-options';\n  static readonly JWT_OPTIONS = '@app/authenticate/jwt-options';\n  static readonly JWKS_OPTIONS = '@app/authenticate/jwks-options';\n  static readonly BASIC_OPTIONS = '@app/authenticate/basic-options';\n  static readonly SERVICE_OPTIONS = '@app/authenticate/service-options';\n  static readonly SERVICE_CERTS_PATH = '@app/authenticate/service-certs-path';\n}\n"]}

package/dist/cjs/base/auth/authenticate/common/types/basic.d.ts

@@ -11,4 +11,3 @@ export type TBasicTokenServiceOptions<E extends Env = Env> = {
         context: TContext<E, string>;
     }) => Promise<IAuthUser | null>;
 };
-//# sourceMappingURL=basic.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/basic.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":""}
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":"","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport type { Env } from 'hono';\nimport type { IAuthUser } from './strategy';\n\nexport type TBasicTokenServiceOptions<E extends Env = Env> = {\n  /** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */\n  verifyCredentials: (opts: {\n    credentials: { username: string; password: string };\n    context: TContext<E, string>;\n  }) => Promise<IAuthUser | null>;\n};\n"]}

package/dist/cjs/base/auth/authenticate/common/types/index.d.ts

@@ -4,4 +4,3 @@ export * from './options';
 export * from './rest';
 export * from './service';
 export * from './strategy';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,wCAAsB;AACtB,4CAA0B;AAC1B,yCAAuB;AACvB,4CAA0B;AAC1B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,wCAAsB;AACtB,4CAA0B;AAC1B,yCAAuB;AACvB,4CAA0B;AAC1B,6CAA2B","sourcesContent":["export * from './basic';\nexport * from './jwt';\nexport * from './options';\nexport * from './rest';\nexport * from './service';\nexport * from './strategy';\n"]}

package/dist/cjs/base/auth/authenticate/common/types/jwt.d.ts

@@ -134,4 +134,3 @@ export interface IPayloadFieldCodec<T = unknown> {
     }): T;
 }
 export type TGetTokenExpiresFn = () => ValueOrPromise<number>;
-//# sourceMappingURL=jwt.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":""}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base/models/common';\nimport type { ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';\nimport type { JWTPayload } from 'jose';\nimport type { JOSEStandards, JWKSModes, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';\nimport type { IAuthUser } from './strategy';\n\n/**\n * Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`\n * exactly, so this is a pass-through with no translation layer.\n *\n * Every field is optional and unset by default, which is today's behaviour: nothing is checked\n * beyond the signature and the time claims. In a fleet where every verifier points at the same\n * issuer JWKS, that means a token minted for one service is accepted verbatim by every other -\n * `audience` is what makes \"this token was meant for me\" a cryptographic statement rather than a\n * convention.\n */\nexport interface IJWTVerifyOptions {\n  /** Expected `aud`. Setting it makes the claim required. Matching is jose's OVERLAP semantics, not equality: a token carrying `['a','b']` satisfies `audience: 'a'`. Enforce single-valued audiences at issue time if that matters. */\n  audience?: string | string[];\n\n  /** Expected `iss`. Setting it makes the claim required. */\n  issuer?: string | string[];\n\n  /** Expected `sub`. Setting it makes the claim required. */\n  subject?: string;\n\n  /** Clock skew tolerance: seconds, or a jose duration string such as `'30 seconds'`. */\n  clockTolerance?: string | number;\n\n  /** Accepted JWS `alg` header values. Unset means the accepted algorithm is decided entirely by what the JWKS serves. */\n  algorithms?: string[];\n\n  /** Caps elapsed time since `iat`. The real replay window for a short-lived assertion, independent of whatever `exp` the caller chose to stamp. */\n  maxTokenAge?: string | number;\n\n  /** Expected JWS `typ` header. The standard defence against cross-token-type confusion when one JWKS serves more than one kind of token. */\n  typ?: string;\n\n  /** Claims that must be present, beyond those implied by the checks above. */\n  requiredClaims?: string[];\n}\n\n/** Default `iss` / `aud` stamped on every issued token. Configured values are AUTHORITATIVE - see {@link IJWTIssueClaims}. */\nexport interface IJWTSignOptions {\n  issuer?: string;\n  audience?: string | string[];\n}\n\n/**\n * Per-token registered claims, passed to `generate()`.\n *\n * This is the supported way to vary `aud` or `sub` per token. Putting them on the payload used to\n * work by accident - `iss`, `aud`, `sub` and `jti` ride through the AES envelope in the clear\n * because they are standard JWT fields - but a claim the payload can set is a claim any caller who\n * shapes the payload can forge. These win over {@link IJWTSignOptions}; the payload never does.\n */\nexport interface IJWTIssueClaims {\n  issuer?: string;\n  audience?: string | string[];\n  subject?: string;\n  jwtId?: string;\n}\n\nexport interface IJWSTokenServiceOptions {\n  headerAlgorithm?: string;\n  jwtSecret: string;\n  getTokenExpiresFn: TGetTokenExpiresFn;\n  aesAlgorithm?: AESAlgorithmType;\n  applicationSecret?: string;\n  fieldCodecs?: IPayloadFieldCodec[];\n  /** Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. */\n  cipher?: IPayloadCipher;\n\n  /** Claim checks applied on verify. Unset means signature and time claims only. */\n  verify?: IJWTVerifyOptions;\n\n  /** Claims stamped on every issued token. A configured value WINS over one supplied in the payload. */\n  sign?: IJWTSignOptions;\n}\n\nexport type TJWKSAlgorithm = 'ES256' | 'RS256' | 'EdDSA';\n\nexport interface IJWKSIssuerOptions {\n  mode: typeof JWKSModes.ISSUER;\n  algorithm: TJWKSAlgorithm;\n  rest?: { path: string };\n  keys: {\n    driver: TJWKSKeyDriver;\n    format: TJWKSKeyFormat;\n    private: string; // Key content (text) or file path (file) — PEM or JWK based on format\n    public: string; // Key content (text) or file path (file) — PEM or JWK based on format\n  };\n  kid: string;\n  getTokenExpiresFn: TGetTokenExpiresFn;\n  aesAlgorithm?: AESAlgorithmType;\n  applicationSecret?: string;\n  fieldCodecs?: IPayloadFieldCodec[];\n  /** Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. */\n  cipher?: IPayloadCipher;\n\n  /** Claim checks applied on verify. Unset means signature and time claims only. */\n  verify?: IJWTVerifyOptions;\n\n  /** Claims stamped on every issued token. A configured value WINS over one supplied in the payload. */\n  sign?: IJWTSignOptions;\n}\n\nexport interface IJWKSVerifierOptions {\n  mode: typeof JWKSModes.VERIFIER;\n  jwksUrl: string;\n  cacheTtlMs?: number; // Default: 43_200_000 (12h)\n  cooldownMs?: number; // Default: 30_000 (30s)\n  aesAlgorithm?: AESAlgorithmType;\n  applicationSecret?: string;\n  fieldCodecs?: IPayloadFieldCodec[];\n  /** Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. */\n  cipher?: IPayloadCipher;\n\n  /** Claim checks applied on verify. Unset means signature and time claims only. */\n  verify?: IJWTVerifyOptions;\n}\n\nexport type TJWKSTokenServiceOptions = IJWKSIssuerOptions | IJWKSVerifierOptions;\n\nexport type TJWTTokenServiceOptions =\n  | { standard: typeof JOSEStandards.JWS; options: IJWSTokenServiceOptions }\n  | { standard: typeof JOSEStandards.JWKS; options: TJWKSTokenServiceOptions };\n\nexport interface IJWTTokenPayload extends JWTPayload, IAuthUser {\n  userId: IdType;\n  roles: { id: IdType; identifier: string; priority: number }[];\n\n  clientId?: string;\n  provider?: string;\n  email?: string;\n  name?: string;\n\n  [extra: string | symbol]: any;\n}\n\nexport interface IPayloadFieldCodec<T = unknown> {\n  key: string;\n  serialize(opts: { value: T }): string;\n  deserialize(opts: { raw: string }): T;\n}\n\nexport type TGetTokenExpiresFn = () => ValueOrPromise<number>;\n"]}

package/dist/cjs/base/auth/authenticate/common/types/options.d.ts

@@ -12,4 +12,3 @@ export interface IAuthenticateOptions {
     basicOptions?: TBasicTokenServiceOptions;
     serviceOptions?: IServiceAuthOptions;
 }
-//# sourceMappingURL=options.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/options.ts"],"names":[],"mappings":""}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/options.ts"],"names":[],"mappings":"","sourcesContent":["import type { TBasicTokenServiceOptions } from './basic';\nimport type { TJWTTokenServiceOptions } from './jwt';\nimport type { TAuthenticationRestOptions } from './rest';\nimport type { IServiceAuthOptions } from './service';\n\n/**\n * Composes the four topic option types into the framework's single authenticate config knob.\n * The only file in this folder allowed more than one sibling import - it is their parent.\n */\nexport interface IAuthenticateOptions {\n  restOptions?: TAuthenticationRestOptions;\n  jwtOptions?: TJWTTokenServiceOptions;\n  basicOptions?: TBasicTokenServiceOptions;\n  serviceOptions?: IServiceAuthOptions;\n}\n"]}

package/dist/cjs/base/auth/authenticate/common/types/rest.d.ts

@@ -46,4 +46,3 @@ export type TAuthenticationRestOptions = {} & ({
     useAuthController: true;
     controllerOpts: TDefineAuthControllerOpts;
 });
-//# sourceMappingURL=rest.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/rest.js.map

