@venizia/ignis-kernel 0.4.3 → 0.4.4

package/dist/cjs/base/auth/authenticate/strategies/strategy-registry.js

@@ -1,87 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationStrategyRegistry = void 0;
-const singleton_realm_1 = require("../../../../helpers/singleton-realm");
-const core_1 = require("@venizia/ignis-helpers/core");
-const base_1 = require("../../base");
-const common_1 = require("../common");
-class AuthenticationStrategyRegistry extends base_1.AbstractAuthRegistry {
-    static { this.SINGLETON_REAL_KEY = 'authentication-strategy-registry'; }
-    constructor() {
-        super({ scope: AuthenticationStrategyRegistry.name });
-    }
-    static getInstance() {
-        return singleton_realm_1.SingletonRealm.resolve({
-            key: AuthenticationStrategyRegistry.SINGLETON_REAL_KEY,
-            create: () => new AuthenticationStrategyRegistry(),
-        });
-    }
-    getBindingPrefix() {
-        return common_1.Authentication.AUTHENTICATION_STRATEGY;
-    }
-    register(opts) {
-        const { container, strategies } = opts;
-        for (const { strategy, name } of strategies) {
-            this.registerDescriptor({ container, target: strategy, name });
-        }
-        return this;
-    }
-    resolveStrategy(opts) {
-        return this.resolveDescriptor(opts);
-    }
-    /**
-     * The names on this list that no registered strategy answers to.
-     *
-     * An EMPTY list yields nothing - it is the framework's own encoding of
-     * `authenticate: { skip: true }`, so treating it as a problem would flag every public route.
-     *
-     * Nothing is reported while the registry is empty. Route configs are built during
-     * `registerControllers()`, after `preConfigure()` and `registerComponents()`, so a real
-     * application has registered by then; an empty registry means this is running outside that
-     * lifecycle - a unit test on a controller - where no name could resolve either way.
-     */
-    findUnregistered(opts) {
-        const { names } = opts;
-        if (names.length === 0 || this.descriptors.size === 0) {
-            return [];
-        }
-        return names.filter((name) => !this.has({ name }));
-    }
-    /**
-     * Refuses to continue past an unregistered name. For an APPLICATION's own startup check.
-     *
-     * The framework does NOT call this - it reports instead. A hard failure cannot be the default
-     * here: a route listing several strategies in ANY mode tolerates one that does not resolve, and
-     * `defineAuthController` hard-codes `'jwt'` on four of its routes, so an application that
-     * registers its JWT strategy under a different name works today and would stop booting.
-     */
-    assertRegistered(opts) {
-        const { names, scope = 'route' } = opts;
-        const unregistered = this.findUnregistered({ names });
-        if (unregistered.length === 0) {
-            return;
-        }
-        throw (0, core_1.getError)({
-            message: `[${scope}] Unknown authentication strategy | unregistered: ${unregistered.join(', ')} | registered: ${this.getNames().join(', ')} | register it with AuthenticationStrategyRegistry.register() before controllers are bound`,
-        });
-    }
-    /**
-     * Names an unregistered strategy at boot, at a level someone sees. Never throws.
-     *
-     * This is what replaces the guard the open `TAuthStrategy` gave up: `resolveStrategy` throws at
-     * request time, the provider's ANY mode swallows it at DEBUG, and the route 401s with nothing to
-     * explain why.
