@venizia/ignis-kernel 0.4.2 → 0.4.4

package/dist/cjs/base/auth/authorize/common/constants/authorization.js

@@ -1,163 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationPolicyVariants = exports.AuthorizationDomainScopes = exports.AuthorizationRoles = exports.AuthorizationDecisions = exports.AuthorizationActions = exports.Authorization = void 0;
-const authorization_role_model_1 = require("../../models/authorization-role.model");
-const enforcer_1 = require("./enforcer");
-class Authorization {
-    static { this.RULES = 'authorization.rules'; }
-    static { this.SKIP_AUTHORIZATION = 'authorization.skip'; }
-    static { this.ENFORCER = 'authorization.enforcer'; }
-    static { this.DOMAIN = 'authorization.domain'; }
-}
-exports.Authorization = Authorization;
-class AuthorizationActions {
-    static { this.CREATE = 'create'; }
-    static { this.UPDATE = 'update'; }
-    static { this.DELETE = 'delete'; }
-    static { this.EXECUTE = 'execute'; }
-    static { this.READ = 'read'; }
-    static { this.WRITE = 'write'; }
-    static { this.MANAGE = 'manage'; }
-    /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. */
-    static { this.CUSTOM = 'custom'; }
-    static { this.SCHEME_SET = new Set([
-        this.CREATE,
-        this.UPDATE,
-        this.DELETE,
-        this.EXECUTE,
-        this.READ,
-        this.WRITE,
-        this.MANAGE,
-        this.CUSTOM,
-    ]); }
-    static { this.LATTICE = [
-        { child: this.READ, parent: this.MANAGE },
-        { child: this.WRITE, parent: this.MANAGE },
-        { child: this.EXECUTE, parent: this.MANAGE },
-        { child: this.CREATE, parent: this.WRITE },
-        { child: this.UPDATE, parent: this.WRITE },
-        { child: this.DELETE, parent: this.WRITE },
-    ]; }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.AuthorizationActions = AuthorizationActions;
-class AuthorizationDecisions {
-    static { this.ALLOW = 'allow'; }
-    static { this.DENY = 'deny'; }
-    static { this.ABSTAIN = 'abstain'; }
-    static { this.SCHEME_SET = new Set([this.ALLOW, this.DENY, this.ABSTAIN]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-    static isAllow(input) {
-        if (typeof input === 'number') {
-            return input > 0;
-        }
-        return input.toLowerCase() === this.ALLOW;
-    }
-    static isDeny(input) {
-        if (typeof input === 'number') {
-            return input < 0;
-        }
-        return input.toLowerCase() === this.DENY;
-    }
-    static isAbstain(input) {
-        if (typeof input === 'number') {
-            return input === 0;
-        }
-        return input.toLowerCase() === this.ABSTAIN;
-    }
-}
-exports.AuthorizationDecisions = AuthorizationDecisions;
-class AuthorizationRoles {
-    static { this.SUPER_ADMIN = authorization_role_model_1.AuthorizationRole.build({
-        name: 'super-admin',
-        priority: 999,
-    }); }
-    static { this.ADMIN = authorization_role_model_1.AuthorizationRole.build({
-        name: 'admin',
-        priority: 900,
-    }); }
-    static { this.USER = authorization_role_model_1.AuthorizationRole.build({
-        name: 'user',
-        priority: 10,
-    }); }
-    static { this.GUEST = authorization_role_model_1.AuthorizationRole.build({
-        name: 'guest',
-        priority: 1,
-    }); }
-    static { this.UNKNOWN_USER = authorization_role_model_1.AuthorizationRole.build({
-        name: 'unknown-user',
-        priority: 0,
-    }); }
-    static { this.SCHEME_SET = new Set([
-        this.SUPER_ADMIN.identifier,
-        this.ADMIN.identifier,
-        this.USER.identifier,
-        this.GUEST.identifier,
-        this.UNKNOWN_USER.identifier,
-    ]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.AuthorizationRoles = AuthorizationRoles;
-class AuthorizationDomainScopes {
-    /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
-    static { this.ANY_MEMBER = 'ANY_MEMBER'; }
-    /** Grant applies system-wide, bypassing membership - super-admin only. */
-    static { this.SYSTEM_WIDE = 'SYSTEM_WIDE'; }
-    static { this.SCHEME_SET = new Set([this.ANY_MEMBER, this.SYSTEM_WIDE]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.AuthorizationDomainScopes = AuthorizationDomainScopes;
-/** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
-class AuthorizationPolicyVariants {
-    /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
-    static { this.GRANT = { action: 'grant', rule: enforcer_1.CasbinRuleVariants.P }; }
-    /** Give a User a Role (optionally domain-scoped; no domain -> `*` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain|*>` */
-    static { this.ASSIGN_ROLE = { action: 'assign_role', rule: enforcer_1.CasbinRuleVariants.G }; }
-    /** A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain `*`: `g, Role_<child>, Role_<parent>, *` */
-    static { this.ROLE_INHERITS = { action: 'role_inherits', rule: enforcer_1.CasbinRuleVariants.G }; }
-    /** User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` */
-    static { this.JOIN_DOMAIN = { action: 'join_domain', rule: enforcer_1.CasbinRuleVariants.G2 }; }
-    /** DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` */
-    static { this.DOMAIN_INHERITS = {
-        action: 'domain_inherits',
-        rule: enforcer_1.CasbinRuleVariants.G3,
-    }; }
-    /** RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` */
-    static { this.RESOURCE_INHERITS = {
-        action: 'resource_inherits',
-        rule: enforcer_1.CasbinRuleVariants.G4,
-    }; }
-    /** ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. */
-    static { this.ACTION_INHERITS = {
-        action: 'action_inherits',
-        rule: enforcer_1.CasbinRuleVariants.G5,
-    }; }
-    /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */
-    static { this.ALL = [
-        this.GRANT,
-        this.ASSIGN_ROLE,
-        this.ROLE_INHERITS,
-        this.JOIN_DOMAIN,
-        this.DOMAIN_INHERITS,
-        this.RESOURCE_INHERITS,
-        this.ACTION_INHERITS,
-    ]; }
-    static { this.ACTION_SCHEME_SET = new Set(this.ALL.map((variant) => variant.action.toString())); }
-    static { this.RULE_SCHEME_SET = new Set(this.ALL.map((variant) => variant.rule.toString())); }
-    static isValidAction(input) {
-        return this.ACTION_SCHEME_SET.has(input);
-    }
-    static isValidRule(input) {
-        return this.RULE_SCHEME_SET.has(input);
-    }
-}
-exports.AuthorizationPolicyVariants = AuthorizationPolicyVariants;
-//# sourceMappingURL=authorization.js.map

