@venizia/ignis 0.2.0-2 → 0.2.0-21

package/dist/components/auth/authenticate/strategies/jwks/issuer.d.ts

@@ -0,0 +1,13 @@
+import { TContext } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { Env } from 'hono';
+import { IAuthUser, IAuthenticationStrategy } from '@venizia/ignis-kernel';
+import { JWKSIssuerTokenService } from '../../services';
+export declare class JWKSIssuerAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
+    private service;
+    name: string;
+    standard: string;
+    constructor(service: JWKSIssuerTokenService<E>);
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+//# sourceMappingURL=issuer.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EAEL,SAAS,EACT,uBAAuB,EAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,qBAAa,gCAAgC,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC/D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAsB;gBASpB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAK5C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}

package/dist/components/auth/authenticate/strategies/{jwks.strategy.js → jwks/issuer.js}

@@ -11,16 +11,15 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-var JWKSIssuerAuthenticationStrategy_1, JWKSVerifierAuthenticationStrategy_1;
+var JWKSIssuerAuthenticationStrategy_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWKSVerifierAuthenticationStrategy = exports.JWKSIssuerAuthenticationStrategy = void 0;
+exports.JWKSIssuerAuthenticationStrategy = void 0;
 const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const ignis_kernel_2 = require("@venizia/ignis-kernel");
 const core_1 = require("@venizia/ignis-helpers/core");
 const ignis_inversion_1 = require("@venizia/ignis-inversion");
 const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const services_1 = require("../services");
-const services_2 = require("../services");
+const services_1 = require("../../services");
 let JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy_1 = class JWKSIssuerAuthenticationStrategy extends core_1.BaseHelper {
     constructor(service) {
         super({ scope: JWKSIssuerAuthenticationStrategy_1.name });
@@ -43,26 +42,4 @@ exports.JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy = JW
     })),
     __metadata("design:paramtypes", [services_1.JWKSIssuerTokenService])
 ], JWKSIssuerAuthenticationStrategy);
-let JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = class JWKSVerifierAuthenticationStrategy extends core_1.BaseHelper {
-    constructor(service) {
-        super({ scope: JWKSVerifierAuthenticationStrategy_1.name });
-        this.service = service;
-        this.name = ignis_kernel_3.Authentication.STRATEGY_JWT;
-        this.standard = ignis_kernel_3.JOSEStandards.JWKS;
-    }
-    authenticate(context) {
-        const token = this.service.extractCredentials(context);
-        return this.service.verify(token);
-    }
-};
-exports.JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy;
-exports.JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({
-        key: ignis_inversion_1.BindingKeys.build({
-            namespace: ignis_kernel_2.BindingNamespaces.SERVICE,
-            key: services_2.JWKSVerifierTokenService.name,
-        }),
-    })),
-    __metadata("design:paramtypes", [services_2.JWKSVerifierTokenService])
-], JWKSVerifierAuthenticationStrategy);
-//# sourceMappingURL=jwks.strategy.js.map
+//# sourceMappingURL=issuer.js.map

package/dist/components/auth/authenticate/strategies/jwks/issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAAwD;AAExD,IAAa,gCAAgC,wCAA7C,MAAa,gCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA0C;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,kCAAgC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFhD,YAAO,GAAP,OAAO,CAA2B;QAV5C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,4EAAgC;2CAAhC,gCAAgC;IAQxC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,iCAAsB,CAAC,IAAI;SACjC,CAAC;KACH,CAAC,CAAA;qCACe,iCAAsB;GAd9B,gCAAgC,CAuB5C"}

package/dist/components/auth/authenticate/strategies/{jwks.strategy.d.ts → jwks/verifier.d.ts}

@@ -2,15 +2,7 @@ import { TContext } from '@venizia/ignis-kernel';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { Env } from 'hono';
 import { IAuthUser, IAuthenticationStrategy } from '@venizia/ignis-kernel';
-import { JWKSIssuerTokenService } from '../services';
-import { JWKSVerifierTokenService } from '../services';
-export declare class JWKSIssuerAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
-    private service;
-    name: string;
-    standard: string;
-    constructor(service: JWKSIssuerTokenService<E>);
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
+import { JWKSVerifierTokenService } from '../../services';
 export declare class JWKSVerifierAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
     private service;
     name: string;
@@ -18,4 +10,4 @@ export declare class JWKSVerifierAuthenticationStrategy<E extends Env = Env> ext
     constructor(service: JWKSVerifierTokenService<E>);
     authenticate(context: TContext<E, string>): Promise<IAuthUser>;
 }
-//# sourceMappingURL=jwks.strategy.d.ts.map
+//# sourceMappingURL=verifier.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EAEL,SAAS,EACT,uBAAuB,EAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,qBAAa,kCAAkC,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CACjE,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAsB;gBASpB,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAK9C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}

