@venizia/ignis 0.4.3 → 0.4.4

package/dist/components/auth/authorize/enforcers/index.js

@@ -1,23 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-// `enforcer-registry.ts` moved to the kernel - `casbin.enforcer.ts` registers itself into it.
-__exportStar(require("@venizia/ignis-kernel"), exports);
-__exportStar(require("./casbin.enforcer"), exports);
-__exportStar(require("./models"), exports);
-__exportStar(require("./policy-line-codec"), exports);
-__exportStar(require("./user-policy-line-cache"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/enforcers/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8FAA8F;AAC9F,wDAAsC;AAEtC,oDAAkC;AAClC,2CAAyB;AACzB,sDAAoC;AACpC,2DAAyC","sourcesContent":["// `enforcer-registry.ts` moved to the kernel - `casbin.enforcer.ts` registers itself into it.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './casbin.enforcer';\nexport * from './models';\nexport * from './policy-line-codec';\nexport * from './user-policy-line-cache';\n"]}

package/dist/components/auth/authorize/enforcers/models/index.d.ts

@@ -1,2 +0,0 @@
-export * from './rbac-domain.model';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/enforcers/models/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/components/auth/authorize/enforcers/models/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./rbac-domain.model"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/enforcers/models/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC","sourcesContent":["export * from './rbac-domain.model';\n"]}

package/dist/components/auth/authorize/enforcers/models/rbac-domain.model.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac-domain.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/rbac-domain.model.ts"],"names":[],"mappings":"AAEA,iKAAiK;AACjK,eAAO,MAAM,+BAA+B,geAmB3C,CAAC"}

package/dist/components/auth/authorize/enforcers/models/rbac-domain.model.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CASBIN_RBAC_DOMAIN_SCOPED_MODEL = void 0;
-// Relation semantics live on AuthorizationPolicyVariants; g's KEY_MATCH domain fn makes `*`-domain links match any request domain; `objectMatch` appears directly in the matcher because hasLink only walks stored nodes.
-// g3/g4/g5 rely on DefaultRoleManager self-links (hasLink(name, name)) - a custom role manager must preserve them.
-/** Scoped RBAC model (v2). Effect = casbin `allow-and-deny` (default-DENY: needs a matching allow AND no matching deny), NOT `deny-override` (default-ALLOW). */
-exports.CASBIN_RBAC_DOMAIN_SCOPED_MODEL = `
-[request_definition]
-r = sub, dom, obj, act
-
-[policy_definition]
-p = sub, dom, obj, act, eft
-
-[role_definition]
-g = _, _, _
-g2 = _, _
-g3 = _, _
-g4 = _, _
-g5 = _, _
-
-[policy_effect]
-e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
-
-[matchers]
-m = g(r.sub, p.sub, r.dom) && (p.dom == "SYSTEM_WIDE" || (p.dom == "ANY_MEMBER" && g2(r.sub, r.dom)) || g3(r.dom, p.dom)) && (objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)) && g5(r.act, p.act)
-`;
-//# sourceMappingURL=rbac-domain.model.js.map

package/dist/components/auth/authorize/enforcers/models/rbac-domain.model.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac-domain.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/rbac-domain.model.ts"],"names":[],"mappings":";;;AAAA,0NAA0N;AAC1N,mHAAmH;AACnH,iKAAiK;AACpJ,QAAA,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;CAmB9C,CAAC","sourcesContent":["// Relation semantics live on AuthorizationPolicyVariants; g's KEY_MATCH domain fn makes `*`-domain links match any request domain; `objectMatch` appears directly in the matcher because hasLink only walks stored nodes.\n// g3/g4/g5 rely on DefaultRoleManager self-links (hasLink(name, name)) - a custom role manager must preserve them.\n/** Scoped RBAC model (v2). Effect = casbin `allow-and-deny` (default-DENY: needs a matching allow AND no matching deny), NOT `deny-override` (default-ALLOW). */\nexport const CASBIN_RBAC_DOMAIN_SCOPED_MODEL = `\n[request_definition]\nr = sub, dom, obj, act\n\n[policy_definition]\np = sub, dom, obj, act, eft\n\n[role_definition]\ng = _, _, _\ng2 = _, _\ng3 = _, _\ng4 = _, _\ng5 = _, _\n\n[policy_effect]\ne = some(where (p.eft == allow)) && !some(where (p.eft == deny))\n\n[matchers]\nm = g(r.sub, p.sub, r.dom) && (p.dom == \"SYSTEM_WIDE\" || (p.dom == \"ANY_MEMBER\" && g2(r.sub, r.dom)) || g3(r.dom, p.dom)) && (objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)) && g5(r.act, p.act)\n`;\n"]}

package/dist/components/auth/authorize/enforcers/policy-line-codec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-line-codec.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAC9B,MAAM,IAAI,gBAAgB,EAC1B,KAAK,IAAI,eAAe,EACzB,MAAM,QAAQ,CAAC;AAEhB;;;GAGG;AACH,qBAAa,eAAe;IAC1B,wKAAwK;WAC3J,gBAAgB,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,eAAe,CAAC;QACvB,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBrB,mNAAmN;WACtM,gBAAgB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BxF,4FAA4F;WAC/E,kBAAkB,CAAC,IAAI,EAAE;QACpC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlB"}