-     */
-    reportUnregistered(opts) {
-        const { names, scope = 'route' } = opts;
-        const unregistered = this.findUnregistered({ names });
-        if (unregistered.length === 0) {
-            return;
-        }
-        this.logger
-            .for(this.reportUnregistered.name)
-            .error('[%s] Unknown authentication strategy - requests relying on it cannot authenticate | unregistered: %s | registered: %s', scope, unregistered.join(', '), this.getNames().join(', '));
-    }
-}
-exports.AuthenticationStrategyRegistry = AuthenticationStrategyRegistry;
-//# sourceMappingURL=strategy-registry.js.map

package/dist/cjs/base/auth/authenticate/strategies/strategy-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"strategy-registry.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/strategies/strategy-registry.ts"],"names":[],"mappings":";;;AACA,+DAA2D;AAE3D,sDAAuD;AACvD,qCAAkD;AAElD,sCAA2C;AAE3C,MAAa,8BAA+B,SAAQ,2BAA6C;aAC/E,uBAAkB,GAAG,kCAAkC,CAAC;IAExE;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,8BAA8B,CAAC,kBAAkB;YACtD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,8BAA8B,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAES,gBAAgB;QACxB,OAAO,uBAAc,CAAC,uBAAuB,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,IAGR;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAEvC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,IAAsB;QACpC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,IAAyB;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,IAAyC;QACxD,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,IAAI,KAAK,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACvO,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAyC;QAC1D,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACjC,KAAK,CACJ,uHAAuH,EACvH,KAAK,EACL,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAC;IACN,CAAC;;AApGH,wEAqGC","sourcesContent":["import type { Container } from '@/helpers/inversion/container';\nimport { SingletonRealm } from '@/helpers/singleton-realm';\nimport type { TClass } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { AbstractAuthRegistry } from '../../base';\nimport type { IAuthenticationStrategy } from '../common';\nimport { Authentication } from '../common';\n\nexport class AuthenticationStrategyRegistry extends AbstractAuthRegistry<IAuthenticationStrategy> {\n  static readonly SINGLETON_REAL_KEY = 'authentication-strategy-registry';\n\n  constructor() {\n    super({ scope: AuthenticationStrategyRegistry.name });\n  }\n\n  static getInstance() {\n    return SingletonRealm.resolve({\n      key: AuthenticationStrategyRegistry.SINGLETON_REAL_KEY,\n      create: () => new AuthenticationStrategyRegistry(),\n    });\n  }\n\n  protected getBindingPrefix(): string {\n    return Authentication.AUTHENTICATION_STRATEGY;\n  }\n\n  register(opts: {\n    container: Container;\n    strategies: { strategy: TClass<IAuthenticationStrategy>; name: string }[];\n  }) {\n    const { container, strategies } = opts;\n\n    for (const { strategy, name } of strategies) {\n      this.registerDescriptor({ container, target: strategy, name });\n    }\n\n    return this;\n  }\n\n  resolveStrategy(opts: { name: string }): IAuthenticationStrategy {\n    return this.resolveDescriptor(opts);\n  }\n\n  /**\n   * The names on this list that no registered strategy answers to.\n   *\n   * An EMPTY list yields nothing - it is the framework's own encoding of\n   * `authenticate: { skip: true }`, so treating it as a problem would flag every public route.\n   *\n   * Nothing is reported while the registry is empty. Route configs are built during\n   * `registerControllers()`, after `preConfigure()` and `registerComponents()`, so a real\n   * application has registered by then; an empty registry means this is running outside that\n   * lifecycle - a unit test on a controller - where no name could resolve either way.\n   */\n  findUnregistered(opts: { names: string[] }): string[] {\n    const { names } = opts;\n\n    if (names.length === 0 || this.descriptors.size === 0) {\n      return [];\n    }\n\n    return names.filter((name) => !this.has({ name }));\n  }\n\n  /**\n   * Refuses to continue past an unregistered name. For an APPLICATION's own startup check.\n   *\n   * The framework does NOT call this - it reports instead. A hard failure cannot be the default\n   * here: a route listing several strategies in ANY mode tolerates one that does not resolve, and\n   * `defineAuthController` hard-codes `'jwt'` on four of its routes, so an application that\n   * registers its JWT strategy under a different name works today and would stop booting.\n   */\n  assertRegistered(opts: { names: string[]; scope?: string }): void {\n    const { names, scope = 'route' } = opts;\n\n    const unregistered = this.findUnregistered({ names });\n    if (unregistered.length === 0) {\n      return;\n    }\n\n    throw getError({\n      message: `[${scope}] Unknown authentication strategy | unregistered: ${unregistered.join(', ')} | registered: ${this.getNames().join(', ')} | register it with AuthenticationStrategyRegistry.register() before controllers are bound`,\n    });\n  }\n\n  /**\n   * Names an unregistered strategy at boot, at a level someone sees. Never throws.