package/dist/components/auth/authenticate/strategies/jwks/verifier.js

@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var JWKSVerifierAuthenticationStrategy_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWKSVerifierAuthenticationStrategy = void 0;
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const ignis_kernel_2 = require("@venizia/ignis-kernel");
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_inversion_1 = require("@venizia/ignis-inversion");
+const ignis_kernel_3 = require("@venizia/ignis-kernel");
+const services_1 = require("../../services");
+let JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = class JWKSVerifierAuthenticationStrategy extends core_1.BaseHelper {
+    constructor(service) {
+        super({ scope: JWKSVerifierAuthenticationStrategy_1.name });
+        this.service = service;
+        this.name = ignis_kernel_3.Authentication.STRATEGY_JWT;
+        this.standard = ignis_kernel_3.JOSEStandards.JWKS;
+    }
+    authenticate(context) {
+        const token = this.service.extractCredentials(context);
+        return this.service.verify(token);
+    }
+};
+exports.JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy;
+exports.JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = __decorate([
+    __param(0, (0, ignis_kernel_1.inject)({
+        key: ignis_inversion_1.BindingKeys.build({
+            namespace: ignis_kernel_2.BindingNamespaces.SERVICE,
+            key: services_1.JWKSVerifierTokenService.name,
+        }),
+    })),
+    __metadata("design:paramtypes", [services_1.JWKSVerifierTokenService])
+], JWKSVerifierAuthenticationStrategy);
+//# sourceMappingURL=verifier.js.map

package/dist/components/auth/authenticate/strategies/jwks/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAA0D;AAE1D,IAAa,kCAAkC,0CAA/C,MAAa,kCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA4C;QAE5C,KAAK,CAAC,EAAE,KAAK,EAAE,oCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFlD,YAAO,GAAP,OAAO,CAA6B;QAV9C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,gFAAkC;6CAAlC,kCAAkC;IAQ1C,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,mCAAwB,CAAC,IAAI;SACnC,CAAC;KACH,CAAC,CAAA;qCACe,mCAAwB;GAdhC,kCAAkC,CAuB9C"}

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts

@@ -0,0 +1,19 @@
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import type { Env } from 'hono';
+import type { IAuthUser, IAuthenticationStrategy, IServiceAuthOptions, TContext } from '@venizia/ignis-kernel';
+import { ServiceAssertionVerifierService } from '../services/service/verifier.service';
+/**
+ * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's
+ * own JWKS. No identity round trip and no shared password.
+ *
+ * It proves which service called, never which user. `resolvePrincipal` is where the application
+ * turns a caller name into one of its own principals.
+ */
+export declare class ServiceAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
+    private readonly verifier;
+    private readonly options;
+    name: string;
+    constructor(verifier: ServiceAssertionVerifierService, options: IServiceAuthOptions<E>);
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+//# sourceMappingURL=service.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.strategy.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAShC,OAAO,KAAK,EACV,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAEvF;;;;;;GAMG;AACH,qBAAa,6BAA6B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC5D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAWnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,IAAI,SAAmC;gBASpB,QAAQ,EAAE,+BAA+B,EAEzC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAK5C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CA8BrE"}