@@ -1 +1 @@
-{"version":3,"file":"rest.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/rest.ts"],"names":[],"mappings":""}
+{"version":3,"file":"rest.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/rest.ts"],"names":[],"mappings":"","sourcesContent":["import type { TAnyObjectSchema } from '@/base/controllers/common/schema-builders';\n\nexport type TDefineAuthControllerOpts = {\n  restPath?: string;\n  serviceKey: string;\n  requireAuthenticatedSignUp?: boolean;\n  payload?: {\n    signIn?: {\n      request: { schema: TAnyObjectSchema };\n      response: { schema: TAnyObjectSchema };\n    };\n    signUp?: {\n      request: { schema: TAnyObjectSchema };\n      response: { schema: TAnyObjectSchema };\n    };\n    changePassword?: {\n      request: { schema?: TAnyObjectSchema };\n      response: { schema: TAnyObjectSchema };\n    };\n    refreshToken?: {\n      response: { schema: TAnyObjectSchema };\n    };\n    getUserInformation?: {\n      response: { schema: TAnyObjectSchema };\n    };\n  };\n};\n\nexport type TAuthenticationRestOptions = {} & (\n  | { useAuthController?: false | undefined }\n  | {\n      useAuthController: true;\n      controllerOpts: TDefineAuthControllerOpts;\n    }\n);\n"]}

package/dist/cjs/base/auth/authenticate/common/types/service.d.ts

@@ -92,4 +92,3 @@ export interface IServiceAuthOptions<E extends Env = Env> {
         context: TContext<E, string>;
     }) => ValueOrPromise<TNullable<IAuthUser>>;
 }
-//# sourceMappingURL=service.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":""}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":"","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport type { TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport type { JWTPayload } from 'jose';\nimport type { TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';\nimport type { IAuthUser } from './strategy';\n\n/**\n * The request binding, following RFC 9449's `htm`/`htu`. A captured assertion cannot be replayed\n * against a different method or path.\n *\n * `htu` is the percent-ENCODED pathname on both ends. Compare it against\n * `new URL(context.req.url).pathname`, never `context.req.path` - Hono hands that one back DECODED,\n * so any route carrying a space or a non-ASCII slug would never match what the caller signed.\n */\nexport interface IServiceAssertionClaims extends JWTPayload {\n  htm: string;\n  htu: string;\n}\n\n/**\n * One entry in the caller allowlist: the JWKS url, or that url plus settings for this caller alone.\n */\nexport type TServiceCallerEntry =\n  | string\n  | {\n      jwksUrl: string;\n      /** Widens the accepted age for THIS caller only. Falls back to the service-wide setting. */\n      acceptMaxAgeSeconds?: number;\n    };\n\n/** Service-to-service authentication: an Ed25519 assertion per request, verified against the caller's JWKS. */\nexport interface IServiceAuthOptions<E extends Env = Env> {\n  /** What this service calls itself: the `iss` it stamps, and the `aud` it demands. */\n  name: string;\n\n  /**\n   * Present only on a service that CALLS OUT. Absent means verify-only, and no certs route is\n   * mounted - which is the common case, since most services are called and never call.\n   */\n  keys?: {\n    driver: TJWKSKeyDriver;\n    format: TJWKSKeyFormat;\n    /** PEM or JWK by `format`; content for the `text` driver, a path for `file`. */\n    private: string;\n    public: string;\n    kid?: string;\n  };\n\n  /**\n   * Caller name to its JWKS url. THIS IS ALSO THE ALLOWLIST - a name absent from the map cannot\n   * call, and an empty map correctly allows nobody.\n   *\n   * The bare-string form is the common case. The object form exists to widen the accepted age for\n   * ONE caller: a nightly batch may legitimately need more slack than an interactive service, and\n   * granting it per caller keeps the concession named and visible in config.\n   */\n  callers?: Record<string, TServiceCallerEntry>;\n\n  /** Where the certs route is mounted. Defaults to `ServiceAssertion.DEFAULT_REST_PATH`. */\n  rest?: { path: string };\n\n  /**\n   * How long the assertions this service MINTS stay valid. Only meaningful where `keys` is set.\n   */\n  signLifetimeSeconds?: number;\n\n  /**\n   * The oldest assertion this service ACCEPTS, measured from `iat`.\n   *\n   * Deliberately separate from `signLifetimeSeconds`, and deliberately not requestable by the\n   * caller. The caller already controls `exp` - it signs the token - so this is the only bound that\n   * survives a compromised caller. A per-caller override belongs in {@link callers}, never in the\n   * assertion.\n   *\n   * Composes with `clockToleranceSeconds`: the real acceptance window is the sum of the two.\n   */\n  acceptMaxAgeSeconds?: number;\n\n  /**\n   * Clock skew allowance. A SECURITY knob, not an operational one.\n   *\n   * Its job is the future case: two machines never agree to the second, and without it a caller one\n   * second ahead is refused outright. But it also widens the REPLAY window second for second - a\n   * callee accepting an `iat` 5s in its own future keeps accepting that token for the rest of the\n   * window too. Measured at the defaults: 65s accepted on our clock, 70s of wall-clock life for a\n   * capture minted by a caller running the full tolerance fast.\n   */\n  clockToleranceSeconds?: number;\n\n  jwks?: { cacheMaxAgeMs?: number; cooldownMs?: number };\n\n  /**\n   * WHO a verified assertion acts as. The framework has already proven the caller; this only maps a\n   * caller name onto an application principal. Return `null` to refuse a caller the allowlist\n   * admits but the application does not recognise.\n   */\n  resolvePrincipal: (opts: {\n    issuer: string;\n    context: TContext<E, string>;\n  }) => ValueOrPromise<TNullable<IAuthUser>>;\n}\n"]}

package/dist/cjs/base/auth/authenticate/common/types/strategy.d.ts

@@ -23,4 +23,3 @@ export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest =
     getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
     refreshToken?(context: TContext<E>): Promise<RTRS>;
 }
-//# sourceMappingURL=strategy.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":""}
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":"","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport type { IdType } from '@/base/models/common';\nimport type { AnyObject } from '@venizia/ignis-helpers/common';\nimport type { Env, MiddlewareHandler } from 'hono';\nimport type {\n  TChangePasswordRequest,\n  TSignInRequest,\n  TSignUpRequest,\n} from '../../../models/requests';\nimport type { TAuthMode } from '../constants';\n\nexport interface IAuthUser {\n  userId: IdType;\n  [extra: string | symbol]: any;\n}\n\nexport interface IAuthenticationStrategy<E extends Env = Env> {\n  name: string;\n  authenticate(context: TContext<E, string>): Promise<IAuthUser>;\n}\n\nexport type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {\n  strategies: string[];\n  mode?: TAuthMode;\n}) => MiddlewareHandler<RouteEnv>;\n\nexport interface IAuthService<\n  E extends Env = Env,\n  // SignIn types\n  SIRQ extends TSignInRequest = TSignInRequest,\n  SIRS = AnyObject,\n  // SignUp types\n  SURQ extends TSignUpRequest = TSignUpRequest,\n  SURS = AnyObject,\n  // ChangePassword types\n  CPRQ extends TChangePasswordRequest = TChangePasswordRequest,\n  CPRS = AnyObject,\n  // UserInformation types\n  UIRQ = AnyObject,\n  UIRS = AnyObject,\n  // RefreshToken types\n  RTRS = AnyObject,\n> {\n  signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;\n  signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;\n  changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;\n  getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;\n  refreshToken?(context: TContext<E>): Promise<RTRS>;\n}\n"]}

package/dist/cjs/base/auth/authenticate/index.d.ts

@@ -2,4 +2,3 @@ export * from './common';
 export * from './middlewares';
 export * from './providers';
 export * from './strategies';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/base/auth/authenticate/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,gDAA8B;AAC9B,8CAA4B;AAC5B,+CAA6B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/base/auth/authenticate/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,gDAA8B;AAC9B,8CAA4B;AAC5B,+CAA6B","sourcesContent":["export * from './common';\nexport * from './middlewares';\nexport * from './providers';\nexport * from './strategies';\n"]}

package/dist/cjs/base/auth/authenticate/middlewares/authenticate.middleware.d.ts

@@ -4,4 +4,3 @@ export declare const authenticate: (opts: {
     strategies: string[];
     mode?: TAuthMode;
 }) => import("hono").MiddlewareHandler<Env>;
-//# sourceMappingURL=authenticate.middleware.d.ts.map

package/dist/cjs/base/auth/authenticate/middlewares/authenticate.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.middleware.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/middlewares/authenticate.middleware.ts"],"names":[],"mappings":";;;AAEA,4CAAsD;AAEtD,MAAM,sBAAsB,GAAG,IAAI,kCAAsB,EAAO,CAAC;AACjE,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,EAAE,CAAC;AAE/C,MAAM,YAAY,GAAG,CAAC,IAAgD,EAAE,EAAE;IAC/E,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAFW,QAAA,YAAY,gBAEvB"}
+{"version":3,"file":"authenticate.middleware.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/middlewares/authenticate.middleware.ts"],"names":[],"mappings":";;;AAEA,4CAAsD;AAEtD,MAAM,sBAAsB,GAAG,IAAI,kCAAsB,EAAO,CAAC;AACjE,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,EAAE,CAAC;AAE/C,MAAM,YAAY,GAAG,CAAC,IAAgD,EAAE,EAAE;IAC/E,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAFW,QAAA,YAAY,gBAEvB","sourcesContent":["import type { Env } from 'hono';\nimport type { TAuthMode } from '../common';\nimport { AuthenticationProvider } from '../providers';\n\nconst authenticationProvider = new AuthenticationProvider<Env>();\nconst authenticateFn = authenticationProvider.value();\n\nexport const authenticate = (opts: { strategies: string[]; mode?: TAuthMode }) => {\n  return authenticateFn(opts);\n};\n"]}

