@venizia/ignis 0.1.1 → 0.2.0-0

package/dist/components/auth/authorize/builders/grant.builder.js

@@ -1,227 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GrantBuilder = void 0;
-const ignis_helpers_1 = require("@venizia/ignis-helpers");
-const common_1 = require("../common");
-const policy_builder_1 = require("./policy.builder");
-/** One closure pass over the action lattice: adds every child reachable from an already-covered parent, reporting whether the set grew. */
-const expandCoveredActions = (opts) => {
-    const { covered } = opts;
-    let grew = false;
-    for (const edge of common_1.AuthorizationActions.LATTICE) {
-        if (!covered.has(edge.parent) || covered.has(edge.child)) {
-            continue;
-        }
-        covered.add(edge.child);
-        grew = true;
-    }
-    return grew;
-};
-class GrantBuilder extends ignis_helpers_1.BaseHelper {
-    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
-    static { this.PLANNABLE_TIERS = new Set([
-        common_1.AuthorizationActions.READ,
-        common_1.AuthorizationActions.WRITE,
-        common_1.AuthorizationActions.EXECUTE,
-        common_1.AuthorizationActions.MANAGE,
-    ]); }
-    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
-    static { this.NARROW_TIERS = [
-        common_1.AuthorizationActions.READ,
-        common_1.AuthorizationActions.WRITE,
-        common_1.AuthorizationActions.EXECUTE,
-    ]; }
-    constructor() {
-        super({ scope: GrantBuilder.name });
-    }
-    static getInstance() {
-        if (!GrantBuilder.instance) {
-            GrantBuilder.instance = new GrantBuilder();
-        }
-        return GrantBuilder.instance;
-    }
-    decodeMetadata(opts) {
-        if (typeof opts.metadata !== 'string') {
-            return opts.metadata;
-        }
-        try {
-            return JSON.parse(opts.metadata);
-        }
-        catch (error) {
-            this.logger
-                .for(this.decodeMetadata.name)
-                .error('Failed to parse metadata | Error: %s', error);
-            return null;
-        }
-    }
-    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
-    parseCustomGrantMetadata(opts) {
-        const decoded = this.decodeMetadata(opts);
-        if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {
-            return null;
-        }
-        const ops = decoded.ops;
-        if (!Array.isArray(ops) || ops.length === 0) {
-            return null;
-        }
-        const seen = new Set();
-        const unique = [];
-        for (const op of ops) {
-            if (typeof op !== 'string' || op.length === 0) {
-                return null;
-            }
-            if (!seen.has(op)) {
-                seen.add(op);
-                unique.push(op);
-            }
-        }
-        return { ops: unique };
-    }
-    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
-    validateCustomGrantOps(opts) {
-        const known = new Set();
-        for (const entry of opts.catalog) {
-            if (entry.subject === opts.subject) {
-                known.add(entry.method);
-            }
-        }
-        const valid = [];
-        const unknown = [];
-        for (const op of opts.ops) {
-            if (known.has(op)) {
-                valid.push(op);
-                continue;
-            }
-            unknown.push(op);
-        }
-        return { valid, unknown };
-    }
-    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
-    actionsCoveredBy(opts) {
-        const covered = new Set([opts.tier]);
-        let grew = true;
-        while (grew) {
-            grew = expandCoveredActions({ covered });
-        }
-        return covered;
-    }
-    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
-    planGrant(opts) {
-        const effect = opts.effect ?? common_1.AuthorizationDecisions.ALLOW;
-        const domain = opts.domain ?? null;
-        if ('tier' in opts.intent) {
-            if (!GrantBuilder.PLANNABLE_TIERS.has(opts.intent.tier)) {
-                throw (0, ignis_helpers_1.getError)({
-                    message: `[planGrant] Invalid tier: ${opts.intent.tier} | Valids: [${[...GrantBuilder.PLANNABLE_TIERS].join(', ')}]`,
-                });
-            }
-            return [
-                policy_builder_1.AuthorizationPolicyBuilder.grant({
-                    subject: opts.subject,
-                    permission: { type: opts.resource.type, id: opts.resource.id },
-                    action: opts.intent.tier,
-                    domain,
-                    effect,
-                }),
-            ];
-        }
-        const seen = new Set();
-        const ops = [];
-        for (const op of opts.intent.ops) {
-            if (seen.has(op)) {
-                continue;
-            }
-            seen.add(op);
-            ops.push(op);
-        }
-        if (!ops.length) {
-            throw (0, ignis_helpers_1.getError)({ message: '[planGrant] intent.ops must not be empty.' });
-        }
-        const subjectCatalog = opts.catalog.filter(entry => entry.subject === opts.resource.subject);
-        const byMethod = new Map(subjectCatalog.map(entry => [entry.method, entry]));
-        const unknown = ops.filter(op => !byMethod.has(op));
-        if (unknown.length) {
-            throw (0, ignis_helpers_1.getError)({
-                message: `[planGrant] Unknown operations for resource "${opts.resource.subject}": ${unknown.join(', ')}`,
-            });
-        }
-        const tierRow = (tier) => policy_builder_1.AuthorizationPolicyBuilder.grant({
-            subject: opts.subject,
-            permission: { type: opts.resource.type, id: opts.resource.id },
-            action: tier,
-            domain,
-            effect,
-        });
-        const rows = [];
-        const remaining = new Set(ops);
-        if (opts.exact !== true) {
-            this.collapseRemainingIntoTiers({ subjectCatalog, remaining, rows, tierRow });
-        }
-        const leftover = ops.filter(op => remaining.has(op));
-        if (!leftover.length) {
-            return rows;
-        }
-        const isPerOperationGrant = leftover.length === 1 || opts.supportsCustomMetadata === false;
-        if (!isPerOperationGrant) {
-            rows.push(policy_builder_1.AuthorizationPolicyBuilder.customGrant({
-                subject: opts.subject,
-                permission: { type: opts.resource.type, id: opts.resource.id },
-                ops: leftover,
-                domain,
-                effect,
-            }));
-            return rows;
-        }
-        for (const op of leftover) {
-            const entry = byMethod.get(op);
-            if (!entry) {
-                throw (0, ignis_helpers_1.getError)({ message: `[planGrant] No catalog entry for operation "${op}".` });
-            }
-            rows.push(policy_builder_1.AuthorizationPolicyBuilder.grant({
-                subject: opts.subject,
-                permission: { type: opts.resource.type, id: entry.code },
-                action: entry.action,
-                domain,
-                effect,
-            }));
-        }
-        return rows;
-    }
-    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
-    collapseRemainingIntoTiers(opts) {
-        const { subjectCatalog, remaining, rows, tierRow } = opts;
-        // manage equals read+write+execute only when the subject has at least one operation in EACH narrow tier; otherwise manage also covers a future tier, which is more than the narrow tiers confer today.
-        const spansAllNarrowTiers = GrantBuilder.NARROW_TIERS.every(tier => {
-            const covered = this.actionsCoveredBy({ tier });
-            return subjectCatalog.some(entry => covered.has(entry.action));
-        });
-        const manageCovered = this.actionsCoveredBy({ tier: common_1.AuthorizationActions.MANAGE });
-        const manageOps = subjectCatalog
-            .filter(entry => manageCovered.has(entry.action))
-            .map(entry => entry.method);
-        if (spansAllNarrowTiers &&
-            manageOps.length &&
-            manageOps.every(method => remaining.has(method))) {
-            rows.push(tierRow(common_1.AuthorizationActions.MANAGE));
-            for (const method of manageOps) {
-                remaining.delete(method);
-            }
-            return;
-        }
-        for (const tier of GrantBuilder.NARROW_TIERS) {
-            const covered = this.actionsCoveredBy({ tier });
-            const methods = subjectCatalog
-                .filter(entry => covered.has(entry.action))
-                .map(entry => entry.method);
-            if (!methods.length || !methods.every(method => remaining.has(method))) {
-                continue;
-            }
-            rows.push(tierRow(tier));
-            for (const method of methods) {
-                remaining.delete(method);
-            }
-        }
-    }
-}
-exports.GrantBuilder = GrantBuilder;
-//# sourceMappingURL=grant.builder.js.map