package/dist/components/auth/authenticate/strategies/service.strategy.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceAuthenticationStrategy_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAuthenticationStrategy = void 0;
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_inversion_1 = require("@venizia/ignis-inversion");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const verifier_service_1 = require("../services/service/verifier.service");
+/**
+ * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's
+ * own JWKS. No identity round trip and no shared password.
+ *
+ * It proves which service called, never which user. `resolvePrincipal` is where the application
+ * turns a caller name into one of its own principals.
+ */
+let ServiceAuthenticationStrategy = ServiceAuthenticationStrategy_1 = class ServiceAuthenticationStrategy extends core_1.BaseHelper {
+    constructor(verifier, options) {
+        super({ scope: ServiceAuthenticationStrategy_1.name });
+        this.verifier = verifier;
+        this.options = options;
+        this.name = ignis_kernel_1.Authentication.STRATEGY_SERVICE;
+    }
+    async authenticate(context) {
+        const token = context.req.header(ignis_kernel_1.ServiceAssertion.HEADER);
+        if (!token) {
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_MISSING });
+        }
+        // The raw url, NOT `context.req.path`: Hono hands that back percent-DECODED, so a route carrying
+        // a space or a non-ASCII slug would never match the encoded path the caller signed.
+        const { issuer } = await this.verifier.verify({
+            token,
+            method: context.req.method,
+            path: new URL(context.req.url).pathname,
+        });
+        const principal = await this.options.resolvePrincipal({ issuer, context });
+        // Validated rather than trusted. `executeAnyMode` calls `setCurrentUser` unconditionally, so an
+        // application returning a principal without a `userId` would authenticate the request and then
+        // fail at the first write, far from here. `executeAllMode` already refuses it; this closes the
+        // gap between the two modes.
+        if (!principal?.userId) {
+            this.logger
+                .for(this.authenticate.name)
+                .warn('resolvePrincipal returned no usable principal | iss: %s', issuer);
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.PRINCIPAL_UNRESOLVED });
+        }
+        // Which service called is audit-relevant even when the principal is shared across callers.
+        return { ...principal, callerService: issuer };
+    }
+};
+exports.ServiceAuthenticationStrategy = ServiceAuthenticationStrategy;
+exports.ServiceAuthenticationStrategy = ServiceAuthenticationStrategy = ServiceAuthenticationStrategy_1 = __decorate([
+    __param(0, (0, ignis_kernel_1.inject)({
+        key: ignis_inversion_1.BindingKeys.build({
+            namespace: ignis_kernel_1.BindingNamespaces.SERVICE,
+            key: verifier_service_1.ServiceAssertionVerifierService.name,
+        }),
+    })),
+    __param(1, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
+    __metadata("design:paramtypes", [verifier_service_1.ServiceAssertionVerifierService, Object])
+], ServiceAuthenticationStrategy);
+//# sourceMappingURL=service.strategy.js.map

package/dist/components/auth/authenticate/strategies/service.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmE;AACnE,8DAAuD;AAEvD,wDAO+B;AAO/B,2EAAuF;AAEvF;;;;;;GAMG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BACX,SAAQ,iBAAU;IAKlB,YAOE,QAA0D,EAE1D,OAAgD;QAEhD,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAJpC,aAAQ,GAAR,QAAQ,CAAiC;QAEzC,YAAO,GAAP,OAAO,CAAwB;QAXlD,SAAI,GAAG,6BAAc,CAAC,gBAAgB,CAAC;IAcvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,+BAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,iGAAiG;QACjG,oFAAoF;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC3B,IAAI,CAAC,yDAAyD,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,2FAA2F;QAC3F,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAlDY,sEAA6B;wCAA7B,6BAA6B;IAOrC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,kDAA+B,CAAC,IAAI;SAC1C,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;qCAD9B,kDAA+B;GAbjD,6BAA6B,CAkDzC"}

package/dist/components/auth/authorize/adapters/base-filtered.d.ts

@@ -1,7 +1,7 @@
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { type FilteredAdapter, type Model } from 'casbin';
 import type { SQL } from 'drizzle-orm';
-import type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './types';
+import type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './common';
 /** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */
 export declare abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter> extends BaseHelper implements FilteredAdapter {
     protected readonly dataSource: ICasbinPolicySource;

package/dist/components/auth/authorize/adapters/base-filtered.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-filtered.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEhG,0LAA0L;AAC1L,8BAAsB,mBAAmB,CAAC,OAAO,GAAG,mBAAmB,CACrE,SAAQ,UACR,YAAW,eAAe;IAE1B,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;gBAEvC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,CAAA;KAAE;IAKpE,SAAS,KAAK,SAAS,IAAI,sBAAsB,CAYhD;IAED,2LAA2L;cAC3K,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAKtE,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAEzE,UAAU,IAAI,OAAO;IAKf,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAG9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAC7B,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3C,+FAA+F;cAC/E,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlF"}
+{"version":3,"file":"base-filtered.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAEjG,0LAA0L;AAC1L,8BAAsB,mBAAmB,CAAC,OAAO,GAAG,mBAAmB,CACrE,SAAQ,UACR,YAAW,eAAe;IAE1B,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;gBAEvC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,CAAA;KAAE;IAKpE,SAAS,KAAK,SAAS,IAAI,sBAAsB,CAKhD;IAED,2LAA2L;cAC3K,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAKtE,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAEzE,UAAU,IAAI,OAAO;IAKf,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAG9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAC7B,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3C,+FAA+F;cAC/E,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlF"}