package/dist/cjs/base/auth/authenticate/middlewares/index.d.ts

@@ -1,2 +1 @@
 export * from './authenticate.middleware';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/middlewares/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C","sourcesContent":["export * from './authenticate.middleware';\n"]}

package/dist/cjs/base/auth/authenticate/providers/authentication.provider.d.ts

@@ -10,4 +10,3 @@ export declare class AuthenticationProvider<RouteEnv extends Env = Env> extends
     private executeAllMode;
     private setCurrentUser;
 }
-//# sourceMappingURL=authentication.provider.d.ts.map

package/dist/cjs/base/auth/authenticate/providers/authentication.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.provider.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/providers/authentication.provider.ts"],"names":[],"mappings":";;;AACA,sDAAmE;AACnE,0DAAqD;AAGrD,0CAAgD;AAEhD,sCAAsF;AACtF,uEAAiF;AAEjF,MAAa,sBACX,SAAQ,iBAAU;IAGlB;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,EAAE;YACZ,OAAO,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC;IACJ,CAAC;IAEO,4BAA4B,CAAC,IAAgD;QACnF,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,4BAAmB,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,kDAA8B,CAAC,WAAW,EAAE,CAAC;QAE9D,OAAO,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,mBAAmB,CAAC,CAAC;YAC3E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC;qBAC3C,KAAK,CAAC,yCAAyC,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,4BAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC7B,MAAM,IAAI,CAAC,cAAc,CAAC;wBACxB,OAAO,EAAE,OAAmB;wBAC5B,UAAU;wBACV,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,KAAK,4BAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC7B,MAAM,IAAI,CAAC,cAAc,CAAC;wBACxB,OAAO,EAAE,OAAmB;wBAC5B,UAAU;wBACV,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,uCAAuC,IAAI,EAAE;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAK5B;QACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErD,8HAA8H;QAC9H,IAAI,cAAuB,CAAC;QAE5B,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvC,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,cAAc,KAAK,KAAK,CAAC;gBACzB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,KAAK,CAAC,gDAAgD,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,6BAAoB,CAAC,MAAM;gBAClC,OAAO,EAAE,4CAA4C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5E,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,cAAc;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAK5B;QACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErD,sGAAsG;QACtG,IAAI,QAAQ,GAAqB,IAAI,CAAC;QAEtC,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAElD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAED,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CACJ,+DAA+D,EAC/D,QAAQ,EACR,QAAQ,EAAE,MAAM,CACjB,CAAC;YACJ,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,6BAAoB,CAAC,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,IAA4C;QACjE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAE/C,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AA7ID,wDA6IC"}
+{"version":3,"file":"authentication.provider.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/providers/authentication.provider.ts"],"names":[],"mappings":";;;AACA,sDAAmE;AACnE,0DAAqD;AAGrD,0CAAgD;AAEhD,sCAAsF;AACtF,uEAAiF;AAEjF,MAAa,sBACX,SAAQ,iBAAU;IAGlB;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,EAAE;YACZ,OAAO,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC;IACJ,CAAC;IAEO,4BAA4B,CAAC,IAAgD;QACnF,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,4BAAmB,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,kDAA8B,CAAC,WAAW,EAAE,CAAC;QAE9D,OAAO,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,mBAAmB,CAAC,CAAC;YAC3E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC;qBAC3C,KAAK,CAAC,yCAAyC,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,4BAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC7B,MAAM,IAAI,CAAC,cAAc,CAAC;wBACxB,OAAO,EAAE,OAAmB;wBAC5B,UAAU;wBACV,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,KAAK,4BAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC7B,MAAM,IAAI,CAAC,cAAc,CAAC;wBACxB,OAAO,EAAE,OAAmB;wBAC5B,UAAU;wBACV,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,uCAAuC,IAAI,EAAE;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAK5B;QACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErD,8HAA8H;QAC9H,IAAI,cAAuB,CAAC;QAE5B,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvC,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,cAAc,KAAK,KAAK,CAAC;gBACzB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,KAAK,CAAC,gDAAgD,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,6BAAoB,CAAC,MAAM;gBAClC,OAAO,EAAE,4CAA4C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5E,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,cAAc;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAK5B;QACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErD,sGAAsG;QACtG,IAAI,QAAQ,GAAqB,IAAI,CAAC;QAEtC,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAElD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAED,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CACJ,+DAA+D,EAC/D,QAAQ,EACR,QAAQ,EAAE,MAAM,CACjB,CAAC;YACJ,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,6BAAoB,CAAC,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,IAA4C;QACjE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAE/C,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,uBAAc,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AA7ID,wDA6IC","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { IProvider } from '@venizia/ignis-inversion';\nimport type { Env } from 'hono';\nimport { createMiddleware } from 'hono/factory';\nimport type { IAuthUser, TAuthenticateFn, TAuthMode } from '../common';\nimport { Authentication, AuthenticationErrors, AuthenticationModes } from '../common';\nimport { AuthenticationStrategyRegistry } from '../strategies/strategy-registry';\n\nexport class AuthenticationProvider<RouteEnv extends Env = Env>\n  extends BaseHelper\n  implements IProvider<TAuthenticateFn<RouteEnv>>\n{\n  constructor() {\n    super({ scope: AuthenticationProvider.name });\n  }\n\n  value(): TAuthenticateFn<RouteEnv> {\n    return opts => {\n      return this.createAuthenticateMiddleware(opts);\n    };\n  }\n\n  private createAuthenticateMiddleware(opts: { strategies: string[]; mode?: TAuthMode }) {\n    const { strategies, mode = AuthenticationModes.ANY } = opts;\n    const registry = AuthenticationStrategyRegistry.getInstance();\n\n    return createMiddleware(async (context, next) => {\n      const isSkipAuthenticate = context.get(Authentication.SKIP_AUTHENTICATION);\n      if (isSkipAuthenticate) {\n        this.logger\n          .for(this.createAuthenticateMiddleware.name)\n          .debug('SKIP checking authentication | path: %s', context.req.path);\n        return next();\n      }\n\n      const isAuthenticated = context.get(Authentication.CURRENT_USER);\n      if (isAuthenticated) {\n        return next();\n      }\n\n      switch (mode) {\n        case AuthenticationModes.ANY: {\n          await this.executeAnyMode({\n            context: context as TContext,\n            strategies,\n            registry,\n            next,\n          });\n          return;\n        }\n        case AuthenticationModes.ALL: {\n          await this.executeAllMode({\n            context: context as TContext,\n            strategies,\n            registry,\n            next,\n          });\n          return;\n        }\n        default: {\n          throw getError({\n            statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n            message: `Invalid authentication mode | mode: ${mode}`,\n          });\n        }\n      }\n    });\n  }\n\n  private async executeAnyMode(opts: {\n    context: TContext;\n    strategies: string[];\n    registry: AuthenticationStrategyRegistry;\n    next: () => Promise<void>;\n  }) {\n    const { context, strategies, registry, next } = opts;\n\n    // The first strategy's failure is the primary one - kept so the 401 carries WHY, instead of only which strategies were tried.\n    let primaryFailure: unknown;\n\n    for (const strategyName of strategies) {\n      try {\n        const strategy = registry.resolveStrategy({ name: strategyName });\n        const user = await strategy.authenticate(context);\n        this.setCurrentUser({ context, user });\n        break;\n      } catch (error) {\n        primaryFailure ??= error;\n        this.logger\n          .for(this.executeAnyMode.name)\n          .debug('Strategy %s failed, trying next... | Error: %s', strategyName, error);\n      }\n    }\n\n    const currentUser = context.get(Authentication.CURRENT_USER);\n    if (!currentUser) {\n      throw getError({\n        error: AuthenticationErrors.FAILED,\n        message: `Authentication failed. Tried strategies: ${strategies.join(', ')}`,\n        logLevel: 'warn',\n        cause: primaryFailure,\n      });\n    }\n\n    await next();\n  }\n\n  private async executeAllMode(opts: {\n    context: TContext;\n    strategies: string[];\n    registry: AuthenticationStrategyRegistry;\n    next: () => Promise<void>;\n  }) {\n    const { context, strategies, registry, next } = opts;\n\n    // Use the first strategy's user as the identity source - all must succeed but first wins for identity\n    let authUser: IAuthUser | null = null;\n\n    for (const strategyName of strategies) {\n      const strategy = registry.resolveStrategy({ name: strategyName });\n      const user = await strategy.authenticate(context);\n\n      authUser ??= user;\n    }\n\n    if (authUser?.userId) {\n      this.setCurrentUser({ context, user: authUser });\n    } else {\n      this.logger\n        .for(this.executeAllMode.name)\n        .error(\n          'Failed to identify authenticated user | user: %j | userId: %s',\n          authUser,\n          authUser?.userId,\n        );\n      throw getError({ error: AuthenticationErrors.USER_UNRESOLVED });\n    }\n\n    return next();\n  }\n\n  private setCurrentUser(opts: { context: TContext; user: IAuthUser }) {\n    const { context, user } = opts;\n    context.set(Authentication.CURRENT_USER, user);\n\n    if (user?.userId) {\n      context.set(Authentication.AUDIT_USER_ID, user.userId);\n    }\n  }\n}\n"]}

package/dist/cjs/base/auth/authenticate/providers/index.d.ts

@@ -1,2 +1 @@
 export * from './authentication.provider';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/providers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/providers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C","sourcesContent":["export * from './authentication.provider';\n"]}

package/dist/cjs/base/auth/authenticate/strategies/index.d.ts

@@ -1,2 +1 @@
 export * from './strategy-registry';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/strategies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC","sourcesContent":["export * from './strategy-registry';\n"]}

package/dist/cjs/base/auth/authenticate/strategies/strategy-registry.d.ts

@@ -55,4 +55,3 @@ export declare class AuthenticationStrategyRegistry extends AbstractAuthRegistry
         scope?: string;
     }): void;
 }
-//# sourceMappingURL=strategy-registry.d.ts.map