\n   *\n   * This is what replaces the guard the open `TAuthStrategy` gave up: `resolveStrategy` throws at\n   * request time, the provider's ANY mode swallows it at DEBUG, and the route 401s with nothing to\n   * explain why.\n   */\n  reportUnregistered(opts: { names: string[]; scope?: string }): void {\n    const { names, scope = 'route' } = opts;\n\n    const unregistered = this.findUnregistered({ names });\n    if (unregistered.length === 0) {\n      return;\n    }\n\n    this.logger\n      .for(this.reportUnregistered.name)\n      .error(\n        '[%s] Unknown authentication strategy - requests relying on it cannot authenticate | unregistered: %s | registered: %s',\n        scope,\n        unregistered.join(', '),\n        this.getNames().join(', '),\n      );\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/builders/grant.builder.d.ts

@@ -1,75 +0,0 @@
-import type { IdType } from '../../..';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type TNullable } from '@venizia/ignis-helpers/common';
-import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common';
-import { type TPolicyDomainInput } from './policy.builder';
-export declare class GrantBuilder extends BaseHelper {
-    static readonly SINGLETON_REAL_KEY = "grant-builder";
-    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
-    private static readonly PLANNABLE_TIERS;
-    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
-    private static readonly NARROW_TIERS;
-    constructor();
-    static getInstance(): GrantBuilder;
-    decodeMetadata<MetadataType = unknown>(opts: {
-        metadata: MetadataType;
-    }): any;
-    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
-    parseCustomGrantMetadata(opts: {
-        metadata: unknown;
-    }): {
-        ops: string[];
-    } | null;
-    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
-    validateCustomGrantOps(opts: {
-        ops: string[];
-        subject: string;
-        catalog: Array<{
-            subject: string;
-            method: string;
-        }>;
-    }): {
-        valid: string[];
-        unknown: string[];
-    };
-    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
-    actionsCoveredBy(opts: {
-        tier: TAuthorizationAction;
-    }): Set<string>;
-    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
-    planGrant(opts: {
-        subject: {
-            type: string;
-            id: IdType;
-        };
-        resource: {
-            type: string;
-            id: IdType;
-            subject: string;
-        };
-        intent: TGrantIntent;
-        catalog: Array<{
-            subject: string;
-            method: string;
-            code: string;
-            action: string;
-        }>;
-        domain?: TNullable<TPolicyDomainInput>;
-        effect?: TAuthorizationDecision;
-        supportsCustomMetadata?: boolean;
-        exact?: boolean;
-    }): TPlannedGrantRow[];
-    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
-    protected collapseRemainingIntoTiers(opts: {
-        subjectCatalog: Array<{
-            subject: string;
-            method: string;
-            code: string;
-            action: string;
-        }>;
-        remaining: Set<string>;
-        rows: TPlannedGrantRow[];
-        tierRow: (tier: TAuthorizationAction) => TPlannedGrantRow;
-    }): void;
-}
-//# sourceMappingURL=grant.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/grant.builder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAmBvF,qBAAa,YAAa,SAAQ,UAAU;IAC1C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,mBAAmB;IAErD,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAKpC;IAEH,oGAAoG;IACpG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIlC;;IAMF,MAAM,CAAC,WAAW;IAOlB,cAAc,CAAC,YAAY,GAAG,OAAO,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAA;KAAE;IAevE,+JAA+J;IAC/J,wBAAwB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IA6B/E,uMAAuM;IACvM,sBAAsB,CAAC,IAAI,EAAE;QAC3B,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACrD,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IAwB1C,kGAAkG;IAClG,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAWnE,gSAAgS;IAChS,SAAS,CAAC,IAAI,EAAE;QACd,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,MAAM,EAAE,YAAY,CAAC;QACrB,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClF,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,sBAAsB,CAAC;QAChC,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,gBAAgB,EAAE;IA0GtB,sGAAsG;IACtG,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE;QACzC,cAAc,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACzF,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,gBAAgB,CAAC;KAC3D,GAAG,IAAI;CA2CT"}