package/dist/components/auth/authorize/adapters/base-filtered.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseFilteredAdapter = void 0;
 const utilities_1 = require("../../../../utilities");
 const core_1 = require("@venizia/ignis-helpers/core");
+const connector_1 = require("./connector");
 /** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */
 class BaseFilteredAdapter extends core_1.BaseHelper {
     constructor(opts) {
@@ -10,14 +11,10 @@ class BaseFilteredAdapter extends core_1.BaseHelper {
         this.dataSource = opts.dataSource;
     }
     get connector() {
-        const source = this.dataSource;
-        const resolved = source.getConnector?.() ?? source.connector;
-        if (!resolved) {
-            throw (0, core_1.getError)({
-                message: '[BaseFilteredAdapter] datasource exposes neither a getConnector() accessor nor a wired connector - pass a datasource whose getConnector() lazily wires the driver.',
-            });
-        }
-        return resolved;
+        return connector_1.PolicyConnectorResolver.resolve({
+            source: this.dataSource,
+            caller: 'BaseFilteredAdapter',
+        });
     }
     /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */
     async query(opts) {

package/dist/components/auth/authorize/adapters/base-filtered.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAC7C,sDAAmE;AAKnE,0LAA0L;AAC1L,MAAsB,mBACpB,SAAQ,iBAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,oKAAoK;aACvK,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAA,0BAAc,EAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAtDD,kDAsDC"}
+{"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAC7C,sDAAyD;AAGzD,2CAAsD;AAGtD,0LAA0L;AAC1L,MAAsB,mBACpB,SAAQ,iBAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,mCAAuB,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAA,0BAAc,EAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AA/CD,kDA+CC"}

package/dist/components/auth/authorize/adapters/common/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/common/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}

package/dist/components/auth/authorize/adapters/common/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/common/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB"}

package/dist/components/auth/authorize/adapters/{types.d.ts → common/types.d.ts}

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../../../../base';
 import type { AnyType } from '@venizia/ignis-helpers/common';
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
 /** Filter passed to loadFilteredPolicy: which principal's policies to load. */

package/dist/components/auth/authorize/adapters/common/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAExE,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,oPAAoP;AACpP,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,2GAA2G;IAC3G,YAAY,CAAC,IAAI,sBAAsB,CAAC;IAExC,oFAAoF;IACpF,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wGAAwG;AACxG,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,kBAAkB,GAAG;QACrC,QAAQ,CAAC,EAAE;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACnC,CAAC;IAEF,0CAA0C;IAC1C,UAAU,EAAE,kBAAkB,CAAC;IAE/B,0DAA0D;IAC1D,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAE3C,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,4CAA4C;IAC5C,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/components/auth/authorize/adapters/common/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/types.ts"],"names":[],"mappings":""}

package/dist/components/auth/authorize/adapters/connector.d.ts

@@ -0,0 +1,10 @@
+import type { ICasbinPolicySource, TCasbinPolicyConnector } from './common';
+/** Connector-resolution logic shared by every adapter/loader reading the casbin policy store. */
+export declare class PolicyConnectorResolver {
+    /** Resolve the wired connector off a policy datasource. */
+    static resolve(opts: {
+        source: ICasbinPolicySource;
+        caller: string;
+    }): TCasbinPolicyConnector;
+}
+//# sourceMappingURL=connector.d.ts.map

package/dist/components/auth/authorize/adapters/connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/connector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE5E,iGAAiG;AACjG,qBAAa,uBAAuB;IAClC,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;CAY9F"}

package/dist/components/auth/authorize/adapters/connector.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyConnectorResolver = void 0;
+const core_1 = require("@venizia/ignis-helpers/core");
+/** Connector-resolution logic shared by every adapter/loader reading the casbin policy store. */
+class PolicyConnectorResolver {
+    /** Resolve the wired connector off a policy datasource. */
+    static resolve(opts) {
+        const { source, caller } = opts;
+        const resolved = source.getConnector?.() ?? source.connector;
+        if (!resolved) {
+            throw (0, core_1.getError)({
+                message: `[${caller}] datasource exposes neither a getConnector() accessor nor a wired connector - pass a datasource whose getConnector() lazily wires the driver.`,
+            });
+        }
+        return resolved;
+    }
+}
+exports.PolicyConnectorResolver = PolicyConnectorResolver;
+//# sourceMappingURL=connector.js.map