package/dist/cjs/base/auth/authenticate/strategies/strategy-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"strategy-registry.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/strategies/strategy-registry.ts"],"names":[],"mappings":";;;AACA,+DAA2D;AAE3D,sDAAuD;AACvD,qCAAkD;AAElD,sCAA2C;AAE3C,MAAa,8BAA+B,SAAQ,2BAA6C;aAC/E,uBAAkB,GAAG,kCAAkC,CAAC;IAExE;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,8BAA8B,CAAC,kBAAkB;YACtD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,8BAA8B,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAES,gBAAgB;QACxB,OAAO,uBAAc,CAAC,uBAAuB,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,IAGR;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAEvC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,IAAsB;QACpC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,IAAyB;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,IAAyC;QACxD,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,IAAI,KAAK,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACvO,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAyC;QAC1D,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACjC,KAAK,CACJ,uHAAuH,EACvH,KAAK,EACL,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAC;IACN,CAAC;;AApGH,wEAqGC"}
+{"version":3,"file":"strategy-registry.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/strategies/strategy-registry.ts"],"names":[],"mappings":";;;AACA,+DAA2D;AAE3D,sDAAuD;AACvD,qCAAkD;AAElD,sCAA2C;AAE3C,MAAa,8BAA+B,SAAQ,2BAA6C;aAC/E,uBAAkB,GAAG,kCAAkC,CAAC;IAExE;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,8BAA8B,CAAC,kBAAkB;YACtD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,8BAA8B,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAES,gBAAgB;QACxB,OAAO,uBAAc,CAAC,uBAAuB,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,IAGR;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAEvC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,IAAsB;QACpC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,IAAyB;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,IAAyC;QACxD,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,IAAI,KAAK,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACvO,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAyC;QAC1D,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACjC,KAAK,CACJ,uHAAuH,EACvH,KAAK,EACL,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAC;IACN,CAAC;;AApGH,wEAqGC","sourcesContent":["import type { Container } from '@/helpers/inversion/container';\nimport { SingletonRealm } from '@/helpers/singleton-realm';\nimport type { TClass } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { AbstractAuthRegistry } from '../../base';\nimport type { IAuthenticationStrategy } from '../common';\nimport { Authentication } from '../common';\n\nexport class AuthenticationStrategyRegistry extends AbstractAuthRegistry<IAuthenticationStrategy> {\n  static readonly SINGLETON_REAL_KEY = 'authentication-strategy-registry';\n\n  constructor() {\n    super({ scope: AuthenticationStrategyRegistry.name });\n  }\n\n  static getInstance() {\n    return SingletonRealm.resolve({\n      key: AuthenticationStrategyRegistry.SINGLETON_REAL_KEY,\n      create: () => new AuthenticationStrategyRegistry(),\n    });\n  }\n\n  protected getBindingPrefix(): string {\n    return Authentication.AUTHENTICATION_STRATEGY;\n  }\n\n  register(opts: {\n    container: Container;\n    strategies: { strategy: TClass<IAuthenticationStrategy>; name: string }[];\n  }) {\n    const { container, strategies } = opts;\n\n    for (const { strategy, name } of strategies) {\n      this.registerDescriptor({ container, target: strategy, name });\n    }\n\n    return this;\n  }\n\n  resolveStrategy(opts: { name: string }): IAuthenticationStrategy {\n    return this.resolveDescriptor(opts);\n  }\n\n  /**\n   * The names on this list that no registered strategy answers to.\n   *\n   * An EMPTY list yields nothing - it is the framework's own encoding of\n   * `authenticate: { skip: true }`, so treating it as a problem would flag every public route.\n   *\n   * Nothing is reported while the registry is empty. Route configs are built during\n   * `registerControllers()`, after `preConfigure()` and `registerComponents()`, so a real\n   * application has registered by then; an empty registry means this is running outside that\n   * lifecycle - a unit test on a controller - where no name could resolve either way.\n   */\n  findUnregistered(opts: { names: string[] }): string[] {\n    const { names } = opts;\n\n    if (names.length === 0 || this.descriptors.size === 0) {\n      return [];\n    }\n\n    return names.filter(name => !this.has({ name }));\n  }\n\n  /**\n   * Refuses to continue past an unregistered name. For an APPLICATION's own startup check.\n   *\n   * The framework does NOT call this - it reports instead. A hard failure cannot be the default\n   * here: a route listing several strategies in ANY mode tolerates one that does not resolve, and\n   * `defineAuthController` hard-codes `'jwt'` on four of its routes, so an application that\n   * registers its JWT strategy under a different name works today and would stop booting.\n   */\n  assertRegistered(opts: { names: string[]; scope?: string }): void {\n    const { names, scope = 'route' } = opts;\n\n    const unregistered = this.findUnregistered({ names });\n    if (unregistered.length === 0) {\n      return;\n    }\n\n    throw getError({\n      message: `[${scope}] Unknown authentication strategy | unregistered: ${unregistered.join(', ')} | registered: ${this.getNames().join(', ')} | register it with AuthenticationStrategyRegistry.register() before controllers are bound`,\n    });\n  }\n\n  /**\n   * Names an unregistered strategy at boot, at a level someone sees. Never throws.\n   *\n   * This is what replaces the guard the open `TAuthStrategy` gave up: `resolveStrategy` throws at\n   * request time, the provider's ANY mode swallows it at DEBUG, and the route 401s with nothing to\n   * explain why.\n   */\n  reportUnregistered(opts: { names: string[]; scope?: string }): void {\n    const { names, scope = 'route' } = opts;\n\n    const unregistered = this.findUnregistered({ names });\n    if (unregistered.length === 0) {\n      return;\n    }\n\n    this.logger\n      .for(this.reportUnregistered.name)\n      .error(\n        '[%s] Unknown authentication strategy - requests relying on it cannot authenticate | unregistered: %s | registered: %s',\n        scope,\n        unregistered.join(', '),\n        this.getNames().join(', '),\n      );\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/builders/grant.builder.d.ts