package/dist/cjs/base/auth/authorize/common/constants/authorization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":";;;AACA,oFAA0E;AAC1E,yCAAgD;AAEhD,MAAa,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAJlD,sCAKC;AAED,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAxCH,oDAyCC;AAGD,MAAa,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AA9BH,wDA+BC;AAGD,MAAa,kBAAkB;aACb,gBAAW,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAhCH,gDAiCC;AAED,MAAa,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAXH,8DAYC;AAGD,sRAAsR;AACtR,MAAa,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAElF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;;AApDH,kEAqDC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { AuthorizationRole } from '../../models/authorization-role.model';\nimport { CasbinRuleVariants } from './enforcer';\n\nexport class Authorization {\n  static readonly RULES = 'authorization.rules';\n  static readonly SKIP_AUTHORIZATION = 'authorization.skip';\n  static readonly ENFORCER = 'authorization.enforcer';\n  static readonly DOMAIN = 'authorization.domain';\n}\n\nexport class AuthorizationActions {\n  static readonly CREATE = 'create';\n  static readonly UPDATE = 'update';\n  static readonly DELETE = 'delete';\n  static readonly EXECUTE = 'execute';\n\n  static readonly READ = 'read';\n  static readonly WRITE = 'write';\n  static readonly MANAGE = 'manage';\n\n  /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. */\n  static readonly CUSTOM = 'custom';\n\n  static readonly SCHEME_SET = new Set([\n    this.CREATE,\n    this.UPDATE,\n    this.DELETE,\n    this.EXECUTE,\n\n    this.READ,\n    this.WRITE,\n    this.MANAGE,\n\n    this.CUSTOM,\n  ]);\n\n  static readonly LATTICE: ReadonlyArray<{\n    child: TAuthorizationAction;\n    parent: TAuthorizationAction;\n  }> = [\n    { child: this.READ, parent: this.MANAGE },\n    { child: this.WRITE, parent: this.MANAGE },\n    { child: this.EXECUTE, parent: this.MANAGE },\n    { child: this.CREATE, parent: this.WRITE },\n    { child: this.UPDATE, parent: this.WRITE },\n    { child: this.DELETE, parent: this.WRITE },\n  ];\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\nexport type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;\n\nexport class AuthorizationDecisions {\n  static readonly ALLOW = 'allow';\n  static readonly DENY = 'deny';\n  static readonly ABSTAIN = 'abstain';\n\n  static readonly SCHEME_SET = new Set([this.ALLOW, this.DENY, this.ABSTAIN]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n\n  static isAllow(input: string | number): boolean {\n    if (typeof input === 'number') {\n      return input > 0;\n    }\n    return input.toLowerCase() === this.ALLOW;\n  }\n\n  static isDeny(input: string | number): boolean {\n    if (typeof input === 'number') {\n      return input < 0;\n    }\n    return input.toLowerCase() === this.DENY;\n  }\n\n  static isAbstain(input: string | number): boolean {\n    if (typeof input === 'number') {\n      return input === 0;\n    }\n    return input.toLowerCase() === this.ABSTAIN;\n  }\n}\nexport type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;\n\nexport class AuthorizationRoles {\n  static readonly SUPER_ADMIN = AuthorizationRole.build({\n    name: 'super-admin',\n    priority: 999,\n  });\n  static readonly ADMIN = AuthorizationRole.build({\n    name: 