package/dist/components/auth/authorize/builders/grant.builder.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant.builder.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":";;;AACA,0DAA8E;AAC9E,sCAOmB;AACnB,qDAAuF;AAEvF,2IAA2I;AAC3I,MAAM,oBAAoB,GAAG,CAAC,IAA8B,EAAW,EAAE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,6BAAoB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAa,YAAa,SAAQ,0BAAU;IAG1C,8FAA8F;aACtE,oBAAe,GAAG,IAAI,GAAG,CAAS;QACxD,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;QAC5B,6BAAoB,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,oGAAoG;aAC5E,iBAAY,GAAwC;QAC1E,6BAAoB,CAAC,IAAI;QACzB,6BAAoB,CAAC,KAAK;QAC1B,6BAAoB,CAAC,OAAO;KAC7B,CAAC;IAEF;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,YAAY,CAAC,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED,cAAc,CAAyB,IAAgC;QACrE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+JAA+J;IAC/J,wBAAwB,CAAC,IAA2B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,uMAAuM;IACvM,sBAAsB,CAAC,IAItB;QACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAoC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gSAAgS;IAChS,SAAS,CAAC,IAST;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,+BAAsB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAA,wBAAQ,EAAC;oBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,2CAA0B,CAAC,KAAK,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxB,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAA,wBAAQ,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAA,wBAAQ,EAAC;gBACb,OAAO,EAAE,gDAAgD,IAAI,CAAC,QAAQ,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAA0B,EAAE,EAAE,CAC7C,2CAA0B,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEL,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC;QAE3F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,WAAW,CAAC;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9D,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAA,wBAAQ,EAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,CAAC,IAAI,CACP,2CAA0B,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sGAAsG;IAC5F,0BAA0B,CAAC,IAKpC;QACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAE1D,uMAAuM;QACvM,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,6BAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,cAAc;aAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9B,IACE,mBAAmB;YACnB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,6BAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc;iBAC3B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;;AAxRH,oCAyRC"}