package/dist/components/auth/authorize/enforcers/policy-line-codec.js

@@ -1,59 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyLineCodec = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-/**
- * Serializes casbin policy state to/from plain string lines. Pure - no pool, no cache, no
- * lifecycle; every method takes exactly what it needs from the caller instead of holding state.
- */
-class PolicyLineCodec {
-    /** Extract a user's lines from an ISOLATED throwaway enforcer (own model + adapter), never a pooled serving one, so concurrent requests cannot change what we cache. */
-    static async extractUserLines(opts) {
-        const { casbin, model, adapter, user } = opts;
-        const loader = await casbin.newEnforcer(model, adapter);
-        if (!loader.loadFilteredPolicy) {
-            throw (0, core_1.getError)({
-                message: '[PolicyLineCodec] Adapter does not support loadFilteredPolicy.',
-            });
-        }
-        await loader.loadFilteredPolicy({
-            principal: { type: user.principalType, id: user.userId },
-        });
-        return PolicyLineCodec.extractLinesFrom({ enforcer: loader });
-    }
-    /** Serialize ALL p-types and g-types (not just `p`/`g`) back into casbin lines so the cached payload is complete for the scoped model; it reads stored rules, so the loader needs no matching funcs registered. */
-    static async extractLinesFrom(opts) {
-        const { enforcer } = opts;
-        const model = enforcer.getModel();
-        const lines = [];
-        const policyTypes = model.model.get(ignis_kernel_1.CasbinRuleVariants.P);
-        const policyTypesKeys = policyTypes?.keys() ?? [];
-        for (const ptype of policyTypesKeys) {
-            const rules = await enforcer.getNamedPolicy(ptype);
-            for (const rule of rules) {
-                lines.push([ptype, ...rule].join(', '));
-            }
-        }
-        const groupingTypes = model.model.get(ignis_kernel_1.CasbinRuleVariants.G);
-        const groupingTypesKeys = groupingTypes?.keys() ?? [];
-        for (const gtype of groupingTypesKeys) {
-            const rules = await enforcer.getNamedGroupingPolicy(gtype);
-            for (const rule of rules) {
-                lines.push([gtype, ...rule].join(', '));
-            }
-        }
-        return lines;
-    }
-    /** Atomically reset a borrowed enforcer's model to exactly `lines` + rebuild role links. */
-    static async loadLinesIntoModel(opts) {
-        const model = opts.enforcer.getModel();
-        model.clearPolicy();
-        for (const line of opts.lines) {
-            opts.helper.loadPolicyLine(line, model);
-        }
-        await opts.enforcer.buildRoleLinks();
-    }
-}
-exports.PolicyLineCodec = PolicyLineCodec;
-//# sourceMappingURL=policy-line-codec.js.map