'admin',\n    priority: 900,\n  });\n  static readonly USER = AuthorizationRole.build({\n    name: 'user',\n    priority: 10,\n  });\n  static readonly GUEST = AuthorizationRole.build({\n    name: 'guest',\n    priority: 1,\n  });\n  static readonly UNKNOWN_USER = AuthorizationRole.build({\n    name: 'unknown-user',\n    priority: 0,\n  });\n\n  static readonly SCHEME_SET = new Set<string>([\n    this.SUPER_ADMIN.identifier,\n    this.ADMIN.identifier,\n    this.USER.identifier,\n    this.GUEST.identifier,\n    this.UNKNOWN_USER.identifier,\n  ]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport class AuthorizationDomainScopes {\n  /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */\n  static readonly ANY_MEMBER = 'ANY_MEMBER';\n\n  /** Grant applies system-wide, bypassing membership - super-admin only. */\n  static readonly SYSTEM_WIDE = 'SYSTEM_WIDE';\n\n  static readonly SCHEME_SET = new Set([this.ANY_MEMBER, this.SYSTEM_WIDE]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\nexport type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;\n\n/** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */\nexport class AuthorizationPolicyVariants {\n  /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */\n  static readonly GRANT = { action: 'grant', rule: CasbinRuleVariants.P } as const;\n\n  /** Give a User a Role (optionally domain-scoped; no domain -> `*` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain|*>` */\n  static readonly ASSIGN_ROLE = { action: 'assign_role', rule: CasbinRuleVariants.G } as const;\n\n  /** A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain `*`: `g, Role_<child>, Role_<parent>, *` */\n  static readonly ROLE_INHERITS = { action: 'role_inherits', rule: CasbinRuleVariants.G } as const;\n\n  /** User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` */\n  static readonly JOIN_DOMAIN = { action: 'join_domain', rule: CasbinRuleVariants.G2 } as const;\n\n  /** DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` */\n  static readonly DOMAIN_INHERITS = {\n    action: 'domain_inherits',\n    rule: CasbinRuleVariants.G3,\n  } as const;\n\n  /** RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` */\n  static readonly RESOURCE_INHERITS = {\n    action: 'resource_inherits',\n    rule: CasbinRuleVariants.G4,\n  } as const;\n\n  /** ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. */\n  static readonly ACTION_INHERITS = {\n    action: 'action_inherits',\n    rule: CasbinRuleVariants.G5,\n  } as const;\n\n  /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */\n  static readonly ALL = [\n    this.GRANT,\n    this.ASSIGN_ROLE,\n    this.ROLE_INHERITS,\n    this.JOIN_DOMAIN,\n    this.DOMAIN_INHERITS,\n    this.RESOURCE_INHERITS,\n    this.ACTION_INHERITS,\n  ] as const;\n\n  static readonly ACTION_SCHEME_SET = new Set(this.ALL.map((variant) => variant.action.toString()));\n\n  static readonly RULE_SCHEME_SET = new Set(this.ALL.map((variant) => variant.rule.toString()));\n\n  static isValidAction(input: string): boolean {\n    return this.ACTION_SCHEME_SET.has(input);\n  }\n\n  static isValidRule(input: string): boolean {\n    return this.RULE_SCHEME_SET.has(input);\n  }\n}\n\n/** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */\nexport type TAuthorizationPolicyVariant =\n  (typeof AuthorizationPolicyVariants.ALL)[number]['action'];\n"]}