package/dist/components/auth/authorize/builders/index.d.ts

@@ -1,4 +0,0 @@
-export * from './grant.builder';
-export * from './permission.builder';
-export * from './policy.builder';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/builders/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/builders/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/components/auth/authorize/builders/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./grant.builder"), exports);
-__exportStar(require("./permission.builder"), exports);
-__exportStar(require("./policy.builder"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/builders/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/builders/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,uDAAqC;AACrC,mDAAiC"}

package/dist/components/auth/authorize/builders/permission.builder.d.ts

@@ -1,80 +0,0 @@
-import type { IdType } from '../../../../base';
-import type { TNullable } from '../../../../helpers';
-import type { TAuthorizationAction } from '../common/constants';
-/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
-export declare class AuthorizationPermissionBuilder {
-    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
-    static readonly RESOURCE_NODE_METHOD = "*";
-    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
-    static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>>;
-    /** The CRUD methods {@link crud} generates by default. */
-    static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string>;
-    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
-    static actionForMethod(method: string): TAuthorizationAction;
-    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
-    static operation<TName>(opts: {
-        subject: string;
-        method: string;
-        scope: string;
-        name: TName;
-        description?: TNullable<TName>;
-        action?: TAuthorizationAction;
-        parentId?: TNullable<IdType>;
-    }): {
-        code: string;
-        subject: string;
-        method: string;
-        action: string;
-        scope: string;
-        description: NonNullable<TName> | null;
-        parentId: IdType | null;
-        name: TName;
-    };
-    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
-    static resourceNode<TName>(opts: {
-        code: string;
-        subject?: string;
-        scope: string;
-        name: TName;
-        description?: TNullable<TName>;
-        action?: TAuthorizationAction;
-        parentId?: TNullable<IdType>;
-    }): {
-        code: string;
-        subject: string;
-        method: string;
-        action: string;
-        scope: string;
-        description: NonNullable<TName> | null;
-        parentId: IdType | null;
-        name: TName;
-    };
-    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
-    static crud<TName>(opts: {
-        subject: string;
-        scope: string;
-        name: (ctx: {
-            subject: string;
-            method: string;
-            action: TAuthorizationAction;
-        }) => TName;
-        description?: (ctx: {
-            subject: string;
-            method: string;
-            action: TAuthorizationAction;
-        }) => TNullable<TName>;
-        methods?: ReadonlyArray<string>;
-    }): {
-        code: string;
-        subject: string;
-        method: string;
-        action: string;
-        scope: string;
-        description: NonNullable<TName> | null;
-        parentId: IdType | null;
-        name: TName;
-    }[];
-    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
-    static objectMatch(requested: string, granted: string): boolean;
-}
-//# sourceMappingURL=permission.builder.d.ts.map