package/dist/components/auth/authorize/enforcers/policy-line-codec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-line-codec.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AACvD,wDAI+B;AAO/B;;;GAGG;AACH,MAAa,eAAe;IAC1B,wKAAwK;IACxK,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAK7B;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,kBAAkB,CAAC;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,mNAAmN;IACnN,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAsC;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;CACF;AAlED,0CAkEC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport {\n  CasbinRuleVariants,\n  type IAuthorizationUser,\n  type ICasbinEnforcerOptions,\n} from '@venizia/ignis-kernel';\nimport type {\n  Enforcer as CasbinEnforcerType,\n  Helper as CasbinHelperType,\n  Model as CasbinModelType,\n} from 'casbin';\n\n/**\n * Serializes casbin policy state to/from plain string lines. Pure - no pool, no cache, no\n * lifecycle; every method takes exactly what it needs from the caller instead of holding state.\n */\nexport class PolicyLineCodec {\n  /** Extract a user's lines from an ISOLATED throwaway enforcer (own model + adapter), never a pooled serving one, so concurrent requests cannot change what we cache. */\n  static async extractUserLines(opts: {\n    casbin: typeof import('casbin');\n    model: CasbinModelType;\n    adapter: ICasbinEnforcerOptions['adapter'];\n    user: IAuthorizationUser;\n  }): Promise<string[]> {\n    const { casbin, model, adapter, user } = opts;\n    const loader = await casbin.newEnforcer(model, adapter);\n\n    if (!loader.loadFilteredPolicy) {\n      throw getError({\n        message: '[PolicyLineCodec] Adapter does not support loadFilteredPolicy.',\n      });\n    }\n\n    await loader.loadFilteredPolicy({\n      principal: { type: user.principalType, id: user.userId },\n    });\n\n    return PolicyLineCodec.extractLinesFrom({ enforcer: loader });\n  }\n\n  /** Serialize ALL p-types and g-types (not just `p`/`g`) back into casbin lines so the cached payload is complete for the scoped model; it reads stored rules, so the loader needs no matching funcs registered. */\n  static async extractLinesFrom(opts: { enforcer: CasbinEnforcerType }): Promise<string[]> {\n    const { enforcer } = opts;\n    const model = enforcer.getModel();\n    const lines: string[] = [];\n\n    const policyTypes = model.model.get(CasbinRuleVariants.P);\n    const policyTypesKeys = policyTypes?.keys() ?? [];\n    for (const ptype of policyTypesKeys) {\n      const rules = await enforcer.getNamedPolicy(ptype);\n      for (const rule of rules) {\n        lines.push([ptype, ...rule].join(', '));\n      }\n    }\n\n    const groupingTypes = model.model.get(CasbinRuleVariants.G);\n    const groupingTypesKeys = groupingTypes?.keys() ?? [];\n    for (const gtype of groupingTypesKeys) {\n      const rules = await enforcer.getNamedGroupingPolicy(gtype);\n      for (const rule of rules) {\n        lines.push([gtype, ...rule].join(', '));\n      }\n    }\n\n    return lines;\n  }\n\n  /** Atomically reset a borrowed enforcer's model to exactly `lines` + rebuild role links. */\n  static async loadLinesIntoModel(opts: {\n    enforcer: CasbinEnforcerType;\n    lines: string[];\n    helper: typeof CasbinHelperType;\n  }): Promise<void> {\n    const model = opts.enforcer.getModel();\n    model.clearPolicy();\n\n    for (const line of opts.lines) {\n      opts.helper.loadPolicyLine(line, model);\n    }\n\n    await opts.enforcer.buildRoleLinks();\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/user-policy-line-cache.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-policy-line-cache.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/user-policy-line-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,sKAAsK;AACtK,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAE1F;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAG9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwC;gBAE/D,IAAI,EAAE;QAChB,MAAM,EAAE,0BAA0B,GAAG;YAAE,GAAG,EAAE,IAAI,CAAA;SAAE,CAAC;QACnD,SAAS,EAAE,iBAAiB,CAAC;KAC9B;IAMD,uMAAuM;IACjM,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiClE,oCAAoC;IAC9B,UAAU,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAO1D,uMAAuM;IACjM,OAAO,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAUlD,+FAA+F;YACjF,eAAe;IAY7B,0FAA0F;YAC5E,UAAU;IAQxB,kGAAkG;IAClG,OAAO,CAAC,UAAU;CAkBnB"}

package/dist/components/auth/authorize/enforcers/user-policy-line-cache.js

@@ -1,98 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserPolicyLineCache = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-/**
- * Per-user redis cache of casbin policy lines. Owns the cache key, the TTL, and concurrent-miss
- * de-duplication so N simultaneous misses for the same user collapse onto one extraction.
- */
-class UserPolicyLineCache extends core_1.BaseHelper {
-    constructor(opts) {
-        super({ scope: UserPolicyLineCache.name });
-        // cacheKey -> in-progress line-fetch; concurrent misses for the same user share one extraction instead of all hitting the DB (see fetch()).
-        this.pendingLineFetches = new Map();
-        this.cached = opts.cached;
-        this.loadLines = opts.loadLines;
-    }
-    /** Fetch the user's lines, collapsing concurrent misses per key onto one extraction. Best-effort: two misses may race past the cache read and both extract (benign - per-user lines are identical). */
-    async fetch(opts) {
-        const cacheKey = await this.resolveCacheKey({ user: opts.user });
-        // Cache hit - Redis owns expiry (PX on write), so a present key is fresh; a corrupted/legacy entry must NOT 500 the request, so it is discarded and refetched.
-        const raw = await this.cached.options.connection.get({ key: cacheKey });
-        if (raw) {
-            const lines = this.parseLines({ raw, cacheKey });
-            if (lines) {
-                return lines;
-            }
-        }
-        const existing = this.pendingLineFetches.get(cacheKey);
-        if (existing) {
-            return existing;
-        }
-        // Cache miss (or discarded corrupt entry) - extract from an ISOLATED enforcer so a concurrent load cannot contaminate the cache, persist it, then return the lines for THIS request.
-        const task = async () => {
-            const lines = await this.loadLines({ user: opts.user });
-            await this.writeLines({ cacheKey, lines });
-            return lines;
-        };
-        const promise = task().finally(() => {
-            this.pendingLineFetches.delete(cacheKey);
-        });
-        this.pendingLineFetches.set(cacheKey, promise);
-        return promise;
-    }
-    /** Drop the user's cached entry. */
-    async invalidate(opts) {
-        const cacheKey = await this.resolveCacheKey({ user: opts.user });
-        const invalidatedKeys = await this.cached.options.connection.del({ keys: [cacheKey] });
-        return { cacheKey, invalidatedKeys };
-    }
-    /** Drop then recompute the user's cached entry via `loadLines` - an isolated extraction (never a pooled serving enforcer), so a concurrent request cannot make the cache hold another user's lines. */
-    async rebuild(opts) {
-        const cacheKey = await this.resolveCacheKey({ user: opts.user });
-        await this.cached.options.connection.del({ keys: [cacheKey] });
-        const lines = await this.loadLines({ user: opts.user });
-        await this.writeLines({ cacheKey, lines });
-        return { cacheKey, lines };
-    }
-    /** Compute the user's cache key and reject an empty result - consistent with the read path. */
-    async resolveCacheKey(opts) {
-        const cacheKey = await this.cached.options.keyFn({ user: opts.user });
-        if (!cacheKey) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthorizationErrors.CACHE_KEY_INVALID,
-                message: '[UserPolicyLineCache] keyFn returned an empty cache key.',
-            });
-        }
-        return cacheKey;
-    }
-    /** Single source of truth for the cache encoding. Used by the miss path and rebuild(). */
-    async writeLines(opts) {
-        await this.cached.options.connection.set({
-            key: opts.cacheKey,
-            value: opts.lines,
-            options: { expiresIn: this.cached.options.expiresIn },
-        });
-    }
-    /** Decode cached policy lines; on any corruption, log and return null so the caller refetches. */
-    parseLines(opts) {
-        try {
-            const parsed = JSON.parse(opts.raw);
-            if (!Array.isArray(parsed) || parsed.some((line) => typeof line !== 'string')) {
-                throw (0, core_1.getError)({
-                    message: '[UserPolicyLineCache] Cached payload is not an array of policy lines.',
-                });
-            }
-            return parsed;
-        }
-        catch (error) {
-            this.logger
-                .for(this.parseLines.name)
-                .warn('Discarding corrupted authz cache entry | key: %s | error: %s', opts.cacheKey, error);
-            return null;
-        }
-    }
-}
-exports.UserPolicyLineCache = UserPolicyLineCache;
-//# sourceMappingURL=user-policy-line-cache.js.map