package/dist/cjs/base/auth/authorize/common/constants/binding-keys.d.ts

@@ -1,6 +0,0 @@
-export declare class AuthorizeBindingKeys {
-    static readonly OPTIONS = "@app/authorize/options";
-    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
-    static enforcerOptions(name: string): string;
-}
-//# sourceMappingURL=binding-keys.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/binding-keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"binding-keys.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,4BAA4B;IACnD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uCAAuC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7C"}

package/dist/cjs/base/auth/authorize/common/constants/binding-keys.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizeBindingKeys = void 0;
-class AuthorizeBindingKeys {
-    static { this.OPTIONS = '@app/authorize/options'; }
-    static { this.ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles'; }
-    static enforcerOptions(name) {
-        return `@app/authorize/enforcers/${name}/options`;
-    }
-}
-exports.AuthorizeBindingKeys = AuthorizeBindingKeys;
-//# sourceMappingURL=binding-keys.js.map

package/dist/cjs/base/auth/authorize/common/constants/binding-keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"binding-keys.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,oBAAoB;aACf,YAAO,GAAG,wBAAwB,CAAC;aACnC,uBAAkB,GAAG,mCAAmC,CAAC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,4BAA4B,IAAI,UAAU,CAAC;IACpD,CAAC;;AANH,oDAOC","sourcesContent":["export class AuthorizeBindingKeys {\n  static readonly OPTIONS = '@app/authorize/options';\n  static readonly ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles';\n\n  static enforcerOptions(name: string): string {\n    return `@app/authorize/enforcers/${name}/options`;\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/common/constants/enforcer.d.ts

@@ -1,54 +0,0 @@
-import type { TConstValue } from '@venizia/ignis-helpers/common';
-export declare class AuthorizationEnforcerTypes {
-    static readonly CASBIN = "casbin";
-    static readonly CUSTOM = "custom";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
-export declare class CasbinEnforcerCachedDrivers {
-    static readonly REDIS = "redis";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
-export declare class CasbinEnforcerModelDrivers {
-    static readonly FILE = "file";
-    static readonly TEXT = "text";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
-export declare class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static readonly KEY_MATCH = "keyMatch";
-    /** Adds URL-path `:param` segment matching. */
-    static readonly KEY_MATCH_2 = "keyMatch2";
-    /** Adds `{param}` segment matching. */
-    static readonly KEY_MATCH_3 = "keyMatch3";
-    /** `{param}` matching with repeated-name equality checks. */
-    static readonly KEY_MATCH_4 = "keyMatch4";
-    /** Treats the stored/policy value as a full regular expression. */
-    static readonly REGEX_MATCH = "regexMatch";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-export declare class CasbinRuleVariants {
-    /** Permission policy line. */
-    static readonly P = "p";
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static readonly G = "g";
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static readonly G2 = "g2";
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static readonly G3 = "g3";
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static readonly G4 = "g4";
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static readonly G5 = "g5";
-}
-export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
-//# sourceMappingURL=enforcer.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/enforcer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAuC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF,qBAAa,2BAA2B;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyB;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,2BAA2B,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAE1F,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF,qBAAa,6BAA6B;IACxC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc;IAEvC,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,uCAAuC;IACvC,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,6DAA6D;IAC7D,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,mEAAmE;IACnE,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;IAE3C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,6BAA6B,GAAG,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE9F,+MAA+M;AAC/M,qBAAa,kBAAkB;IAC7B,8BAA8B;IAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO;IAExB,4GAA4G;IAE5G,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO;IAExB,uFAAuF;IACvF,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,wDAAwD;IACxD,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,sDAAsD;IACtD,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;CAC3B;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/cjs/base/auth/authorize/common/constants/enforcer.js