package/dist/components/auth/authorize/adapters/connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/connector.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAGvD,iGAAiG;AACjG,MAAa,uBAAuB;IAClC,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAqD;QAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,MAAM,gJAAgJ;aACpK,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAdD,0DAcC"}

package/dist/components/auth/authorize/adapters/custom-grant-expander.d.ts

@@ -0,0 +1,52 @@
+import type { IdType } from '../../../../base';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { type TCustomGrantMetadata } from '@venizia/ignis-kernel';
+import type { ICasbinPolicySource, IScopedCasbinEntities } from './common';
+/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */
+export type TCustomGrantRow = {
+    subjectId: IdType;
+    objectSubject: string;
+    ops: string[];
+    domain: string;
+    effect: string;
+};
+/**
+ * Expands "custom" operation-subset grants (`metadata.ops`) into one casbin line per catalogued
+ * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL
+ * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.
+ */
+export declare class CustomGrantExpander extends BaseHelper {
+    protected readonly dataSource: ICasbinPolicySource;
+    protected readonly permission: IScopedCasbinEntities['permission'];
+    protected readonly softDelete: IScopedCasbinEntities['softDelete'];
+    constructor(opts: {
+        dataSource: ICasbinPolicySource;
+        entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;
+    });
+    /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */
+    rejectCustomRow(opts: {
+        row: {
+            subjectId: IdType;
+            objectCode: string;
+            objectMethod: string;
+        };
+        parsed: TCustomGrantMetadata | null;
+        isCustomAction: boolean;
+        metadataColumnName?: string;
+    }): string | null;
+    /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */
+    expandCustomGrants(opts: {
+        subjectType: string;
+        customRows: TCustomGrantRow[];
+    }): Promise<{
+        lines: string[];
+        rejections: string[];
+    }>;
+    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
+    private qualifiedTable;
+    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
+    private softDeleteClause;
+    /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */
+    private queryOperationCatalog;
+}
+//# sourceMappingURL=custom-grant-expander.d.ts.map

package/dist/components/auth/authorize/adapters/custom-grant-expander.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-grant-expander.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAI3E,kHAAkH;AAClH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACnE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAEvD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC;KACpE;IAOD,yFAAyF;IACzF,eAAe,CAAC,IAAI,EAAE;QACpB,GAAG,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QACrE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,MAAM,GAAG,IAAI;IAsBjB,4NAA4N;IACtN,kBAAkB,CAAC,IAAI,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,eAAe,EAAE,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAoDtD,uGAAuG;IACvG,OAAO,CAAC,cAAc;IAMtB,4LAA4L;IAC5L,OAAO,CAAC,gBAAgB;IASxB,sGAAsG;YACxF,qBAAqB;CA6BpC"}