package/dist/components/auth/authorize/enforcers/user-policy-line-cache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-policy-line-cache.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/user-policy-line-cache.ts"],"names":[],"mappings":";;;AAAA,sDAAmE;AAEnE,wDAI+B;AAK/B;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAOjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAP7C,4IAA4I;QAC3H,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAOzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,KAAK,CAAC,IAAkC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,+JAA+J;QAC/J,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,qLAAqL;QACrL,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,UAAU,CAAC,IAEhB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEvF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,OAAO,CAAC,IAEb;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,eAAe,CAAC,IAAkC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,kCAAmB,CAAC,iBAAiB;gBAC5C,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,UAAU,CAAC,IAA2C;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvC,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,UAAU,CAAC,IAAuC;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uEAAuE;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAkB,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,8DAA8D,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAlHD,kDAkHC","sourcesContent":["import { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationErrors,\n  type IAuthorizationUser,\n  type ICasbinEnforcerCachedRedis,\n} from '@venizia/ignis-kernel';\n\n/** Computes a user's policy lines on a cache miss - CasbinAuthorizationEnforcer wires this to its isolated-enforcer extraction (PolicyLineCodec.extractUserLines). */\nexport type TPolicyLineLoader = (opts: { user: IAuthorizationUser }) => Promise<string[]>;\n\n/**\n * Per-user redis cache of casbin policy lines. Owns the cache key, the TTL, and concurrent-miss\n * de-duplication so N simultaneous misses for the same user collapse onto one extraction.\n */\nexport class UserPolicyLineCache extends BaseHelper {\n  private readonly cached: ICasbinEnforcerCachedRedis & { use: true };\n  private readonly loadLines: TPolicyLineLoader;\n\n  // cacheKey -> in-progress line-fetch; concurrent misses for the same user share one extraction instead of all hitting the DB (see fetch()).\n  private readonly pendingLineFetches = new Map<string, Promise<string[]>>();\n\n  constructor(opts: {\n    cached: ICasbinEnforcerCachedRedis & { use: true };\n    loadLines: TPolicyLineLoader;\n  }) {\n    super({ scope: UserPolicyLineCache.name });\n    this.cached = opts.cached;\n    this.loadLines = opts.loadLines;\n  }\n\n  /** Fetch the user's lines, collapsing concurrent misses per key onto one extraction. Best-effort: two misses may race past the cache read and both extract (benign - per-user lines are identical). */\n  async fetch(opts: { user: IAuthorizationUser }): Promise<string[]> {\n    const cacheKey = await this.resolveCacheKey({ user: opts.user });\n\n    // Cache hit - Redis owns expiry (PX on write), so a present key is fresh; a corrupted/legacy entry must NOT 500 the request, so it is discarded and refetched.\n    const raw = await this.cached.options.connection.get({ key: cacheKey });\n    if (raw) {\n      const lines = this.parseLines({ raw, cacheKey });\n\n      if (lines) {\n        return lines;\n      }\n    }\n\n    const existing = this.pendingLineFetches.get(cacheKey);\n    if (existing) {\n      return existing;\n    }\n\n    // Cache miss (or discarded corrupt entry) - extract from an ISOLATED enforcer so a concurrent load cannot contaminate the cache, persist it, then return the lines for THIS request.\n    const task = async () => {\n      const lines = await this.loadLines({ user: opts.user });\n      await this.writeLines({ cacheKey, lines });\n      return lines;\n    };\n\n    const promise = task().finally(() => {\n      this.pendingLineFetches.delete(cacheKey);\n    });\n\n    this.pendingLineFetches.set(cacheKey, promise);\n    return promise;\n  }\n\n  /** Drop the user's cached entry. */\n  async invalidate(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; invalidatedKeys: number }> {\n    const cacheKey = await this.resolveCacheKey({ user: opts.user });\n    const invalidatedKeys = await this.cached.options.connection.del({ keys: [cacheKey] });\n\n    return { cacheKey, invalidatedKeys };\n  }\n\n  /** Drop then recompute the user's cached entry via `loadLines` - an isolated extraction (never a pooled serving enforcer), so a concurrent request cannot make the cache hold another user's lines. */\n  async rebuild(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lines: string[] }> {\n    const cacheKey = await this.resolveCacheKey({ user: opts.user });\n    await this.cached.options.connection.del({ keys: [cacheKey] });\n\n    const lines = await this.loadLines({ user: opts.user });\n    await this.writeLines({ cacheKey, lines });\n\n    return { cacheKey, lines };\n  }\n\n  /** Compute the user's cache key and reject an empty result - consistent with the read path. */\n  private async resolveCacheKey(opts: { user: IAuthorizationUser }): Promise<string> {\n    const cacheKey = await this.cached.options.keyFn({ user: opts.user });\n    if (!cacheKey) {\n      throw getError({\n        error: AuthorizationErrors.CACHE_KEY_INVALID,\n        message: '[UserPolicyLineCache] keyFn returned an empty cache key.',\n      });\n    }\n\n    return cacheKey;\n  }\n\n  /** Single source of truth for the cache encoding. Used by the miss path and rebuild(). */\n  private async writeLines(opts: { cacheKey: string; lines: string[] }): Promise<void> {\n    await this.cached.options.connection.set({\n      key: opts.cacheKey,\n      value: opts.lines,\n      options: { expiresIn: this.cached.options.expiresIn },\n    });\n  }\n\n  /** Decode cached policy lines; on any corruption, log and return null so the caller refetches. */\n  private parseLines(opts: { raw: string; cacheKey: string }): TNullable<string[]> {\n    try {\n      const parsed = JSON.parse(opts.raw);\n\n      if (!Array.isArray(parsed) || parsed.some((line) => typeof line !== 'string')) {\n        throw getError({\n          message: '[UserPolicyLineCache] Cached payload is not an array of policy lines.',\n        });\n      }\n\n      return parsed as string[];\n    } catch (error) {\n      this.logger\n        .for(this.parseLines.name)\n        .warn('Discarding corrupted authz cache entry | key: %s | error: %s', opts.cacheKey, error);\n      return null;\n    }\n  }\n}\n"]}