@@ -72,4 +72,3 @@ export declare class GrantBuilder extends BaseHelper {
         tierRow: (tier: TAuthorizationAction) => TPlannedGrantRow;
     }): void;
 }
-//# sourceMappingURL=grant.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/grant.builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":";;;AAAA,+DAA2D;AAE3D,sDAAmE;AAEnE,sCAOmB;AACnB,qDAAuF;AAEvF,2IAA2I;AAC3I,MAAM,oBAAoB,GAAG,CAAC,IAA8B,EAAW,EAAE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,6BAAoB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAa,YAAa,SAAQ,iBAAU;aAC1B,uBAAkB,GAAG,eAAe,CAAC;IAErD,8FAA8F;aACtE,oBAAe,GAAG,IAAI,GAAG,CAAS;QACxD,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;QAC5B,6BAAoB,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,oGAAoG;aAC5E,iBAAY,GAAwC;QAC1E,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;KAC7B,CAAC;IAEF;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,YAAY,CAAC,kBAAkB;YACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAyB,IAAgC;QACrE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+JAA+J;IAC/J,wBAAwB,CAAC,IAA2B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,uMAAuM;IACvM,sBAAsB,CAAC,IAItB;QACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAoC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gSAAgS;IAChS,SAAS,CAAC,IAST;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,+BAAsB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,2CAA0B,CAAC,KAAK,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxB,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gDAAgD,IAAI,CAAC,QAAQ,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAA0B,EAAE,EAAE,CAC7C,2CAA0B,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEL,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC;QAE3F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,WAAW,CAAC;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9D,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sGAAsG;IAC5F,0BAA0B,CAAC,IAKpC;QACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAE1D,uMAAuM;QACvM,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,6BAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,cAAc;aAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9B,IACE,mBAAmB;YACnB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,6BAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc;iBAC3B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;;AAvRH,oCAwRC"}
+{"version":3,"file":"grant.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":";;;AAAA,+DAA2D;AAE3D,sDAAmE;AAEnE,sCAOmB;AACnB,qDAAuF;AAEvF,2IAA2I;AAC3I,MAAM,oBAAoB,GAAG,CAAC,IAA8B,EAAW,EAAE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,6BAAoB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAa,YAAa,SAAQ,iBAAU;aAC1B,uBAAkB,GAAG,eAAe,CAAC;IAErD,8FAA8F;aACtE,oBAAe,GAAG,IAAI,GAAG,CAAS;QACxD,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;QAC5B,6BAAoB,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,oGAAoG;aAC5E,iBAAY,GAAwC;QAC1E,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;KAC7B,CAAC;IAEF;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,YAAY,CAAC,kBAAkB;YACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAyB,IAAgC;QACrE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+JAA+J;IAC/J,wBAAwB,CAAC,IAA2B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,uMAAuM;IACvM,sBAAsB,CAAC,IAItB;QACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAoC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gSAAgS;IAChS,SAAS,CAAC,IAST;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,+BAAsB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,2CAA0B,CAAC,KAAK,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxB,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gDAAgD,IAAI,CAAC,QAAQ,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAA0B,EAAE,EAAE,CAC7C,2CAA0B,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEL,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC;QAE3F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,WAAW,CAAC;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9D,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sGAAsG;IAC5F,0BAA0B,CAAC,IAKpC;QACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAE1D,uMAAuM;QACvM,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,6BAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,cAAc;aAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9B,IACE,mBAAmB;YACnB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,6BAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc;iBAC3B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;;AAvRH,oCAwRC","sourcesContent":["import { SingletonRealm } from '@/helpers/singleton-realm';\nimport type { IdType } from '@/base';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  type TAuthorizationAction,\n  type TAuthorizationDecision,\n  type TGrantIntent,\n  type TPlannedGrantRow,\n} from '../common';\nimport { AuthorizationPolicyBuilder, type TPolicyDomainInput } from './policy.builder';\n\n/** One closure pass over the action lattice: adds every child reachable from an already-covered parent, reporting whether the set grew. */\nconst expandCoveredActions = (opts: { covered: Set<string> }): boolean => {\n  const { covered } = opts;\n  let grew = false;\n\n  for (const edge of AuthorizationActions.LATTICE) {\n    if (!covered.has(edge.parent) || covered.has(edge.child)) {\n      continue;\n    }\n\n    covered.add(edge.child);\n    grew = true;\n  }\n\n  return grew;\n};\n\nexport class GrantBuilder extends BaseHelper {\n  static readonly SINGLETON_REAL_KEY = 'grant-builder';\n\n  /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */\n  private static readonly PLANNABLE_TIERS = new Set<string>([\n    AuthorizationActions.READ,\n    AuthorizationActions.WRITE,\n    AuthorizationActions.EXECUTE,\n    AuthorizationActions.MANAGE,\n  ]);\n\n  /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */\n  private static readonly NARROW_TIERS: ReadonlyArray<TAuthorizationAction> = [\n    AuthorizationActions.READ,\n    AuthorizationActions.WRITE,\n    AuthorizationActions.EXECUTE,\n  ];\n\n  constructor() {\n    super({ scope: GrantBuilder.name });\n  }\n\n  static getInstance() {\n    return SingletonRealm.resolve({\n      key: GrantBuilder.SINGLETON_REAL_KEY,\n      create: () => new GrantBuilder(),\n    });\n  }\n\n  decodeMetadata<MetadataType = unknown>(opts: { metadata: MetadataType }) {\n    if (typeof opts.metadata !== 'string') {\n      return opts.metadata;\n    }\n\n    try {\n      return JSON.parse(opts.metadata);\n    } catch (error) {\n      this.logger\n        .for(this.decodeMetadata.name)\n        .error('Failed to parse metadata | Error: %s', error);\n      return null;\n    }\n  }\n\n  /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */\n  parseCustomGrantMetadata(opts: { metadata: unknown }): { ops: string[] } | null {\n    const decoded = this.decodeMetadata(opts);\n\n    if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {\n      return null;\n    }\n\n    const ops = (decoded as { ops?: unknown }).ops;\n    if (!Array.isArray(ops) || ops.length === 0) {\n      return null;\n    }\n\n    const seen = new Set<string>();\n    const unique: string[] = [];\n\n    for (const op of ops) {\n      if (typeof op !== 'string' || op.length === 0) {\n        return null;\n      }\n\n      if (!seen.has(op)) {\n        seen.add(op);\n        unique.push(op);\n      }\n    }\n\n    return { ops: unique };\n  }\n\n  /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */\n  validateCustomGrantOps(opts: {\n    ops: string[];\n    subject: string;\n    catalog: Array<{ subject: string; method: string }>;\n  }): { valid: string[]; unknown: string[] } {\n    const known = new Set<string>();\n\n    for (const entry of opts.catalog) {\n      if (entry.subject === opts.subject) {\n        known.add(entry.method);\n      }\n    }\n\n    const valid: string[] = [];\n    const unknown: string[] = [];\n\n    for (const op of opts.ops) {\n      if (known.has(op)) {\n        valid.push(op);\n        continue;\n      }\n\n      unknown.push(op);\n    }\n\n    return { valid, unknown };\n  }\n\n  /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */\n  actionsCoveredBy(opts: { tier: TAuthorizationAction }): Set<string> {\n    const covered = new Set<string>([opts.tier]);\n\n    let grew = true;\n    while (grew) {\n      grew = expandCoveredActions({ covered });\n    }\n\n    return covered;\n  }\n\n  /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */\n  planGrant(opts: {\n    subject: { type: string; id: IdType };\n    resource: { type: string; id: IdType; subject: string };\n    intent: TGrantIntent;\n    catalog: Array<{ subject: string; method: string; code: string; action: string }>;\n    domain?: TNullable<TPolicyDomainInput>;\n    effect?: TAuthorizationDecision;\n    supportsCustomMetadata?: boolean;\n    exact?: boolean;\n  }): TPlannedGrantRow[] {\n    const effect = opts.effect ?? AuthorizationDecisions.ALLOW;\n    const domain = opts.domain ?? null;\n\n    if ('tier' in opts.intent) {\n      if (!GrantBuilder.PLANNABLE_TIERS.has(opts.intent.tier)) {\n        throw getError({\n          message: `[planGrant] Invalid tier: ${opts.intent.tier} | Valids: [${[...GrantBuilder.PLANNABLE_TIERS].join(', ')}]`,\n        });\n      }\n\n      return [\n        AuthorizationPolicyBuilder.grant({\n          subject: opts.subject,\n          permission: { type: opts.resource.type, id: opts.resource.id },\n          action: opts.intent.tier,\n          domain,\n          effect,\n        }),\n      ];\n    }\n\n    const seen = new Set<string>();\n    const ops: string[] = [];\n\n    for (const op of opts.intent.ops) {\n      if (seen.has(op)) {\n        continue;\n      }\n\n      seen.add(op);\n      ops.push(op);\n    }\n\n    if (!ops.length) {\n      throw getError({ message: '[planGrant] intent.ops must not be empty.' });\n    }\n\n    const subjectCatalog = opts.catalog.filter(entry => entry.subject === opts.resource.subject);\n    const byMethod = new Map(subjectCatalog.map(entry => [entry.method, entry]));\n\n    const unknown = ops.filter(op => !byMethod.has(op));\n    if (unknown.length) {\n      throw getError({\n        message: `[planGrant] Unknown operations for resource \"${opts.resource.subject}\": ${unknown.join(', ')}`,\n      });\n    }\n\n    const tierRow = (tier: TAuthorizationAction) =>\n      AuthorizationPolicyBuilder.grant({\n        subject: opts.subject,\n        permission: { type: opts.resource.type, id: opts.resource.id },\n        action: tier,\n        domain,\n        effect,\n      });\n\n    const rows: TPlannedGrantRow[] = [];\n    const remaining = new Set(ops);\n\n    if (opts.exact !== true) {\n      this.collapseRemainingIntoTiers({ subjectCatalog, remaining, rows, tierRow });\n    }\n\n    const leftover = ops.filter(op => remaining.has(op));\n\n    if (!leftover.length) {\n      return rows;\n    }\n\n    const isPerOperationGrant = leftover.length === 1 || opts.supportsCustomMetadata === false;\n\n    if (!isPerOperationGrant) {\n      rows.push(\n        AuthorizationPolicyBuilder.customGrant({\n          subject: opts.subject,\n          permission: { type: opts.resource.type, id: opts.resource.id },\n          ops: leftover,\n          domain,\n          effect,\n        }),\n      );\n\n      return rows;\n    }\n\n    for (const op of leftover) {\n      const entry = byMethod.get(op);\n      if (!entry) {\n        throw getError({ message: `[planGrant] No catalog entry for operation \"${op}\".` });\n      }\n\n      rows.push(\n        AuthorizationPolicyBuilder.grant({\n          subject: opts.subject,\n          permission: { type: opts.resource.type, id: entry.code },\n          action: entry.action,\n          domain,\n          effect,\n        }),\n      );\n    }\n\n    return rows;\n  }\n\n  /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */\n  protected collapseRemainingIntoTiers(opts: {\n    subjectCatalog: Array<{ subject: string; method: string; code: string; action: string }>;\n    remaining: Set<string>;\n    rows: TPlannedGrantRow[];\n    tierRow: (tier: TAuthorizationAction) => TPlannedGrantRow;\n  }): void {\n    const { subjectCatalog, remaining, rows, tierRow } = opts;\n\n    // manage equals read+write+execute only when the subject has at least one operation in EACH narrow tier; otherwise manage also covers a future tier, which is more than the narrow tiers confer today.\n    const spansAllNarrowTiers = GrantBuilder.NARROW_TIERS.every(tier => {\n      const covered = this.actionsCoveredBy({ tier });\n      return subjectCatalog.some(entry => covered.has(entry.action));\n    });\n\n    const manageCovered = this.actionsCoveredBy({ tier: AuthorizationActions.MANAGE });\n    const manageOps = subjectCatalog\n      .filter(entry => manageCovered.has(entry.action))\n      .map(entry => entry.method);\n\n    if (\n      spansAllNarrowTiers &&\n      manageOps.length &&\n      manageOps.every(method => remaining.has(method))\n    ) {\n      rows.push(tierRow(AuthorizationActions.MANAGE));\n      for (const method of manageOps) {\n        remaining.delete(method);\n      }\n\n      return;\n    }\n\n    for (const tier of GrantBuilder.NARROW_TIERS) {\n      const covered = this.actionsCoveredBy({ tier });\n      const methods = subjectCatalog\n        .filter(entry => covered.has(entry.action))\n        .map(entry => entry.method);\n\n      if (!methods.length || !methods.every(method => remaining.has(method))) {\n        continue;\n      }\n\n      rows.push(tierRow(tier));\n      for (const method of methods) {\n        remaining.delete(method);\n      }\n    }\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/builders/index.d.ts

@@ -1,4 +1,3 @@
 export * from './grant.builder';
 export * from './permission.builder';
 export * from './policy.builder';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/builders/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,uDAAqC;AACrC,mDAAiC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,uDAAqC;AACrC,mDAAiC","sourcesContent":["export * from './grant.builder';\nexport * from './permission.builder';\nexport * from './policy.builder';\n"]}