package/dist/components/auth/authorize/builders/permission.builder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission.builder.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,+RAA+R;AAC/R,qBAAa,8BAA8B;IACzC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,oBAAoB,OAAO;IAE3C,gHAAgH;IAChH,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAU5E;IAEF,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAUzD;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB;IAI5D,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,oBAAoB,CAAA;SAAE,KAAK,KAAK,CAAC;QACxF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,oBAAoB,CAAC;SAC9B,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KACjC;;;;;;;;;;IAsBD,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;CAWhE"}

package/dist/components/auth/authorize/builders/permission.builder.js

@@ -1,95 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationPermissionBuilder = void 0;
-const constants_1 = require("../common/constants");
-/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
-class AuthorizationPermissionBuilder {
-    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
-    static { this.RESOURCE_NODE_METHOD = '*'; }
-    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
-    static { this.METHOD_ACTIONS = {
-        find: constants_1.AuthorizationActions.READ,
-        findById: constants_1.AuthorizationActions.READ,
-        findOne: constants_1.AuthorizationActions.READ,
-        count: constants_1.AuthorizationActions.READ,
-        create: constants_1.AuthorizationActions.CREATE,
-        updateById: constants_1.AuthorizationActions.UPDATE,
-        updateBy: constants_1.AuthorizationActions.UPDATE,
-        deleteById: constants_1.AuthorizationActions.DELETE,
-        deleteBy: constants_1.AuthorizationActions.DELETE,
-    }; }
-    /** The CRUD methods {@link crud} generates by default. */
-    static { this.DEFAULT_CRUD_METHODS = [
-        'find',
-        'findById',
-        'findOne',
-        'count',
-        'create',
-        'updateById',
-        'updateBy',
-        'deleteById',
-        'deleteBy',
-    ]; }
-    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
-    static actionForMethod(method) {
-        return AuthorizationPermissionBuilder.METHOD_ACTIONS[method] ?? constants_1.AuthorizationActions.EXECUTE;
-    }
-    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
-    static operation(opts) {
-        return {
-            code: [opts.subject, opts.method].join('.'),
-            subject: opts.subject,
-            method: opts.method,
-            action: opts.action ?? AuthorizationPermissionBuilder.actionForMethod(opts.method),
-            scope: opts.scope,
-            description: opts.description ?? null,
-            parentId: opts.parentId ?? null,
-            name: opts.name,
-        };
-    }
-    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
-    static resourceNode(opts) {
-        return {
-            code: opts.code,
-            subject: opts.subject ?? opts.code,
-            method: AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD,
-            action: opts.action ?? constants_1.AuthorizationActions.MANAGE,
-            scope: opts.scope,
-            description: opts.description ?? null,
-            parentId: opts.parentId ?? null,
-            name: opts.name,
-        };
-    }
-    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
-    static crud(opts) {
-        const methods = opts.methods ?? AuthorizationPermissionBuilder.DEFAULT_CRUD_METHODS;
-        return methods.map(method => {
-            const action = AuthorizationPermissionBuilder.actionForMethod(method);
-            const ctx = {
-                subject: opts.subject,
-                method,
-                action,
-            };
-            return AuthorizationPermissionBuilder.operation({
-                subject: opts.subject,
-                method,
-                scope: opts.scope,
-                action,
-                name: opts.name(ctx),
-                description: opts.description ? opts.description(ctx) : undefined,
-            });
-        });
-    }
-    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
-    static objectMatch(requested, granted) {
-        if (granted === '*') {
-            return true;
-        }
-        if (requested === granted) {
-            return true;
-        }
-        return requested.startsWith(`${granted}.`);
-    }
-}
-exports.AuthorizationPermissionBuilder = AuthorizationPermissionBuilder;
-//# sourceMappingURL=permission.builder.js.map