package/dist/components/auth/authorize/index.d.ts

@@ -1,6 +0,0 @@
-export * from '@venizia/ignis-kernel';
-export * from './adapters';
-export * from './component';
-export * from './enforcers';
-export * from './role-managers';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/authorize/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}

package/dist/components/auth/authorize/index.js

@@ -1,24 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-// `builders`, `common`, `middlewares`, `models` and `providers` moved to the kernel in full;
-// `enforcer-registry.ts` moved out of `enforcers` too (see `./enforcers/index.ts`).
-__exportStar(require("@venizia/ignis-kernel"), exports);
-__exportStar(require("./adapters"), exports);
-__exportStar(require("./component"), exports);
-__exportStar(require("./enforcers"), exports);
-__exportStar(require("./role-managers"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/components/auth/authorize/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6FAA6F;AAC7F,oFAAoF;AACpF,wDAAsC;AAEtC,6CAA2B;AAC3B,8CAA4B;AAC5B,8CAA4B;AAC5B,kDAAgC","sourcesContent":["// `builders`, `common`, `middlewares`, `models` and `providers` moved to the kernel in full;\n// `enforcer-registry.ts` moved out of `enforcers` too (see `./enforcers/index.ts`).\nexport * from '@venizia/ignis-kernel';\n\nexport * from './adapters';\nexport * from './component';\nexport * from './enforcers';\nexport * from './role-managers';\n"]}

package/dist/components/auth/authorize/role-managers/base.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,8BAAsB,eAAgB,SAAQ,UAAU;IACtD,SAAS,CAAC,aAAa,UAAS;IAEhC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAEvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,8GAA8G;IACxG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAI/B,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,8HAA8H;IAC9H,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,GAAG,IAAI;IAUlF,gGAAgG;IAChG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG;QACjE,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB;IAcD;;yGAEqG;IACrG,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACtC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,MAAM,EAAE;CA4Bb"}