@@ -1,70 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CasbinRuleVariants = exports.CasbinDomainMatchingFunctions = exports.CasbinEnforcerModelDrivers = exports.CasbinEnforcerCachedDrivers = exports.AuthorizationEnforcerTypes = void 0;
-class AuthorizationEnforcerTypes {
-    static { this.CASBIN = 'casbin'; }
-    static { this.CUSTOM = 'custom'; }
-    static { this.SCHEME_SET = new Set([this.CASBIN, this.CUSTOM]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.AuthorizationEnforcerTypes = AuthorizationEnforcerTypes;
-class CasbinEnforcerCachedDrivers {
-    static { this.REDIS = 'redis'; }
-    static { this.SCHEME_SET = new Set([this.REDIS]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.CasbinEnforcerCachedDrivers = CasbinEnforcerCachedDrivers;
-class CasbinEnforcerModelDrivers {
-    static { this.FILE = 'file'; }
-    static { this.TEXT = 'text'; }
-    static { this.SCHEME_SET = new Set([this.FILE, this.TEXT]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.CasbinEnforcerModelDrivers = CasbinEnforcerModelDrivers;
-class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static { this.KEY_MATCH = 'keyMatch'; }
-    /** Adds URL-path `:param` segment matching. */
-    static { this.KEY_MATCH_2 = 'keyMatch2'; }
-    /** Adds `{param}` segment matching. */
-    static { this.KEY_MATCH_3 = 'keyMatch3'; }
-    /** `{param}` matching with repeated-name equality checks. */
-    static { this.KEY_MATCH_4 = 'keyMatch4'; }
-    /** Treats the stored/policy value as a full regular expression. */
-    static { this.REGEX_MATCH = 'regexMatch'; }
-    static { this.SCHEME_SET = new Set([
-        this.KEY_MATCH,
-        this.KEY_MATCH_2,
-        this.KEY_MATCH_3,
-        this.KEY_MATCH_4,
-        this.REGEX_MATCH,
-    ]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.CasbinDomainMatchingFunctions = CasbinDomainMatchingFunctions;
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-class CasbinRuleVariants {
-    /** Permission policy line. */
-    static { this.P = 'p'; }
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static { this.G = 'g'; }
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static { this.G2 = 'g2'; }
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static { this.G3 = 'g3'; }
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static { this.G4 = 'g4'; }
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static { this.G5 = 'g5'; }
-}
-exports.CasbinRuleVariants = CasbinRuleVariants;
-//# sourceMappingURL=enforcer.js.map