package/dist/components/auth/authorize/builders/permission.builder.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission.builder.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":";;;AAGA,mDAA2D;AAE3D,+RAA+R;AAC/R,MAAa,8BAA8B;IACzC,yFAAyF;aACzE,yBAAoB,GAAG,GAAG,CAAC;IAE3C,gHAAgH;aAChG,mBAAc,GAAmD;QAC/E,IAAI,EAAE,gCAAoB,CAAC,IAAI;QAC/B,QAAQ,EAAE,gCAAoB,CAAC,IAAI;QACnC,OAAO,EAAE,gCAAoB,CAAC,IAAI;QAClC,KAAK,EAAE,gCAAoB,CAAC,IAAI;QAChC,MAAM,EAAE,gCAAoB,CAAC,MAAM;QACnC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;QACrC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;KACtC,CAAC;IAEF,0DAA0D;aAC1C,yBAAoB,GAA0B;QAC5D,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,UAAU;KACX,CAAC;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAc;QACnC,OAAO,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,gCAAoB,CAAC,OAAO,CAAC;IAC/F,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAQ,IAQvB;QACC,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAQ,IAQ1B;QACC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;YAClC,MAAM,EAAE,8BAA8B,CAAC,oBAAoB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gCAAoB,CAAC,MAAM;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAQ,IAUlB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,8BAA8B,CAAC,oBAAoB,CAAC;QAEpF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM,MAAM,GAAG,8BAA8B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,GAAG,GAAsE;gBAC7E,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,MAAM;aACP,CAAC;YAEF,OAAO,8BAA8B,CAAC,SAAS,CAAQ;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QACnD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC;;AA3HH,wEA4HC"}

package/dist/components/auth/authorize/builders/policy.builder.d.ts

@@ -1,195 +0,0 @@
-import type { IdType } from '../../../../base';
-import type { TNullable } from '../../../../helpers';
-import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';
-/** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
-export type TPolicyDomainInput = string | {
-    type: string;
-    id: IdType;
-};
-export declare class AuthorizationPolicyBuilder {
-    static readonly ACTION_PRINCIPAL = "Action";
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    private static serializeDomain;
-    /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
-    static grant(opts: {
-        subject: {
-            type: string;
-            id: IdType;
-        };
-        permission: {
-            type: string;
-            id: IdType;
-        };
-        action: string;
-        domain?: TNullable<TPolicyDomainInput>;
-        effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    };
-    /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
-    static customGrant(opts: {
-        subject: {
-            type: string;
-            id: IdType;
-        };
-        permission: {
-            type: string;
-            id: IdType;
-        };
-        ops: string[];
-        domain?: TNullable<TPolicyDomainInput>;
-        effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-        metadata: {
-            ops: string[];
-        };
-    };
-    /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
-    static assignRole(opts: {
-        user: {
-            type: string;
-            id: IdType;
-        };
-        role: {
-            type: string;
-            id: IdType;
-        };
-        domain?: TNullable<TPolicyDomainInput>;
-    }): {
-        variant: "assign_role";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        domain: TNullable<string>;
-    };
-    /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
-    static joinDomain(opts: {
-        user: {
-            type: string;
-            id: IdType;
-        };
-        domain: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "join_domain";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** A role inherits another role (casbin `g`, shared relation with assign_role). */
-    static roleInherits(opts: {
-        child: {
-            type: string;
-            id: IdType;
-        };
-        parent: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "role_inherits";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */
-    static resourceInherits(opts: {
-        child: {
-            type: string;
-            id: IdType;
-        };
-        parent: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "resource_inherits";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */
-    static actionInherits(opts: {
-        child: TAuthorizationAction;
-        parent: TAuthorizationAction;
-    }): {
-        variant: "action_inherits";
-        subjectType: string;
-        subjectId: string;
-        targetType: string;
-        targetId: string;
-    };
-    /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */
-    static actionLattice(): {
-        variant: "action_inherits";
-        subjectType: string;
-        subjectId: string;
-        targetType: string;
-        targetId: string;
-    }[];
-    /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */
-    static domainInherits(opts: {
-        child: {
-            type: string;
-            id: IdType;
-        };
-        parent: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "domain_inherits";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */
-    static roleGrants(opts: {
-        role: {
-            type: string;
-            id: IdType;
-        };
-        permission: {
-            type: string;
-            idByCode: ReadonlyMap<string, string>;
-        };
-        grants: ReadonlyArray<{
-            resourceCode: string;
-            action: string;
-            domain?: TNullable<TPolicyDomainInput>;
-            effect: TAuthorizationDecision;
-        }>;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    }[];
-}
-//# sourceMappingURL=policy.builder.d.ts.map