package/dist/cjs/base/auth/authorize/builders/grant.builder.js

@@ -1,229 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GrantBuilder = void 0;
-const singleton_realm_1 = require("../../../../helpers/singleton-realm");
-const core_1 = require("@venizia/ignis-helpers/core");
-const common_1 = require("../common");
-const policy_builder_1 = require("./policy.builder");
-/** One closure pass over the action lattice: adds every child reachable from an already-covered parent, reporting whether the set grew. */
-const expandCoveredActions = (opts) => {
-    const { covered } = opts;
-    let grew = false;
-    for (const edge of common_1.AuthorizationActions.LATTICE) {
-        if (!covered.has(edge.parent) || covered.has(edge.child)) {
-            continue;
-        }
-        covered.add(edge.child);
-        grew = true;
-    }
-    return grew;
-};
-class GrantBuilder extends core_1.BaseHelper {
-    static { this.SINGLETON_REAL_KEY = 'grant-builder'; }
-    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
-    static { this.PLANNABLE_TIERS = new Set([
-        common_1.AuthorizationActions.READ,
-        common_1.AuthorizationActions.WRITE,
-        common_1.AuthorizationActions.EXECUTE,
-        common_1.AuthorizationActions.MANAGE,
-    ]); }
-    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
-    static { this.NARROW_TIERS = [
-        common_1.AuthorizationActions.READ,
-        common_1.AuthorizationActions.WRITE,
-        common_1.AuthorizationActions.EXECUTE,
-    ]; }
-    constructor() {
-        super({ scope: GrantBuilder.name });
-    }
-    static getInstance() {
-        return singleton_realm_1.SingletonRealm.resolve({
-            key: GrantBuilder.SINGLETON_REAL_KEY,
-            create: () => new GrantBuilder(),
-        });
-    }
-    decodeMetadata(opts) {
-        if (typeof opts.metadata !== 'string') {
-            return opts.metadata;
-        }
-        try {
-            return JSON.parse(opts.metadata);
-        }
-        catch (error) {
-            this.logger
-                .for(this.decodeMetadata.name)
-                .error('Failed to parse metadata | Error: %s', error);
-            return null;
-        }
-    }
-    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
-    parseCustomGrantMetadata(opts) {
-        const decoded = this.decodeMetadata(opts);
-        if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {
-            return null;
-        }
-        const ops = decoded.ops;
-        if (!Array.isArray(ops) || ops.length === 0) {
-            return null;
-        }
-        const seen = new Set();
-        const unique = [];
-        for (const op of ops) {
-            if (typeof op !== 'string' || op.length === 0) {
-                return null;
-            }
-            if (!seen.has(op)) {
-                seen.add(op);
-                unique.push(op);
-            }
-        }
-        return { ops: unique };
-    }
-    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
-    validateCustomGrantOps(opts) {
-        const known = new Set();
-        for (const entry of opts.catalog) {
-            if (entry.subject === opts.subject) {
-                known.add(entry.method);
-            }
-        }
-        const valid = [];
-        const unknown = [];
-        for (const op of opts.ops) {
-            if (known.has(op)) {
-                valid.push(op);
-                continue;
-            }
-            unknown.push(op);
-        }
-        return { valid, unknown };
-    }
-    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
-    actionsCoveredBy(opts) {
-        const covered = new Set([opts.tier]);
-        let grew = true;
-        while (grew) {
-            grew = expandCoveredActions({ covered });
-        }
-        return covered;
-    }
-    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
-    planGrant(opts) {
-        const effect = opts.effect ?? common_1.AuthorizationDecisions.ALLOW;
-        const domain = opts.domain ?? null;
-        if ('tier' in opts.intent) {
-            if (!GrantBuilder.PLANNABLE_TIERS.has(opts.intent.tier)) {
-                throw (0, core_1.getError)({
-                    message: `[planGrant] Invalid tier: ${opts.intent.tier} | Valids: [${[...GrantBuilder.PLANNABLE_TIERS].join(', ')}]`,
-                });
-            }
-            return [
-                policy_builder_1.AuthorizationPolicyBuilder.grant({
-                    subject: opts.subject,
-                    permission: { type: opts.resource.type, id: opts.resource.id },
-                    action: opts.intent.tier,
-                    domain,
-                    effect,
-                }),
-            ];
-        }
-        const seen = new Set();
-        const ops = [];
-        for (const op of opts.intent.ops) {
-            if (seen.has(op)) {
-                continue;
-            }
-            seen.add(op);
-            ops.push(op);
-        }
-        if (!ops.length) {