package/dist/cjs/base/auth/authorize/common/constants/enforcer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/enforcer.ts"],"names":[],"mappings":";;;AAEA,MAAa,0BAA0B;aACrB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,gEASC;AAID,MAAa,2BAA2B;aACtB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAPH,kEAQC;AAID,MAAa,0BAA0B;aACrB,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,gEASC;AAID,MAAa,6BAA6B;IACxC,+FAA+F;aAC/E,cAAS,GAAG,UAAU,CAAC;IAEvC,+CAA+C;aAC/B,gBAAW,GAAG,WAAW,CAAC;IAE1C,uCAAuC;aACvB,gBAAW,GAAG,WAAW,CAAC;IAE1C,6DAA6D;aAC7C,gBAAW,GAAG,WAAW,CAAC;IAE1C,mEAAmE;aACnD,gBAAW,GAAG,YAAY,CAAC;aAE3B,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AA1BH,sEA2BC;AAID,+MAA+M;AAC/M,MAAa,kBAAkB;IAC7B,8BAA8B;aACd,MAAC,GAAG,GAAG,CAAC;IAExB,4GAA4G;IAE5G,+FAA+F;aAC/E,MAAC,GAAG,GAAG,CAAC;IAExB,uFAAuF;aACvE,OAAE,GAAG,IAAI,CAAC;IAE1B,gEAAgE;aAChD,OAAE,GAAG,IAAI,CAAC;IAE1B,wDAAwD;aACxC,OAAE,GAAG,IAAI,CAAC;IAE1B,sDAAsD;aACtC,OAAE,GAAG,IAAI,CAAC;;AAnB5B,gDAoBC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\n\nexport class AuthorizationEnforcerTypes {\n  static readonly CASBIN = 'casbin';\n  static readonly CUSTOM = 'custom';\n\n  static readonly SCHEME_SET = new Set([this.CASBIN, this.CUSTOM]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;\n\nexport class CasbinEnforcerCachedDrivers {\n  static readonly REDIS = 'redis';\n\n  static readonly SCHEME_SET = new Set([this.REDIS]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;\n\nexport class CasbinEnforcerModelDrivers {\n  static readonly FILE = 'file';\n  static readonly TEXT = 'text';\n\n  static readonly SCHEME_SET = new Set([this.FILE, this.TEXT]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;\n\nexport class CasbinDomainMatchingFunctions {\n  /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */\n  static readonly KEY_MATCH = 'keyMatch';\n\n  /** Adds URL-path `:param` segment matching. */\n  static readonly KEY_MATCH_2 = 'keyMatch2';\n\n  /** Adds `{param}` segment matching. */\n  static readonly KEY_MATCH_3 = 'keyMatch3';\n\n  /** `{param}` matching with repeated-name equality checks. */\n  static readonly KEY_MATCH_4 = 'keyMatch4';\n\n  /** Treats the stored/policy value as a full regular expression. */\n  static readonly REGEX_MATCH = 'regexMatch';\n\n  static readonly SCHEME_SET = new Set([\n    this.KEY_MATCH,\n    this.KEY_MATCH_2,\n    this.KEY_MATCH_3,\n    this.KEY_MATCH_4,\n    this.REGEX_MATCH,\n  ]);\n\n  static isValid(input: string): boolean {\n    return this.SCHEME_SET.has(input);\n  }\n}\n\nexport type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;\n\n/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */\nexport class CasbinRuleVariants {\n  /** Permission policy line. */\n  static readonly P = 'p';\n\n  /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */\n\n  /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */\n  static readonly G = 'g';\n\n  /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */\n  static readonly G2 = 'g2';\n\n  /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */\n  static readonly G3 = 'g3';\n\n  /** Grouping #4 - resource hierarchy. The `obj` axis. */\n  static readonly G4 = 'g4';\n\n  /** Grouping #5 - action hierarchy. The `act` axis. */\n  static readonly G5 = 'g5';\n}\n\nexport type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;\n"]}

package/dist/cjs/base/auth/authorize/common/constants/index.d.ts

@@ -1,4 +0,0 @@
-export * from './authorization';
-export * from './binding-keys';
-export * from './enforcer';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/cjs/base/auth/authorize/common/constants/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./authorization"), exports);
-__exportStar(require("./binding-keys"), exports);
-__exportStar(require("./enforcer"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/common/constants/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B","sourcesContent":["export * from './authorization';\nexport * from './binding-keys';\nexport * from './enforcer';\n"]}