package/dist/components/auth/authorize/adapters/custom-grant-expander.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomGrantExpander = void 0;
+const utilities_1 = require("../../../../utilities");
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const drizzle_orm_1 = require("drizzle-orm");
+const connector_1 = require("./connector");
+const DEFAULT_SCHEMA = 'public';
+/**
+ * Expands "custom" operation-subset grants (`metadata.ops`) into one casbin line per catalogued
+ * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL
+ * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.
+ */
+class CustomGrantExpander extends core_1.BaseHelper {
+    constructor(opts) {
+        super({ scope: CustomGrantExpander.name });
+        this.dataSource = opts.dataSource;
+        this.permission = opts.entities.permission;
+        this.softDelete = opts.entities.softDelete;
+    }
+    /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */
+    rejectCustomRow(opts) {
+        const { row, parsed, isCustomAction, metadataColumnName } = opts;
+        if (isCustomAction && !metadataColumnName) {
+            return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;
+        }
+        if (isCustomAction && !parsed) {
+            return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;
+        }
+        if (!isCustomAction && parsed) {
+            return `Skipping grant - metadata.ops is present but action is not "${ignis_kernel_1.AuthorizationActions.CUSTOM}", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;
+        }
+        if (row.objectMethod !== ignis_kernel_1.AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {
+            return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;
+        }
+        return null;
+    }
+    /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */
+    async expandCustomGrants(opts) {
+        if (!opts.customRows.length) {
+            return { lines: [], rejections: [] };
+        }
+        const seen = new Set();
+        const pairs = [];
+        const candidates = opts.customRows.flatMap(row => row.ops.map(op => ({ subject: row.objectSubject, method: op })));
+        for (const candidate of candidates) {
+            const key = `${candidate.subject}.${candidate.method}`;
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            pairs.push(candidate);
+        }
+        const catalog = await this.queryOperationCatalog({ pairs });
+        const byKey = new Map(catalog.map(entry => [`${entry.subject}.${entry.method}`, entry]));
+        const lines = [];
+        const rejections = [];
+        for (const row of opts.customRows) {
+            const { valid, unknown } = ignis_kernel_1.GrantBuilder.getInstance().validateCustomGrantOps({
+                ops: row.ops,
+                subject: row.objectSubject,
+                catalog,
+            });
+            if (unknown.length) {
+                rejections.push(`Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`);
+            }
+            for (const op of valid) {
+                const entry = byKey.get(`${row.objectSubject}.${op}`);
+                lines.push(`${ignis_kernel_1.AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`);
+            }
+        }
+        return { lines, rejections };
+    }
+    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
+    qualifiedTable(opts) {
+        const { table } = opts;
+        const schema = table.schemaName ?? DEFAULT_SCHEMA;
+        return (0, drizzle_orm_1.sql) `${drizzle_orm_1.sql.identifier(schema)}.${drizzle_orm_1.sql.identifier(table.tableName)}`;
+    }
+    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
+    softDeleteClause(opts) {
+        const sd = this.softDelete;
+        if (!sd?.use) {
+            return drizzle_orm_1.sql.empty();
+        }
+        return (0, drizzle_orm_1.sql) ` AND ${drizzle_orm_1.sql.raw(opts.alias)}.${drizzle_orm_1.sql.identifier(sd.columnName)} IS NULL`;
+    }
+    /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */
+    async queryOperationCatalog(opts) {
+        if (!opts.pairs.length) {
+            return [];
+        }
+        const permissionTable = this.qualifiedTable({ table: this.permission });
+        const connector = connector_1.PolicyConnectorResolver.resolve({
+            source: this.dataSource,
+            caller: CustomGrantExpander.name,
+        });
+        const result = await connector.execute((0, drizzle_orm_1.sql) `
+      SELECT permission.subject, permission.method, permission.code, permission.action
+      FROM ${permissionTable} permission
+      WHERE (permission.subject, permission.method) IN (${drizzle_orm_1.sql.join(opts.pairs.map(pair => (0, drizzle_orm_1.sql) `(${pair.subject}, ${pair.method})`), (0, drizzle_orm_1.sql) `, `)})
+        AND permission.method <> ${ignis_kernel_1.AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause({ alias: 'permission' })}
+    `);
+        return (0, utilities_1.readResultRows)({
+            result,
+        });
+    }
+}
+exports.CustomGrantExpander = CustomGrantExpander;
+//# sourceMappingURL=custom-grant-expander.js.map

package/dist/components/auth/authorize/adapters/custom-grant-expander.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":";;;AACA,2CAA6C;AAC7C,sDAAyD;AACzD,wDAM+B;AAC/B,6CAA4C;AAC5C,2CAAsD;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,mCAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,6CAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAC/C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAChE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,2BAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,mCAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;aAEjC,eAAe;0DAC8B,iBAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAC9D,IAAA,iBAAG,EAAA,IAAI,CACR;mCAC4B,6CAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,IAAA,0BAAc,EAAoE;YACvF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAlJD,kDAkJC"}

package/dist/components/auth/authorize/adapters/index.d.ts

@@ -1,4 +1,6 @@
 export * from './base-filtered';
-export * from './scoped-casbin.adapter';
-export * from './types';
+export * from './common';
+export * from './connector';
+export * from './custom-grant-expander';
+export * from './scoped-casbin';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC"}

package/dist/components/auth/authorize/adapters/index.js

@@ -15,6 +15,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./base-filtered"), exports);
-__exportStar(require("./scoped-casbin.adapter"), exports);
-__exportStar(require("./types"), exports);
+__exportStar(require("./common"), exports);
+__exportStar(require("./connector"), exports);
+__exportStar(require("./custom-grant-expander"), exports);
+__exportStar(require("./scoped-casbin"), exports);
 //# sourceMappingURL=index.js.map