-            throw (0, core_1.getError)({ message: '[planGrant] intent.ops must not be empty.' });
-        }
-        const subjectCatalog = opts.catalog.filter((entry) => entry.subject === opts.resource.subject);
-        const byMethod = new Map(subjectCatalog.map((entry) => [entry.method, entry]));
-        const unknown = ops.filter((op) => !byMethod.has(op));
-        if (unknown.length) {
-            throw (0, core_1.getError)({
-                message: `[planGrant] Unknown operations for resource "${opts.resource.subject}": ${unknown.join(', ')}`,
-            });
-        }
-        const tierRow = (tier) => policy_builder_1.AuthorizationPolicyBuilder.grant({
-            subject: opts.subject,
-            permission: { type: opts.resource.type, id: opts.resource.id },
-            action: tier,
-            domain,
-            effect,
-        });
-        const rows = [];
-        const remaining = new Set(ops);
-        if (opts.exact !== true) {
-            this.collapseRemainingIntoTiers({ subjectCatalog, remaining, rows, tierRow });
-        }
-        const leftover = ops.filter((op) => remaining.has(op));
-        if (!leftover.length) {
-            return rows;
-        }
-        const isPerOperationGrant = leftover.length === 1 || opts.supportsCustomMetadata === false;
-        if (!isPerOperationGrant) {
-            rows.push(policy_builder_1.AuthorizationPolicyBuilder.customGrant({
-                subject: opts.subject,
-                permission: { type: opts.resource.type, id: opts.resource.id },
-                ops: leftover,
-                domain,
-                effect,
-            }));
-            return rows;
-        }
-        for (const op of leftover) {
-            const entry = byMethod.get(op);
-            if (!entry) {
-                throw (0, core_1.getError)({ message: `[planGrant] No catalog entry for operation "${op}".` });
-            }
-            rows.push(policy_builder_1.AuthorizationPolicyBuilder.grant({
-                subject: opts.subject,
-                permission: { type: opts.resource.type, id: entry.code },
-                action: entry.action,
-                domain,
-                effect,
-            }));
-        }
-        return rows;
-    }
-    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
-    collapseRemainingIntoTiers(opts) {
-        const { subjectCatalog, remaining, rows, tierRow } = opts;
-        // manage equals read+write+execute only when the subject has at least one operation in EACH narrow tier; otherwise manage also covers a future tier, which is more than the narrow tiers confer today.
-        const spansAllNarrowTiers = GrantBuilder.NARROW_TIERS.every((tier) => {
-            const covered = this.actionsCoveredBy({ tier });
-            return subjectCatalog.some((entry) => covered.has(entry.action));
-        });
-        const manageCovered = this.actionsCoveredBy({ tier: common_1.AuthorizationActions.MANAGE });
-        const manageOps = subjectCatalog
-            .filter((entry) => manageCovered.has(entry.action))
-            .map((entry) => entry.method);
-        if (spansAllNarrowTiers &&
-            manageOps.length &&
-            manageOps.every((method) => remaining.has(method))) {
-            rows.push(tierRow(common_1.AuthorizationActions.MANAGE));
-            for (const method of manageOps) {
-                remaining.delete(method);
-            }
-            return;
-        }
-        for (const tier of GrantBuilder.NARROW_TIERS) {
-            const covered = this.actionsCoveredBy({ tier });
-            const methods = subjectCatalog
-                .filter((entry) => covered.has(entry.action))
-                .map((entry) => entry.method);
-            if (!methods.length || !methods.every((method) => remaining.has(method))) {
-                continue;
-            }
-            rows.push(tierRow(tier));
-            for (const method of methods) {
-                remaining.delete(method);
-            }
-        }
-    }
-}
-exports.GrantBuilder = GrantBuilder;
-//# sourceMappingURL=grant.builder.js.map

package/dist/cjs/base/auth/authorize/builders/grant.builder.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":";;;AAAA,+DAA2D;AAE3D,sDAAmE;AAEnE,sCAOmB;AACnB,qDAAuF;AAEvF,2IAA2I;AAC3I,MAAM,oBAAoB,GAAG,CAAC,IAA8B,EAAW,EAAE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,6BAAoB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAa,YAAa,SAAQ,iBAAU;aAC1B,uBAAkB,GAAG,eAAe,CAAC;IAErD,8FAA8F;aACtE,oBAAe,GAAG,IAAI,GAAG,CAAS;QACxD,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;QAC5B,6BAAoB,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,oGAAoG;aAC5E,iBAAY,GAAwC;QAC1E,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;KAC7B,CAAC;IAEF;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,YAAY,CAAC,kBAAkB;YACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAyB,IAAgC;QACrE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+JAA+J;IAC/J,wBAAwB,CAAC,IAA2B