package/dist/cjs/base/auth/authorize/common/errors.d.ts

@@ -1,60 +0,0 @@
-import type { TRegisterErrors } from '@venizia/ignis-helpers/core';
-/** Codes a client branches on for a refused authorization. A throw site may override `message` for detail; the code and status come from here. */
-export declare const AuthorizationErrors: {
-    readonly UNAUTHENTICATED: {
-        readonly message: {
-            readonly text: "Authorization requires an authenticated user";
-            readonly code: "core.authorization.unauthenticated";
-        };
-        readonly statusCode: 401;
-        readonly category: "auth";
-    };
-    readonly DENIED: {
-        readonly message: {
-            readonly text: "Authorization denied";
-            readonly code: "core.authorization.denied";
-        };
-        readonly statusCode: 403;
-        readonly category: "auth";
-    };
-    /** Distinct from {@link DENIED}: a voter refused before the enforcer ever ran. */
-    readonly DENIED_BY_VOTER: {
-        readonly message: {
-            readonly text: "Authorization denied by voter";
-            readonly code: "core.authorization.denied_by_voter";
-        };
-        readonly statusCode: 403;
-        readonly category: "auth";
-    };
-    /** Distinct from {@link DENIED}: no enforcer ever ran - the route declared `authorize()` but the application registered none, and `defaultDecision` did not say ALLOW. */
-    readonly ENFORCER_NOT_REGISTERED: {
-        readonly message: {
-            readonly text: "Authorization requires an enforcer, but none is registered";
-            readonly code: "core.authorization.enforcer_not_registered";
-        };
-        readonly statusCode: 403;
-        readonly category: "auth";
-    };
-    readonly PRINCIPAL_TYPE_MISSING: {
-        readonly message: {
-            readonly text: "user.principalType is required for enforcer-based authorization";
-            readonly code: "core.authorization.principal_type_missing";
-        };
-        readonly statusCode: 400;
-        readonly category: "validation";
-    };
-    readonly CACHE_KEY_INVALID: {
-        readonly message: {
-            readonly text: "Authorization cache key resolver returned an empty key";
-            readonly code: "core.authorization.cache_key_invalid";
-        };
-        readonly statusCode: 400;
-        readonly category: "validation";
-    };
-};
-/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
-declare module '@venizia/ignis-helpers/core' {
-    interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthorizationErrors> {
-    }
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/cjs/base/auth/authorize/common/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAIrF,kJAAkJ;AAClJ,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;IAc9B,kFAAkF;;;;;;;;;IAMlF,0KAA0K;;;;;;;;;;;;;;;;;;;;;;;;;CAyBvH,CAAC;AAEtD,8RAA8R;AAC9R,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,mBAAmB,CAAC;KAAG;CACnF"}

package/dist/cjs/base/auth/authorize/common/errors.js

@@ -1,53 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationErrors = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-const common_1 = require("@venizia/ignis-helpers/common");
-/** Codes a client branches on for a refused authorization. A throw site may override `message` for detail; the code and status come from here. */
-exports.AuthorizationErrors = {
-    UNAUTHENTICATED: {
-        message: {
-            text: 'Authorization requires an authenticated user',
-            code: 'core.authorization.unauthenticated',
-        },
-        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
-        category: core_1.ErrorScopes.AUTH,
-    },
-    DENIED: {
-        message: { text: 'Authorization denied', code: 'core.authorization.denied' },
-        statusCode: common_1.HTTP.ResultCodes.RS_4.Forbidden,
-        category: core_1.ErrorScopes.AUTH,
-    },
-    /** Distinct from {@link DENIED}: a voter refused before the enforcer ever ran. */
-    DENIED_BY_VOTER: {
-        message: { text: 'Authorization denied by voter', code: 'core.authorization.denied_by_voter' },
-        statusCode: common_1.HTTP.ResultCodes.RS_4.Forbidden,
-        category: core_1.ErrorScopes.AUTH,
-    },
-    /** Distinct from {@link DENIED}: no enforcer ever ran - the route declared `authorize()` but the application registered none, and `defaultDecision` did not say ALLOW. */
-    ENFORCER_NOT_REGISTERED: {
-        message: {
-            text: 'Authorization requires an enforcer, but none is registered',
-            code: 'core.authorization.enforcer_not_registered',
-        },
-        statusCode: common_1.HTTP.ResultCodes.RS_4.Forbidden,
-        category: core_1.ErrorScopes.AUTH,
-    },
-    PRINCIPAL_TYPE_MISSING: {
-        message: {
-            text: 'user.principalType is required for enforcer-based authorization',
-            code: 'core.authorization.principal_type_missing',
-        },
-        statusCode: common_1.HTTP.ResultCodes.RS_4.BadRequest,
-        category: core_1.ErrorScopes.VALIDATION,
-    },
-    CACHE_KEY_INVALID: {
-        message: {
-            text: 'Authorization cache key resolver returned an empty key',
-            code: 'core.authorization.cache_key_invalid',
-        },
-        statusCode: common_1.HTTP.ResultCodes.RS_4.BadRequest,
-        category: core_1.ErrorScopes.VALIDATION,
-    },
-};
-//# sourceMappingURL=errors.js.map