package/dist/components/auth/authorize/role-managers/base.js

@@ -1,77 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseRoleManager = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-/**
- * Shared casbin `RoleManager` scaffolding for the resource, domain-hierarchy, and membership
- * role managers: the debug-only interface members (`printRoles`, `getDomains`, `getAllDomains`),
- * the `hasLink` wrapper around the synchronous `syncedHasLink`, the once-per-`clear()`
- * overlay-initialized log line, and the shared ancestor walk both hierarchy-aware managers use.
- */
-class BaseRoleManager extends core_1.BaseHelper {
-    constructor() {
-        super(...arguments);
-        this.graphReported = false;
-    }
-    async hasLink(name1, name2) {
-        return this.syncedHasLink(name1, name2);
-    }
-    /** casbin calls this after buildRoleLinks purely as a debug hook; none of the role managers log from here. */
-    async printRoles() { }
-    async getDomains() {
-        return [];
-    }
-    async getAllDomains() {
-        return [];
-    }
-    /** Logs the initialized-overlay line once per `clear()` cycle; `build` is only invoked the first time so counts stay lazy. */
-    reportGraphOnce(build) {
-        if (this.graphReported) {
-            return;
-        }
-        this.graphReported = true;
-        const { message, args } = build();
-        this.logger.for(this.syncedHasLink.name).debug(message, ...args);
-    }
-    /** Node and edge counts of a domain-hierarchy overlay, for the once-per-`clear()` debug log. */
-    static overlayStats(overlay) {
-        if (!overlay) {
-            return { nodeCount: 0, edgeCount: 0 };
-        }
-        let edgeCount = 0;
-        const overlayValues = overlay.values();
-        for (const parents of overlayValues) {
-            edgeCount += parents.size;
-        }
-        return { nodeCount: overlay.size, edgeCount };
-    }
-    /** `node` itself plus every ancestor reachable by walking the overlay's child->parent edges,
-     * node first. Cycle-safe: visited Set + index cursor, never shift(). Static - `ResourceRoleManager`
-     * extends this base with no overlay of this shape, so this must not force instance state onto it. */
-    static collectAncestors(opts) {
-        const { overlay, node } = opts;
-        const result = [node];
-        const visited = new Set([node]);
-        const queue = [node];
-        let head = 0;
-        while (head < queue.length) {
-            const current = queue[head];
-            head += 1;
-            const parents = overlay?.get(current);
-            if (!parents) {
-                continue;
-            }
-            for (const parent of parents) {
-                if (visited.has(parent)) {
-                    continue;
-                }
-                visited.add(parent);
-                result.push(parent);
-                queue.push(parent);
-            }
-        }
-        return result;
-    }
-}
-exports.BaseRoleManager = BaseRoleManager;
-//# sourceMappingURL=base.js.map

package/dist/components/auth/authorize/role-managers/base.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":";;;AAAA,sDAAyD;AAEzD;;;;;GAKG;AACH,MAAsB,eAAgB,SAAQ,iBAAU;IAAxD;;QACY,kBAAa,GAAG,KAAK,CAAC;IAkFlC,CAAC;IA9EC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8HAA8H;IACpH,eAAe,CAAC,KAAiD;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,gGAAgG;IACtF,MAAM,CAAC,YAAY,CAAC,OAAkC;QAI9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;yGAEqG;IAC3F,MAAM,CAAC,gBAAgB,CAAC,IAGjC;QACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnFD,0CAmFC","sourcesContent":["import { BaseHelper } from '@venizia/ignis-helpers/core';\n\n/**\n * Shared casbin `RoleManager` scaffolding for the resource, domain-hierarchy, and membership\n * role managers: the debug-only interface members (`printRoles`, `getDomains`, `getAllDomains`),\n * the `hasLink` wrapper around the synchronous `syncedHasLink`, the once-per-`clear()`\n * overlay-initialized log line, and the shared ancestor walk both hierarchy-aware managers use.\n */\nexport abstract class BaseRoleManager extends BaseHelper {\n  protected graphReported = false;\n\n  abstract syncedHasLink(name1: string, name2: string): boolean;\n\n  async hasLink(name1: string, name2: string): Promise<boolean> {\n    return this.syncedHasLink(name1, name2);\n  }\n\n  /** casbin calls this after buildRoleLinks purely as a debug hook; none of the role managers log from here. */\n  async printRoles(): Promise<void> {}\n\n  async getDomains(): Promise<string[]> {\n    return [];\n  }\n\n  async getAllDomains(): Promise<string[]> {\n    return [];\n  }\n\n  /** Logs the initialized-overlay line once per `clear()` cycle; `build` is only invoked the first time so counts stay lazy. */\n  protected reportGraphOnce(build: () => { message: string; args: unknown[] }): void {\n    if (this.graphReported) {\n      return;\n    }\n    this.graphReported = true;\n\n    const { message, args } = build();\n    this.logger.for(this.syncedHasLink.name).debug(message, ...args);\n  }\n\n  /** Node and edge counts of a domain-hierarchy overlay, for the once-per-`clear()` debug log. */\n  protected static overlayStats(overlay?: Map<string, Set<string>>): {\n    nodeCount: number;\n    edgeCount: number;\n  } {\n    if (!overlay) {\n      return { nodeCount: 0, edgeCount: 0 };\n    }\n\n    let edgeCount = 0;\n    const overlayValues = overlay.values();\n    for (const parents of overlayValues) {\n      edgeCount += parents.size;\n    }\n\n    return { nodeCount: overlay.size, edgeCount };\n  }\n\n  /** `node` itself plus every ancestor reachable by walking the overlay's child->parent edges,\n   * node first. Cycle-safe: visited Set + index cursor, never shift(). Static - `ResourceRoleManager`\n   * extends this base with no overlay of this shape, so this must not force instance state onto it. */\n  protected static collectAncestors(opts: {\n    overlay?: Map<string, Set<string>>;\n    node: string;\n  }): string[] {\n    const { overlay, node } = opts;\n    const result: string[] = [node];\n    const visited = new Set<string>([node]);\n    const queue: string[] = [node];\n\n    let head = 0;\n    while (head < queue.length) {\n      const current = queue[head];\n      head += 1;\n\n      const parents = overlay?.get(current);\n      if (!parents) {\n        continue;\n      }\n\n      for (const parent of parents) {\n        if (visited.has(parent)) {\n          continue;\n        }\n        visited.add(parent);\n        result.push(parent);\n        queue.push(parent);\n      }\n    }\n\n    return result;\n  }\n}\n"]}