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,uMAAuM;IACvM,sBAAsB,CAAC,IAItB;QACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAoC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gSAAgS;IAChS,SAAS,CAAC,IAST;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,+BAAsB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,2CAA0B,CAAC,KAAK,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxB,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gDAAgD,IAAI,CAAC,QAAQ,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAA0B,EAAE,EAAE,CAC7C,2CAA0B,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEL,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC;QAE3F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,WAAW,CAAC;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9D,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sGAAsG;IAC5F,0BAA0B,CAAC,IAKpC;QACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAE1D,uMAAuM;QACvM,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,6BAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,cAAc;aAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEhC,IACE,mBAAmB;YACnB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAClD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,6BAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc;iBAC3B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEhC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACzE,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;;AAvRH,oCAwRC","sourcesContent":["import { SingletonRealm } from '@/helpers/singleton-realm';\nimport type { IdType } from '@/base';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  type TAuthorizationAction,\n  type TAuthorizationDecision,\n  type TGrantIntent,\n  type TPlannedGrantRow,\n} from '../common';\nimport { AuthorizationPolicyBuilder, type TPolicyDomainInput } from './policy.builder';\n\n/** One closure pass over the action lattice: adds every child reachable from an already-covered parent, reporting whether the set grew. */\nconst expandCoveredActions = (opts: { covered: Set<string> }): boolean => {\n  const { covered } = opts;\n  let grew = false;\n\n  for (const edge of AuthorizationActions.LATTICE) {\n    if (!covered.has(edge.parent) || covered.has(edge.child)) {\n      continue;\n    }\n\n    covered.add(edge.child);\n    grew = true;\n  }\n\n  return grew;\n};\n\nexport class GrantBuilder extends BaseHelper {\n  static readonly SINGLETON_REAL_KEY = 'grant-builder';\n\n  /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */\n  private static readonly PLANNABLE_TIERS = new Set<string>([\n    AuthorizationActions.READ,\n    AuthorizationActions.WRITE,\n    AuthorizationActions.EXECUTE,\n    AuthorizationActions.MANAGE,\n  ]);\n\n  /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */\n  private static readonly NARROW_TIERS: ReadonlyArray<TAuthorizationAction> = [\n    AuthorizationActions.READ,\n    AuthorizationActions.WRITE,\n    AuthorizationActions.EXECUTE,\n  ];\n\n  constructor() {\n    super({ scope: GrantBuilder.name });\n  }\n\n  static getInstance() {\n    return SingletonRealm.resolve({\n      key: GrantBuilder.SINGLETON_REAL_KEY,\n      create: () => new GrantBuilder(),\n    });\n  }\n\n  decodeMetadata<MetadataType = unknown>(opts: { metadata: MetadataType }) {\n    if (typeof opts.metadata !== 'string') {\n      return opts.metadata;\n    }\n\n    try {\n      return JSON.parse(opts.metadata);\n    } catch (error) {\n      this.logger\n        .for(this.decodeMetadata.name)\n        .error('Failed to parse metadata | Error: %s', error);\n      return null;\n    }\n  }\n\n  /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */\n  parseCustomGrantMetadata(opts: { metadata: unknown }): { ops: string[] } | null {\n    const decoded = this.decodeMetadata(opts);\n\n    if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {\n      return null;\n    }\n\n    const ops = (decoded as { ops?: unknown }).ops;\n    if (!Array.isArray(ops) || ops.length === 0) {\n      return null;\n    }\n\n    const seen = new Set<string>();\n    const unique: string[] = [];\n\n    for (const op of ops) {\n      if (typeof op !== 'string' || op.length === 0) {\n        return null;\n      }\n\n      if (!seen.has(op)) {\n        seen.add(op);\n        unique.push(op);\n      }\n    }\n\n    return { ops: unique };\n  }\n\n  /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */\n  validateCustomGrantOps(opts: {\n    ops: string[];\n    subject: string;\n    catalog: Array<{ subject: string; method: string }>;\n  }): { valid: string[]; unknown: string[] } {\n    const known = new Set<string>();\n\n    for (const entry of opts.catalog) {\n      if (entry.subject === opts.subject) {\n        known.add(entry.method);\n      }\n    }\n\n    const valid: string[] = [];\n    const unknown: string[] = [];\n\n    for (const op of opts.ops) {\n      if (known.has(op)) {\n        valid.push(op);\n        continue;\n      }\n\n      