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts

@@ -77,4 +77,3 @@ export declare class AuthorizationPermissionBuilder {
     /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
     static objectMatch(requested: string, granted: string): boolean;
 }
-//# sourceMappingURL=permission.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/permission.builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":";;;AAGA,mDAA2D;AAE3D,+RAA+R;AAC/R,MAAa,8BAA8B;IACzC,yFAAyF;aACzE,yBAAoB,GAAG,GAAG,CAAC;IAE3C,gHAAgH;aAChG,mBAAc,GAAmD;QAC/E,IAAI,EAAE,gCAAoB,CAAC,IAAI;QAC/B,QAAQ,EAAE,gCAAoB,CAAC,IAAI;QACnC,OAAO,EAAE,gCAAoB,CAAC,IAAI;QAClC,KAAK,EAAE,gCAAoB,CAAC,IAAI;QAChC,MAAM,EAAE,gCAAoB,CAAC,MAAM;QACnC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;QACrC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;KACtC,CAAC;IAEF,0DAA0D;aAC1C,yBAAoB,GAA0B;QAC5D,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,UAAU;KACX,CAAC;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAc;QACnC,OAAO,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,gCAAoB,CAAC,OAAO,CAAC;IAC/F,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAQ,IAQvB;QACC,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAQ,IAQ1B;QACC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;YAClC,MAAM,EAAE,8BAA8B,CAAC,oBAAoB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gCAAoB,CAAC,MAAM;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAQ,IAUlB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,8BAA8B,CAAC,oBAAoB,CAAC;QAEpF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM,MAAM,GAAG,8BAA8B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,GAAG,GAAsE;gBAC7E,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,MAAM;aACP,CAAC;YAEF,OAAO,8BAA8B,CAAC,SAAS,CAAQ;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QACnD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC;;AA3HH,wEA4HC"}
+{"version":3,"file":"permission.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":";;;AAGA,mDAA2D;AAE3D,+RAA+R;AAC/R,MAAa,8BAA8B;IACzC,yFAAyF;aACzE,yBAAoB,GAAG,GAAG,CAAC;IAE3C,gHAAgH;aAChG,mBAAc,GAAmD;QAC/E,IAAI,EAAE,gCAAoB,CAAC,IAAI;QAC/B,QAAQ,EAAE,gCAAoB,CAAC,IAAI;QACnC,OAAO,EAAE,gCAAoB,CAAC,IAAI;QAClC,KAAK,EAAE,gCAAoB,CAAC,IAAI;QAChC,MAAM,EAAE,gCAAoB,CAAC,MAAM;QACnC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;QACrC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;KACtC,CAAC;IAEF,0DAA0D;aAC1C,yBAAoB,GAA0B;QAC5D,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,UAAU;KACX,CAAC;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAc;QACnC,OAAO,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,gCAAoB,CAAC,OAAO,CAAC;IAC/F,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAQ,IAQvB;QACC,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAQ,IAQ1B;QACC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;YAClC,MAAM,EAAE,8BAA8B,CAAC,oBAAoB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gCAAoB,CAAC,MAAM;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAQ,IAUlB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,8BAA8B,CAAC,oBAAoB,CAAC;QAEpF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM,MAAM,GAAG,8BAA8B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,GAAG,GAAsE;gBAC7E,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,MAAM;aACP,CAAC;YAEF,OAAO,8BAA8B,CAAC,SAAS,CAAQ;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QACnD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC;;AA3HH,wEA4HC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { TAuthorizationAction } from '../common/constants';\nimport { AuthorizationActions } from '../common/constants';\n\n/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */\nexport class AuthorizationPermissionBuilder {\n  /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */\n  static readonly RESOURCE_NODE_METHOD = '*';\n\n  /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */\n  static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>> = {\n    find: AuthorizationActions.READ,\n    findById: AuthorizationActions.READ,\n    findOne: AuthorizationActions.READ,\n    count: AuthorizationActions.READ,\n    create: AuthorizationActions.CREATE,\n    updateById: AuthorizationActions.UPDATE,\n    updateBy: AuthorizationActions.UPDATE,\n    deleteById: AuthorizationActions.DELETE,\n    deleteBy: AuthorizationActions.DELETE,\n  };\n\n  /** The CRUD methods {@link crud} generates by default. */\n  static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string> = [\n    'find',\n    'findById',\n    'findOne',\n    'count',\n    'create',\n    'updateById',\n    'updateBy',\n    'deleteById',\n    'deleteBy',\n  ];\n\n  /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */\n  static actionForMethod(method: string): TAuthorizationAction {\n    return AuthorizationPermissionBuilder.METHOD_ACTIONS[method] ?? AuthorizationActions.EXECUTE;\n  }\n\n  /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */\n  static operation<TName>(opts: {\n    subject: string;\n    method: string;\n    scope: string;\n    name: TName;\n    description?: TNullable<TName>;\n    action?: TAuthorizationAction;\n    parentId?: TNullable<IdType>;\n  }) {\n    return {\n      code: [opts.subject, opts.method].join('.'),\n      subject: opts.subject,\n      method: opts.method,\n      action: opts.action ?? AuthorizationPermissionBuilder.actionForMethod(opts.method),\n      scope: opts.scope,\n      description: opts.description ?? null,\n      parentId: opts.parentId ?? null,\n      name: opts.name,\n    };\n  }\n\n  /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */\n  static resourceNode<TName>(opts: {\n    code: string;\n    subject?: string;\n    scope: string;\n    name: TName;\n    description?: TNullable<TName>;\n    action?: TAuthorizationAction;\n    parentId?: TNullable<IdType>;\n  }) {\n    return {\n      code: opts.code,\n      subject: opts.subject ?? opts.code,\n      method: AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD,\n      action: opts.action ?? AuthorizationActions.MANAGE,\n      scope: opts.scope,\n      description: opts.description ?? null,\n      parentId: opts.parentId ?? null,\n      name: opts.name,\n    };\n  }\n\n  /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */\n  static crud<TName>(opts: {\n    subject: string;\n    scope: string;\n    name: (ctx: { subject: string; method: string; action: TAuthorizationAction }) => TName;\n    description?: (ctx: {\n      subject: string;\n      method: string;\n      action: TAuthorizationAction;\n    }) => TNullable<TName>;\n    methods?: ReadonlyArray<string>;\n  }) {\n    const methods = opts.methods ?? AuthorizationPermissionBuilder.DEFAULT_CRUD_METHODS;\n\n    return methods.map(method => {\n      const action = AuthorizationPermissionBuilder.actionForMethod(method);\n      const ctx: { subject: string; method: string; action: TAuthorizationAction } = {\n        subject: opts.subject,\n        method,\n        action,\n      };\n\n      return AuthorizationPermissionBuilder.operation<TName>({\n        subject: opts.subject,\n        method,\n        scope: opts.scope,\n        action,\n        name: opts.name(ctx),\n        description: opts.description ? opts.description(ctx) : undefined,\n      });\n    });\n  }\n\n  /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */\n  static objectMatch(requested: string, granted: string): boolean {\n    if (granted === '*') {\n      return true;\n    }\n\n    if (requested === granted) {\n      return true;\n    }\n\n    return requested.startsWith(`${granted}.`);\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts

@@ -198,4 +198,3 @@ export declare class AuthorizationPolicyBuilder {
     }): TBuilderGrantRow[];
 }
 export {};
-//# sourceMappingURL=policy.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/policy.builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAI6B;AAuC7B,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,sJAAsJ;IAC9I,MAAM,CAAC,WAAW,CAAC,MAAsC;QAI/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,qCAAyB,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AAvLH,gEAwLC"}
+{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAI6B;AAuC7B,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,sJAAsJ;IAC9I,MAAM,CAAC,WAAW,CAAC,MAAsC;QAI/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,qCAAyB,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AAvLH,gEAwLC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';\nimport {\n  AuthorizationActions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '../common/constants';\n\n/** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */\nexport type TPolicyDomainInput = string | { type: string; id: IdType };\n\n/**\n * Explicit on purpose: `TAuthorizationDecision` is `Extract<ValueOf<T>, string | number>`, and its\n * literal members widen to `string` when a method's return type is inferred rather than declared.\n * Without this annotation `grant()`'s `effect` stops satisfying `PolicyDefinition`'s narrowed column.\n * Not exported - `TGrantRow`/`TCustomGrantRow` already name unrelated adapter-side row shapes\n * downstream; consumers derive this shape via `ReturnType<typeof AuthorizationPolicyBuilder.grant>`.\n */\ntype TBuilderGrantRow = {\n  variant: typeof AuthorizationPolicyVariants.GRANT.action;\n  subjectType: string;\n  subjectId: IdType;\n  targetType: string;\n  targetId: IdType;\n  action: string;\n  effect: TAuthorizationDecision;\n  domainType: TNullable<string>;\n  domainId: TNullable<IdType>;\n};\n\n/**\n * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read\n * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own\n * metadata has a different shape points the adapter at a different column\n * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.\n *\n * Declared here, beside the only writer, so the column type and the row type cannot drift.\n */\nexport type TSubsetGrantMetadata = { ops: string[] };\n\ntype TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {\n  action: typeof AuthorizationActions.CUSTOM;\n  metadata: TSubsetGrantMetadata;\n};\n\nexport class AuthorizationPolicyBuilder {\n  static readonly ACTION_PRINCIPAL = 'Action';\n\n  /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */\n  private static splitDomain(domain?: TNullable<TPolicyDomainInput>): {\n    domainType: TNullable<string>;\n    domainId: TNullable<IdType>;\n  } {\n    if (domain == null || domain === AuthorizationDomainScopes.ANY_MEMBER) {\n      return { domainType: null, domainId: null };\n    }\n\n    if (typeof domain === 'string') {\n      return { domainType: domain, domainId: null };\n    }\n\n    return { domainType: domain.type, domainId: domain.id };\n  }\n\n  /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */\n  static grant(opts: {\n    subject: { type: string; id: IdType };\n    permission: { type: string; id: IdType };\n    action: string;\n    domain?: TNullable<TPolicyDomainInput>;\n    effect: TAuthorizationDecision;\n  }): TBuilderGrantRow {\n    return {\n      variant: AuthorizationPolicyVariants.GRANT.action,\n      subjectType: opts.subject.type,\n      subjectId: opts.subject.id,\n      targetType: opts.permission.type,\n      targetId: opts.permission.id,\n      action: opts.action,\n      effect: opts.effect,\n      ...AuthorizationPolicyBuilder.splitDomain(opts.domain),\n    };\n  }\n\n  /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */\n  static customGrant(opts: {\n    subject: { type: string; id: IdType };\n    permission: { type: string; id: IdType };\n    ops: string[];\n    domain?: TNullable<TPolicyDomainInput>;\n    effect: TAuthorizationDecision;\n  }): TBuilderCustomGrantRow {\n    return {\n      variant: AuthorizationPolicyVariants.GRANT.action,\n      subjectType: opts.subject.type,\n      subjectId: opts.subject.id,\n      targetType: opts.permission.type,\n      targetId: opts.permission.id,\n      action: AuthorizationActions.CUSTOM,\n      effect: opts.effect,\n      ...AuthorizationPolicyBuilder.splitDomain(opts.domain),\n      metadata: { ops: opts.ops },\n    };\n  }\n\n  /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */\n  static assignRole(opts: {\n    user: { type: string; id: IdType };\n    role: { type: string; id: IdType };\n    domain?: TNullable<TPolicyDomainInput>;\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.ASSIGN_ROLE.action,\n      subjectType: opts.user.type,\n      subjectId: opts.user.id,\n      targetType: opts.role.type,\n      targetId: opts.role.id,\n      ...AuthorizationPolicyBuilder.splitDomain(opts.domain),\n    };\n  }\n\n  /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */\n  static joinDomain(opts: {\n    user: { type: string; id: IdType };\n    domain: { type: string; id: IdType };\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.JOIN_DOMAIN.action,\n      subjectType: opts.user.type,\n      subjectId: opts.user.id,\n      targetType: opts.domain.type,\n      targetId: opts.domain.id,\n    };\n  }\n\n  /** A role inherits another role (casbin `g`, shared relation with assign_role). */\n  static roleInherits(opts: {\n    child: { type: string; id: IdType };\n    parent: { type: string; id: IdType };\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.ROLE_INHERITS.action,\n      subjectType: opts.child.type,\n      subjectId: opts.child.id,\n      targetType: opts.parent.type,\n      targetId: opts.parent.id,\n    };\n  }\n\n  /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */\n  static resourceInherits(opts: {\n    child: { type: string; id: IdType }; // Permission\n    parent: { type: string; id: IdType }; // Permission\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.RESOURCE_INHERITS.action,\n      subjectType: opts.child.type,\n      subjectId: opts.child.id,\n      targetType: opts.parent.type,\n      targetId: opts.parent.id,\n    };\n  }\n\n  /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */\n  static actionInherits(opts: { child: TAuthorizationAction; parent: TAuthorizationAction }) {\n    return {\n      variant: AuthorizationPolicyVariants.ACTION_INHERITS.action,\n      subjectType: this.ACTION_PRINCIPAL,\n      subjectId: opts.child,\n      targetType: this.ACTION_PRINCIPAL,\n      targetId: opts.parent,\n    };\n  }\n\n  /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */\n  static actionLattice() {\n    return AuthorizationActions.LATTICE.map(action => this.actionInherits(action));\n  }\n\n  /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */\n  static domainInherits(opts: {\n    child: { type: string; id: IdType };\n    parent: { type: string; id: IdType };\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.DOMAIN_INHERITS.action,\n      subjectType: opts.child.type,\n      subjectId: opts.child.id,\n      targetType: opts.parent.type,\n      targetId: opts.parent.id,\n    };\n  }\n\n  /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */\n  static roleGrants(opts: {\n    role: { type: string; id: IdType };\n    permission: {\n      type: string;\n      idByCode: ReadonlyMap<string, string>;\n    };\n\n    grants: ReadonlyArray<{\n      resourceCode: string;\n      action: string;\n      domain?: TNullable<TPolicyDomainInput>;\n      effect: TAuthorizationDecision;\n    }>;\n  }) {\n    const rows: Array<ReturnType<typeof AuthorizationPolicyBuilder.grant>> = [];\n\n    for (const grant of opts.grants) {\n      const permissionId = opts.permission.idByCode.get(grant.resourceCode);\n      if (!permissionId) {\n        continue;\n      }\n\n      const policy = AuthorizationPolicyBuilder.grant({\n        subject: { type: opts.role.type, id: opts.role.id },\n        permission: { type: opts.permission.type, id: permissionId },\n        action: grant.action,\n        domain: grant.domain,\n        effect: grant.effect,\n      });\n\n      rows.push(policy);\n    }\n\n    return rows;\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/common/constants/authorization.d.ts

@@ -120,4 +120,3 @@ export declare class AuthorizationPolicyVariants {
 }
 /** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
 export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
-//# sourceMappingURL=authorization.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":";;;AACA,oFAA0E;AAC1E,yCAAgD;AAEhD,MAAa,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAJlD,sCAKC;AAED,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAxCH,oDAyCC;AAGD,MAAa,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AA9BH,wDA+BC;AAGD,MAAa,kBAAkB;aACb,gBAAW,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAhCH,gDAiCC;AAED,MAAa,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAXH,8DAYC;AAGD,sRAAsR;AACtR,MAAa,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAEhF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;;AApDH,kEAqDC"}
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":";;;AACA,oFAA0E;AAC1E,yCAAgD;AAEhD,MAAa,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAJlD,sCAKC;AAED,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAxCH,oDAyCC;AAGD,MAAa,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AA9BH,wDA+BC;AAGD,MAAa,kBAAkB;aACb,gBAAW,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAhCH,gDAiCC;AAED,MAAa,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAXH,8DAYC;AAGD,sRAAsR;AACtR,MAAa,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAEhF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;;AApDH,kEAqDC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { AuthorizationRole } from '../../models/authorization-role.model';\nimport { CasbinRuleVariants } from './enforcer';\n\nexport class Authorization {\n  static readonly RULES = 'authorization.rules';\n  static readonly SKIP_AUTHORIZATION = 'authorization.skip';\n  static readonly ENFORCER = 'authorization.enforcer';\n  static readonly DOMAIN = 'authorization.domain';\n}\n\nexport class AuthorizationActions {\n  static readonly CREATE = 'create';\n  static readonly UPDATE = 'update';\n  static readonly DELETE = 'delete';\n  static readonly EXECUTE = 'execute';\n\n  static readonly READ = 'read';\n  static readonly WRITE = 'write';\n  static readonly MANAGE = 'manage';\n\n  /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. */\n  static readonly CUSTOM = 'custom';\n\n  static readonly SCHEME_SET = new Set([\n    this.CREATE,\n    this.UPDATE,\n    this.DELETE,\n    this.EXECUTE,\n\n    this.READ,\n    this.WRITE,\n    this.MANAGE,\n\n    this.CUSTOM,\n  ]);\n\n  static readonly LATTICE: ReadonlyArray<{\n    child: TAuthorizationAction;\n    parent: TAuthorizationAction;\n  }> = [\n    { child: this.READ, parent: this.MANAGE },\n    { child: this.WRITE, parent: this.MANAGE },\n    { child: this.EXECUTE, parent: this.MANAGE },\n    { child: this.CREATE, parent: this.WRITE },\n    { child: this.UPDATE, parent: this.WRITE },\n    { child: this.DELETE, parent: this.WRITE },\n  ];\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\nexport type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;\n\nexport class AuthorizationDecisions {\n  static readonly ALLOW = 'allow';\n  static readonly DENY = 'deny';\n  static readonly ABSTAIN = 'abstain';\n\n  static readonly SCHEME_SET = new Set([this.ALLOW, this.DENY, this.ABSTAIN]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n\n  static isAllow(input: string | number): boolean {\n    if (typeof input === 'number') {\n      return input > 0;\n    }\n    return input.toLowerCase() === this.ALLOW;\n  }\n\n  static isDeny(input: string | number): boolean {\n    if (typeof input === 'number') {\n      return input < 0;\n    }\n    return input.toLowerCase() === this.DENY;\n  }\n\n  static isAbstain(input: string | number): boolean {\n    if (typeof input === 'number') {\n      return input === 0;\n    }\n    return input.toLowerCase() === this.ABSTAIN;\n  }\n}\nexport type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;\n\nexport class AuthorizationRoles {\n  static readonly SUPER_ADMIN = AuthorizationRole.build({\n    name: 'super-admin',\n    priority: 999,\n  });\n  static readonly ADMIN = AuthorizationRole.build({\n    name: 'admin',\n    priority: 900,\n  });\n  static readonly USER = AuthorizationRole.build({\n    name: 'user',\n    priority: 10,\n  });\n  static readonly GUEST = AuthorizationRole.build({\n    name: 'guest',\n    priority: 1,\n  });\n  static readonly UNKNOWN_USER = AuthorizationRole.build({\n    name: 'unknown-user',\n    priority: 0,\n  });\n\n  static readonly SCHEME_SET = new Set<string>([\n    this.SUPER_ADMIN.identifier,\n    this.ADMIN.identifier,\n    this.USER.identifier,\n    this.GUEST.identifier,\n    this.UNKNOWN_USER.identifier,\n  ]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport class AuthorizationDomainScopes {\n  /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */\n  static readonly ANY_MEMBER = 'ANY_MEMBER';\n\n  /** Grant applies system-wide, bypassing membership - super-admin only. */\n  static readonly SYSTEM_WIDE = 'SYSTEM_WIDE';\n\n  static readonly SCHEME_SET = new Set([this.ANY_MEMBER, this.SYSTEM_WIDE]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\nexport type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;\n\n/** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */\nexport class AuthorizationPolicyVariants {\n  /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */\n  static readonly GRANT = { action: 'grant', rule: CasbinRuleVariants.P } as const;\n\n  /** Give a User a Role (optionally domain-scoped; no domain -> `*` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain|*>` */\n  static readonly ASSIGN_ROLE = { action: 'assign_role', rule: CasbinRuleVariants.G } as const;\n\n  /** A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain `*`: `g, Role_<child>, Role_<parent>, *` */\n  static readonly ROLE_INHERITS = { action: 'role_inherits', rule: CasbinRuleVariants.G } as const;\n\n  /** User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` */\n  static readonly JOIN_DOMAIN = { action: 'join_domain', rule: CasbinRuleVariants.G2 } as const;\n\n  /** DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` */\n  static readonly DOMAIN_INHERITS = {\n    action: 'domain_inherits',\n    rule: CasbinRuleVariants.G3,\n  } as const;\n\n  /** RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` */\n  static readonly RESOURCE_INHERITS = {\n    action: 'resource_inherits',\n    rule: CasbinRuleVariants.G4,\n  } as const;\n\n  /** ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. */\n  static readonly ACTION_INHERITS = {\n    action: 'action_inherits',\n    rule: CasbinRuleVariants.G5,\n  } as const;\n\n  /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */\n  static readonly ALL = [\n    this.GRANT,\n    this.ASSIGN_ROLE,\n    this.ROLE_INHERITS,\n    this.JOIN_DOMAIN,\n    this.DOMAIN_INHERITS,\n    this.RESOURCE_INHERITS,\n    this.ACTION_INHERITS,\n  ] as const;\n\n  static readonly ACTION_SCHEME_SET = new Set(this.ALL.map(variant => variant.action.toString()));\n\n  static readonly RULE_SCHEME_SET = new Set(this.ALL.map(variant => variant.rule.toString()));\n\n  static isValidAction(input: string): boolean {\n    return this.ACTION_SCHEME_SET.has(input);\n  }\n\n  static isValidRule(input: string): boolean {\n    return this.RULE_SCHEME_SET.has(input);\n  }\n}\n\n/** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */\nexport type TAuthorizationPolicyVariant =\n  (typeof AuthorizationPolicyVariants.ALL)[number]['action'];\n"]}