package/dist/components/auth/authorize/role-managers/domain-hierarchy.d.ts

@@ -1,28 +0,0 @@
-import type { RoleManager } from 'casbin';
-import { BaseRoleManager } from './base';
-/**
- * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's
- * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.
- * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears
- * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`
- * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.
- */
-export declare class DomainHierarchyRoleManager extends BaseRoleManager implements RoleManager {
-    private readonly reversed;
-    private readonly overlay;
-    constructor(opts: {
-        reversed?: boolean;
-        overlay?: Map<string, Set<string>>;
-    });
-    /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */
-    clear(): Promise<void>;
-    addLink(child: string, parent: string): Promise<void>;
-    deleteLink(child: string, parent: string): Promise<void>;
-    syncedHasLink(name1: string, name2: string): boolean;
-    /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
-    getRoles(name: string): Promise<string[]>;
-    getUsers(name: string): Promise<string[]>;
-    /** True when `start` is `target`, or reaches it through the overlay. */
-    private reaches;
-}
-//# sourceMappingURL=domain-hierarchy.d.ts.map

package/dist/components/auth/authorize/role-managers/domain-hierarchy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-hierarchy.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/domain-hierarchy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,eAAgB,YAAW,WAAW;IACpF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGtB;gBAEU,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;KAAE;IAM5E,8JAA8J;IACxJ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAarD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAepD,8GAA8G;IACxG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAY/C,wEAAwE;IACxE,OAAO,CAAC,OAAO;CAahB"}

package/dist/components/auth/authorize/role-managers/domain-hierarchy.js

@@ -1,77 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DomainHierarchyRoleManager = void 0;
-const base_1 = require("./base");
-/**
- * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's
- * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.
- * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears
- * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`
- * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.
- */
-class DomainHierarchyRoleManager extends base_1.BaseRoleManager {
-    constructor(opts) {
-        super({ scope: DomainHierarchyRoleManager.name });
-        this.reversed = opts.reversed ?? false;
-        this.overlay = opts.overlay ?? new Map();
-    }
-    /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */
-    async clear() {
-        this.overlay.clear();
-        this.graphReported = false;
-    }
-    async addLink(child, parent) {
-        const existing = this.overlay.get(child);
-        if (existing) {
-            existing.add(parent);
-        }
-        else {
-            this.overlay.set(child, new Set([parent]));
-        }
-        if (!this.overlay.has(parent)) {
-            this.overlay.set(parent, new Set());
-        }
-    }
-    async deleteLink(child, parent) {
-        this.overlay.get(child)?.delete(parent);
-    }
-    syncedHasLink(name1, name2) {
-        this.reportGraphOnce(() => {
-            const { nodeCount, edgeCount } = DomainHierarchyRoleManager.overlayStats(this.overlay);
-            return {
-                message: 'domain-hierarchy role manager initialized | nodes: %d | edges: %d | reversed: %s',
-                args: [nodeCount, edgeCount, this.reversed],
-            };
-        });
-        const start = this.reversed ? name2 : name1;
-        const target = this.reversed ? name1 : name2;
-        return this.reaches({ start, target });
-    }
-    /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
-    async getRoles(name) {
-        return [...(this.overlay.get(name) ?? [])];
-    }
-    async getUsers(name) {
-        const users = [];
-        for (const [child, parents] of this.overlay) {
-            if (parents.has(name)) {
-                users.push(child);
-            }
-        }
-        return users;
-    }
-    /** True when `start` is `target`, or reaches it through the overlay. */
-    reaches(opts) {
-        const { start, target } = opts;
-        if (start === target) {
-            return true;
-        }
-        const ancestors = DomainHierarchyRoleManager.collectAncestors({
-            overlay: this.overlay,
-            node: start,
-        });
-        return ancestors.includes(target);
-    }
-}
-exports.DomainHierarchyRoleManager = DomainHierarchyRoleManager;
-//# sourceMappingURL=domain-hierarchy.js.map