package/dist/cjs/base/auth/authorize/common/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/errors.ts"],"names":[],"mappings":";;;AACA,sDAA0D;AAC1D,0DAAqD;AAErD,kJAAkJ;AACrI,QAAA,mBAAmB,GAAG;IACjC,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,8CAA8C;YACpD,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,EAAE;QAC5E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS;QAC3C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,kFAAkF;IAClF,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,oCAAoC,EAAE;QAC9F,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS;QAC3C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,0KAA0K;IAC1K,uBAAuB,EAAE;QACvB,OAAO,EAAE;YACP,IAAI,EAAE,4DAA4D;YAClE,IAAI,EAAE,4CAA4C;SACnD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS;QAC3C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,sBAAsB,EAAE;QACtB,OAAO,EAAE;YACP,IAAI,EAAE,iEAAiE;YACvE,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC5C,QAAQ,EAAE,kBAAW,CAAC,UAAU;KACjC;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,wDAAwD;YAC9D,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC5C,QAAQ,EAAE,kBAAW,CAAC,UAAU;KACjC;CACkD,CAAC","sourcesContent":["import type { TErrorDefinition, TRegisterErrors } from '@venizia/ignis-helpers/core';\nimport { ErrorScopes } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\n\n/** Codes a client branches on for a refused authorization. A throw site may override `message` for detail; the code and status come from here. */\nexport const AuthorizationErrors = {\n  UNAUTHENTICATED: {\n    message: {\n      text: 'Authorization requires an authenticated user',\n      code: 'core.authorization.unauthenticated',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Unauthorized,\n    category: ErrorScopes.AUTH,\n  },\n  DENIED: {\n    message: { text: 'Authorization denied', code: 'core.authorization.denied' },\n    statusCode: HTTP.ResultCodes.RS_4.Forbidden,\n    category: ErrorScopes.AUTH,\n  },\n  /** Distinct from {@link DENIED}: a voter refused before the enforcer ever ran. */\n  DENIED_BY_VOTER: {\n    message: { text: 'Authorization denied by voter', code: 'core.authorization.denied_by_voter' },\n    statusCode: HTTP.ResultCodes.RS_4.Forbidden,\n    category: ErrorScopes.AUTH,\n  },\n  /** Distinct from {@link DENIED}: no enforcer ever ran - the route declared `authorize()` but the application registered none, and `defaultDecision` did not say ALLOW. */\n  ENFORCER_NOT_REGISTERED: {\n    message: {\n      text: 'Authorization requires an enforcer, but none is registered',\n      code: 'core.authorization.enforcer_not_registered',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.Forbidden,\n    category: ErrorScopes.AUTH,\n  },\n  PRINCIPAL_TYPE_MISSING: {\n    message: {\n      text: 'user.principalType is required for enforcer-based authorization',\n      code: 'core.authorization.principal_type_missing',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.BadRequest,\n    category: ErrorScopes.VALIDATION,\n  },\n  CACHE_KEY_INVALID: {\n    message: {\n      text: 'Authorization cache key resolver returned an empty key',\n      code: 'core.authorization.cache_key_invalid',\n    },\n    statusCode: HTTP.ResultCodes.RS_4.BadRequest,\n    category: ErrorScopes.VALIDATION,\n  },\n} as const satisfies Record<string, TErrorDefinition>;\n\n/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */\ndeclare module '@venizia/ignis-helpers/core' {\n  interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthorizationErrors> {}\n}\n"]}

package/dist/cjs/base/auth/authorize/common/index.d.ts

@@ -1,4 +0,0 @@
-export * from './errors';
-export * from './constants';
-export * from './types';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/common/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}

package/dist/cjs/base/auth/authorize/common/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./errors"), exports);
-__exportStar(require("./constants"), exports);
-__exportStar(require("./types"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/common/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,8CAA4B;AAC5B,0CAAwB","sourcesContent":["export * from './errors';\nexport * from './constants';\nexport * from './types';\n"]}