unknown.push(op);\n    }\n\n    return { valid, unknown };\n  }\n\n  /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */\n  actionsCoveredBy(opts: { tier: TAuthorizationAction }): Set<string> {\n    const covered = new Set<string>([opts.tier]);\n\n    let grew = true;\n    while (grew) {\n      grew = expandCoveredActions({ covered });\n    }\n\n    return covered;\n  }\n\n  /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */\n  planGrant(opts: {\n    subject: { type: string; id: IdType };\n    resource: { type: string; id: IdType; subject: string };\n    intent: TGrantIntent;\n    catalog: Array<{ subject: string; method: string; code: string; action: string }>;\n    domain?: TNullable<TPolicyDomainInput>;\n    effect?: TAuthorizationDecision;\n    supportsCustomMetadata?: boolean;\n    exact?: boolean;\n  }): TPlannedGrantRow[] {\n    const effect = opts.effect ?? AuthorizationDecisions.ALLOW;\n    const domain = opts.domain ?? null;\n\n    if ('tier' in opts.intent) {\n      if (!GrantBuilder.PLANNABLE_TIERS.has(opts.intent.tier)) {\n        throw getError({\n          message: `[planGrant] Invalid tier: ${opts.intent.tier} | Valids: [${[...GrantBuilder.PLANNABLE_TIERS].join(', ')}]`,\n        });\n      }\n\n      return [\n        AuthorizationPolicyBuilder.grant({\n          subject: opts.subject,\n          permission: { type: opts.resource.type, id: opts.resource.id },\n          action: opts.intent.tier,\n          domain,\n          effect,\n        }),\n      ];\n    }\n\n    const seen = new Set<string>();\n    const ops: string[] = [];\n\n    for (const op of opts.intent.ops) {\n      if (seen.has(op)) {\n        continue;\n      }\n\n      seen.add(op);\n      ops.push(op);\n    }\n\n    if (!ops.length) {\n      throw getError({ message: '[planGrant] intent.ops must not be empty.' });\n    }\n\n    const subjectCatalog = opts.catalog.filter((entry) => entry.subject === opts.resource.subject);\n    const byMethod = new Map(subjectCatalog.map((entry) => [entry.method, entry]));\n\n    const unknown = ops.filter((op) => !byMethod.has(op));\n    if (unknown.length) {\n      throw getError({\n        message: `[planGrant] Unknown operations for resource \"${opts.resource.subject}\": ${unknown.join(', ')}`,\n      });\n    }\n\n    const tierRow = (tier: TAuthorizationAction) =>\n      AuthorizationPolicyBuilder.grant({\n        subject: opts.subject,\n        permission: { type: opts.resource.type, id: opts.resource.id },\n        action: tier,\n        domain,\n        effect,\n      });\n\n    const rows: TPlannedGrantRow[] = [];\n    const remaining = new Set(ops);\n\n    if (opts.exact !== true) {\n      this.collapseRemainingIntoTiers({ subjectCatalog, remaining, rows, tierRow });\n    }\n\n    const leftover = ops.filter((op) => remaining.has(op));\n\n    if (!leftover.length) {\n      return rows;\n    }\n\n    const isPerOperationGrant = leftover.length === 1 || opts.supportsCustomMetadata === false;\n\n    if (!isPerOperationGrant) {\n      rows.push(\n        AuthorizationPolicyBuilder.customGrant({\n          subject: opts.subject,\n          permission: { type: opts.resource.type, id: opts.resource.id },\n          ops: leftover,\n          domain,\n          effect,\n        }),\n      );\n\n      return rows;\n    }\n\n    for (const op of leftover) {\n      const entry = byMethod.get(op);\n      if (!entry) {\n        throw getError({ message: `[planGrant] No catalog entry for operation \"${op}\".` });\n      }\n\n      rows.push(\n        AuthorizationPolicyBuilder.grant({\n          subject: opts.subject,\n          permission: { type: opts.resource.type, id: entry.code },\n          action: entry.action,\n          domain,\n          effect,\n        }),\n      );\n    }\n\n    return rows;\n  }\n\n  /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */\n  protected collapseRemainingIntoTiers(opts: {\n    subjectCatalog: Array<{ subject: string; method: string; code: string; action: string }>;\n    remaining: Set<string>;\n    rows: TPlannedGrantRow[];\n    tierRow: (tier: TAuthorizationAction) => TPlannedGrantRow;\n  }): void {\n    const { subjectCatalog, remaining, rows, tierRow } = opts;\n\n    // manage equals read+write+execute only when the subject has at least one operation in EACH narrow tier; otherwise manage also covers a future tier, which is more than the narrow tiers confer today.\n    const spansAllNarrowTiers = GrantBuilder.NARROW_TIERS.every((tier) => {\n      const covered = this.actionsCoveredBy({ tier });\n      return subjectCatalog.some((entry) => covered.has(entry.action));\n    });\n\n    const manageCovered = this.actionsCoveredBy({ tier: AuthorizationActions.MANAGE });\n    const manageOps = subjectCatalog\n      .filter((entry) => manageCovered.has(entry.action))\n      .map((entry) => entry.method);\n\n    if (\n      spansAllNarrowTiers &&\n      manageOps.length &&\n      manageOps.every((method) => remaining.has(method))\n    ) {\n      rows.push(tierRow(AuthorizationActions.MANAGE));\n      for (const method of manageOps) {\n        remaining.delete(method);\n      }\n\n      return;\n    }\n\n    for (const tier of GrantBuilder.NARROW_TIERS) {\n      const covered = this.actionsCoveredBy({ tier });\n      const methods = subjectCatalog\n        .filter((entry) => covered.has(entry.action))\n        .map((entry) => entry.method);\n\n      if (!methods.length || !methods.every((method) => remaining.has(method))) {\n        continue;\n      }\n\n      rows.push(tierRow(tier));\n      for (const method of methods) {\n        remaining.delete(method);\n      }\n    }\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/builders/index.d.ts