package/dist/components/auth/authorize/role-managers/domain-hierarchy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-hierarchy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/domain-hierarchy.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,sBAAe;IAO7D,YAAY,IAAgE;QAC1E,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,GAAG,EAAuB,CAAC;IAChE,CAAC;IAED,8JAA8J;IAC9J,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvF,OAAO;gBACL,OAAO,EAAE,kFAAkF;gBAC3F,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAE7C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IAChE,OAAO,CAAC,IAAuC;QACrD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;YAC5D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAlFD,gEAkFC","sourcesContent":["import type { RoleManager } from 'casbin';\nimport { BaseRoleManager } from './base';\n\n/**\n * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's\n * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.\n * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears\n * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`\n * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.\n */\nexport class DomainHierarchyRoleManager extends BaseRoleManager implements RoleManager {\n  private readonly reversed: boolean;\n  private readonly overlay: Map<\n    string, // child domain\n    Set<string> // set of parent domains\n  >;\n\n  constructor(opts: { reversed?: boolean; overlay?: Map<string, Set<string>> }) {\n    super({ scope: DomainHierarchyRoleManager.name });\n    this.reversed = opts.reversed ?? false;\n    this.overlay = opts.overlay ?? new Map<string, Set<string>>();\n  }\n\n  /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */\n  async clear(): Promise<void> {\n    this.overlay.clear();\n    this.graphReported = false;\n  }\n\n  async addLink(child: string, parent: string): Promise<void> {\n    const existing = this.overlay.get(child);\n    if (existing) {\n      existing.add(parent);\n    } else {\n      this.overlay.set(child, new Set<string>([parent]));\n    }\n\n    if (!this.overlay.has(parent)) {\n      this.overlay.set(parent, new Set<string>());\n    }\n  }\n\n  async deleteLink(child: string, parent: string): Promise<void> {\n    this.overlay.get(child)?.delete(parent);\n  }\n\n  syncedHasLink(name1: string, name2: string): boolean {\n    this.reportGraphOnce(() => {\n      const { nodeCount, edgeCount } = DomainHierarchyRoleManager.overlayStats(this.overlay);\n      return {\n        message: 'domain-hierarchy role manager initialized | nodes: %d | edges: %d | reversed: %s',\n        args: [nodeCount, edgeCount, this.reversed],\n      };\n    });\n\n    const start = this.reversed ? name2 : name1;\n    const target = this.reversed ? name1 : name2;\n\n    return this.reaches({ start, target });\n  }\n\n  /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */\n  async getRoles(name: string): Promise<string[]> {\n    return [...(this.overlay.get(name) ?? [])];\n  }\n\n  async getUsers(name: string): Promise<string[]> {\n    const users: string[] = [];\n\n    for (const [child, parents] of this.overlay) {\n      if (parents.has(name)) {\n        users.push(child);\n      }\n    }\n\n    return users;\n  }\n\n  /** True when `start` is `target`, or reaches it through the overlay. */\n  private reaches(opts: { start: string; target: string }): boolean {\n    const { start, target } = opts;\n\n    if (start === target) {\n      return true;\n    }\n\n    const ancestors = DomainHierarchyRoleManager.collectAncestors({\n      overlay: this.overlay,\n      node: start,\n    });\n    return ancestors.includes(target);\n  }\n}\n"]}

package/dist/components/auth/authorize/role-managers/index.d.ts

@@ -1,5 +0,0 @@
-export * from './base';
-export * from './domain-hierarchy';
-export * from './membership';
-export * from './resource';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/role-managers/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/components/auth/authorize/role-managers/index.js

@@ -1,21 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./base"), exports);
-__exportStar(require("./domain-hierarchy"), exports);
-__exportStar(require("./membership"), exports);
-__exportStar(require("./resource"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/role-managers/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,qDAAmC;AACnC,+CAA6B;AAC7B,6CAA2B","sourcesContent":["export * from './base';\nexport * from './domain-hierarchy';\nexport * from './membership';\nexport * from './resource';\n"]}

package/dist/components/auth/authorize/role-managers/membership.d.ts

@@ -1,21 +0,0 @@
-import type { RoleManager } from 'casbin';
-import { BaseRoleManager } from './base';
-/** `g2` axis (`g2(r.sub, r.dom)`): membership holds when the user joined the request domain or any
- * ancestor of it, walking the shared per-request domain-hierarchy overlay. Memberships are
- * per-principal and rebuilt every request, so `clear()` wipes all. */
-export declare class MembershipRoleManager extends BaseRoleManager implements RoleManager {
-    private readonly overlay?;
-    private memberships;
-    constructor(opts: {
-        overlay?: Map<string, Set<string>>;
-    });
-    clear(): Promise<void>;
-    addLink(user: string, domain: string): Promise<void>;
-    deleteLink(user: string, domain: string): Promise<void>;
-    /** True when `name1` (user) joined `name2` (request domain) itself, or any ancestor of it. Walks UP from the request domain only - walking down from every joined domain would fan out over the whole subtree. */
-    syncedHasLink(name1: string, name2: string): boolean;
-    /** Local membership state only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
-    getRoles(name: string): Promise<string[]>;
-    getUsers(name: string): Promise<string[]>;
-}
-//# sourceMappingURL=membership.d.ts.map