package/dist/cjs/base/auth/authorize/common/constants/binding-keys.d.ts

@@ -3,4 +3,3 @@ export declare class AuthorizeBindingKeys {
     static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
     static enforcerOptions(name: string): string;
 }
-//# sourceMappingURL=binding-keys.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/binding-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding-keys.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,oBAAoB;aACf,YAAO,GAAG,wBAAwB,CAAC;aACnC,uBAAkB,GAAG,mCAAmC,CAAC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,4BAA4B,IAAI,UAAU,CAAC;IACpD,CAAC;;AANH,oDAOC"}
+{"version":3,"file":"binding-keys.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,oBAAoB;aACf,YAAO,GAAG,wBAAwB,CAAC;aACnC,uBAAkB,GAAG,mCAAmC,CAAC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,4BAA4B,IAAI,UAAU,CAAC;IACpD,CAAC;;AANH,oDAOC","sourcesContent":["export class AuthorizeBindingKeys {\n  static readonly OPTIONS = '@app/authorize/options';\n  static readonly ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles';\n\n  static enforcerOptions(name: string): string {\n    return `@app/authorize/enforcers/${name}/options`;\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/common/constants/enforcer.d.ts

@@ -51,4 +51,3 @@ export declare class CasbinRuleVariants {
     static readonly G5 = "g5";
 }
 export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
-//# sourceMappingURL=enforcer.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/enforcer.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcer.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/enforcer.ts"],"names":[],"mappings":";;;AAEA,MAAa,0BAA0B;aACrB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,gEASC;AAID,MAAa,2BAA2B;aACtB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAPH,kEAQC;AAID,MAAa,0BAA0B;aACrB,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,gEASC;AAID,MAAa,6BAA6B;IACxC,+FAA+F;aAC/E,cAAS,GAAG,UAAU,CAAC;IAEvC,+CAA+C;aAC/B,gBAAW,GAAG,WAAW,CAAC;IAE1C,uCAAuC;aACvB,gBAAW,GAAG,WAAW,CAAC;IAE1C,6DAA6D;aAC7C,gBAAW,GAAG,WAAW,CAAC;IAE1C,mEAAmE;aACnD,gBAAW,GAAG,YAAY,CAAC;aAE3B,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AA1BH,sEA2BC;AAID,+MAA+M;AAC/M,MAAa,kBAAkB;IAC7B,8BAA8B;aACd,MAAC,GAAG,GAAG,CAAC;IAExB,4GAA4G;IAE5G,+FAA+F;aAC/E,MAAC,GAAG,GAAG,CAAC;IAExB,uFAAuF;aACvE,OAAE,GAAG,IAAI,CAAC;IAE1B,gEAAgE;aAChD,OAAE,GAAG,IAAI,CAAC;IAE1B,wDAAwD;aACxC,OAAE,GAAG,IAAI,CAAC;IAE1B,sDAAsD;aACtC,OAAE,GAAG,IAAI,CAAC;;AAnB5B,gDAoBC"}
+{"version":3,"file":"enforcer.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/enforcer.ts"],"names":[],"mappings":";;;AAEA,MAAa,0BAA0B;aACrB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,gEASC;AAID,MAAa,2BAA2B;aACtB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAPH,kEAQC;AAID,MAAa,0BAA0B;aACrB,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,gEASC;AAID,MAAa,6BAA6B;IACxC,+FAA+F;aAC/E,cAAS,GAAG,UAAU,CAAC;IAEvC,+CAA+C;aAC/B,gBAAW,GAAG,WAAW,CAAC;IAE1C,uCAAuC;aACvB,gBAAW,GAAG,WAAW,CAAC;IAE1C,6DAA6D;aAC7C,gBAAW,GAAG,WAAW,CAAC;IAE1C,mEAAmE;aACnD,gBAAW,GAAG,YAAY,CAAC;aAE3B,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AA1BH,sEA2BC;AAID,+MAA+M;AAC/M,MAAa,kBAAkB;IAC7B,8BAA8B;aACd,MAAC,GAAG,GAAG,CAAC;IAExB,4GAA4G;IAE5G,+FAA+F;aAC/E,MAAC,GAAG,GAAG,CAAC;IAExB,uFAAuF;aACvE,OAAE,GAAG,IAAI,CAAC;IAE1B,gEAAgE;aAChD,OAAE,GAAG,IAAI,CAAC;IAE1B,wDAAwD;aACxC,OAAE,GAAG,IAAI,CAAC;IAE1B,sDAAsD;aACtC,OAAE,GAAG,IAAI,CAAC;;AAnB5B,gDAoBC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\n\nexport class AuthorizationEnforcerTypes {\n  static readonly CASBIN = 'casbin';\n  static readonly CUSTOM = 'custom';\n\n  static readonly SCHEME_SET = new Set([this.CASBIN, this.CUSTOM]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;\n\nexport class CasbinEnforcerCachedDrivers {\n  static readonly REDIS = 'redis';\n\n  static readonly SCHEME_SET = new Set([this.REDIS]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;\n\nexport class CasbinEnforcerModelDrivers {\n  static readonly FILE = 'file';\n  static readonly TEXT = 'text';\n\n  static readonly SCHEME_SET = new Set([this.FILE, this.TEXT]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;\n\nexport class CasbinDomainMatchingFunctions {\n  /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */\n  static readonly KEY_MATCH = 'keyMatch';\n\n  /** Adds URL-path `:param` segment matching. */\n  static readonly KEY_MATCH_2 = 'keyMatch2';\n\n  /** Adds `{param}` segment matching. */\n  static readonly KEY_MATCH_3 = 'keyMatch3';\n\n  /** `{param}` matching with repeated-name equality checks. */\n  static readonly KEY_MATCH_4 = 'keyMatch4';\n\n  /** Treats the stored/policy value as a full regular expression. */\n  static readonly REGEX_MATCH = 'regexMatch';\n\n  static readonly SCHEME_SET = new Set([\n    this.KEY_MATCH,\n    this.KEY_MATCH_2,\n    this.KEY_MATCH_3,\n    this.KEY_MATCH_4,\n    this.REGEX_MATCH,\n  ]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;\n\n/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */\nexport class CasbinRuleVariants {\n  /** Permission policy line. */\n  static readonly P = 'p';\n\n  /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */\n\n  /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */\n  static readonly G = 'g';\n\n  /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */\n  static readonly G2 = 'g2';\n\n  /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */\n  static readonly G3 = 'g3';\n\n  /** Grouping #4 - resource hierarchy. The `obj` axis. */\n  static readonly G4 = 'g4';\n\n  /** Grouping #5 - action hierarchy. The `act` axis. */\n  static readonly G5 = 'g5';\n}\n\nexport type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;\n"]}

package/dist/cjs/base/auth/authorize/common/constants/index.d.ts

@@ -1,4 +1,3 @@
 export * from './authorization';
 export * from './binding-keys';
 export * from './enforcer';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B","sourcesContent":["export * from './authorization';\nexport * from './binding-keys';\nexport * from './enforcer';\n"]}

package/dist/cjs/base/auth/authorize/common/errors.d.ts

@@ -57,4 +57,3 @@ declare module '@venizia/ignis-helpers/core' {
     interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthorizationErrors> {
     }
 }
-//# sourceMappingURL=errors.d.ts.map