@@ -1,4 +0,0 @@
-export * from './grant.builder';
-export * from './permission.builder';
-export * from './policy.builder';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/builders/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/cjs/base/auth/authorize/builders/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./grant.builder"), exports);
-__exportStar(require("./permission.builder"), exports);
-__exportStar(require("./policy.builder"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/builders/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,uDAAqC;AACrC,mDAAiC","sourcesContent":["export * from './grant.builder';\nexport * from './permission.builder';\nexport * from './policy.builder';\n"]}

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts

@@ -1,80 +0,0 @@
-import type { IdType } from '../../..';
-import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { TAuthorizationAction } from '../common/constants';
-/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
-export declare class AuthorizationPermissionBuilder {
-    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
-    static readonly RESOURCE_NODE_METHOD = "*";
-    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
-    static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>>;
-    /** The CRUD methods {@link crud} generates by default. */
-    static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string>;
-    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
-    static actionForMethod(method: string): TAuthorizationAction;
-    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
-    static operation<TName>(opts: {
-        subject: string;
-        method: string;
-        scope: string;
-        name: TName;
-        description?: TNullable<TName>;
-        action?: TAuthorizationAction;
-        parentId?: TNullable<IdType>;
-    }): {
-        code: string;
-        subject: string;
-        method: string;
-        action: TAuthorizationAction;
-        scope: string;
-        description: NonNullable<TName> | null;
-        parentId: IdType | null;
-        name: TName;
-    };
-    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
-    static resourceNode<TName>(opts: {
-        code: string;
-        subject?: string;
-        scope: string;
-        name: TName;
-        description?: TNullable<TName>;
-        action?: TAuthorizationAction;
-        parentId?: TNullable<IdType>;
-    }): {
-        code: string;
-        subject: string;
-        method: string;
-        action: TAuthorizationAction;
-        scope: string;
-        description: NonNullable<TName> | null;
-        parentId: IdType | null;
-        name: TName;
-    };
-    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
-    static crud<TName>(opts: {
-        subject: string;
-        scope: string;
-        name: (ctx: {
-            subject: string;
-            method: string;
-            action: TAuthorizationAction;
-        }) => TName;
-        description?: (ctx: {
-            subject: string;
-            method: string;
-            action: TAuthorizationAction;
-        }) => TNullable<TName>;
-        methods?: ReadonlyArray<string>;
-    }): {
-        code: string;
-        subject: string;
-        method: string;
-        action: TAuthorizationAction;
-        scope: string;
-        description: NonNullable<TName> | null;
-        parentId: IdType | null;
-        name: TName;
-    }[];
-    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
-    static objectMatch(requested: string, granted: string): boolean;
-}
-//# sourceMappingURL=permission.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,+RAA+R;AAC/R,qBAAa,8BAA8B;IACzC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,oBAAoB,OAAO;IAE3C,gHAAgH;IAChH,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAU5E;IAEF,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAUzD;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB;IAI5D,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,oBAAoB,CAAA;SAAE,KAAK,KAAK,CAAC;QACxF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,oBAAoB,CAAC;SAC9B,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KACjC;;;;;;;;;;IAsBD,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;CAWhE"}