@venizia/ignis 0.4.3 → 0.4.5

package/dist/components/auth/authenticate/strategies/jwks/verifier.js

@@ -1,45 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var JWKSVerifierAuthenticationStrategy_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWKSVerifierAuthenticationStrategy = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const services_1 = require("../../services");
-let JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = class JWKSVerifierAuthenticationStrategy extends core_1.BaseHelper {
-    constructor(service) {
-        super({ scope: JWKSVerifierAuthenticationStrategy_1.name });
-        this.service = service;
-        this.name = ignis_kernel_3.Authentication.STRATEGY_JWT;
-        this.standard = ignis_kernel_3.JOSEStandards.JWKS;
-    }
-    authenticate(context) {
-        const token = this.service.extractCredentials(context);
-        return this.service.verify(token);
-    }
-};
-exports.JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy;
-exports.JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({
-        key: ignis_inversion_1.BindingKeys.build({
-            namespace: ignis_kernel_2.BindingNamespaces.SERVICE,
-            key: services_1.JWKSVerifierTokenService.name,
-        }),
-    })),
-    __metadata("design:paramtypes", [services_1.JWKSVerifierTokenService])
-], JWKSVerifierAuthenticationStrategy);
-//# sourceMappingURL=verifier.js.map

package/dist/components/auth/authenticate/strategies/jwks/verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAA0D;AAE1D,IAAa,kCAAkC,0CAA/C,MAAa,kCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA4C;QAE5C,KAAK,CAAC,EAAE,KAAK,EAAE,oCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFlD,YAAO,GAAP,OAAO,CAA6B;QAV9C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,gFAAkC;6CAAlC,kCAAkC;IAQ1C,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,mCAAwB,CAAC,IAAI;SACnC,CAAC;KACH,CAAC,CAAA;qCACe,mCAAwB;GAdhC,kCAAkC,CAuB9C","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n  JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWKSVerifierTokenService } from '../../services';\n\nexport class JWKSVerifierAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_JWT;\n  standard = JOSEStandards.JWKS;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: JWKSVerifierTokenService.name,\n      }),\n    })\n    private service: JWKSVerifierTokenService<E>,\n  ) {\n    super({ scope: JWKSVerifierAuthenticationStrategy.name });\n  }\n\n  authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const token = this.service.extractCredentials(context);\n    return this.service.verify(token);\n  }\n}\n"]}

package/dist/components/auth/authenticate/strategies/jws.strategy.d.ts

@@ -1,13 +0,0 @@
-import { type TContext } from '@venizia/ignis-kernel';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type Env } from 'hono';
-import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
-import { JWSTokenService } from '../services';
-export declare class JWSAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
-    private service;
-    name: string;
-    standard: string;
-    constructor(service: JWSTokenService<E>);
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-//# sourceMappingURL=jws.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/jws.strategy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jws.strategy.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/jws.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,qBAAa,yBAAyB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CACxD,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAqB;gBASnB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAKrC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}

package/dist/components/auth/authenticate/strategies/jws.strategy.js

@@ -1,45 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var JWSAuthenticationStrategy_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWSAuthenticationStrategy = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const services_1 = require("../services");
-let JWSAuthenticationStrategy = JWSAuthenticationStrategy_1 = class JWSAuthenticationStrategy extends core_1.BaseHelper {
-    constructor(service) {
-        super({ scope: JWSAuthenticationStrategy_1.name });
-        this.service = service;
-        this.name = ignis_kernel_3.Authentication.STRATEGY_JWT;
-        this.standard = ignis_kernel_3.JOSEStandards.JWS;
-    }
-    authenticate(context) {
-        const token = this.service.extractCredentials(context);
-        return this.service.verify(token);
-    }
-};
-exports.JWSAuthenticationStrategy = JWSAuthenticationStrategy;
-exports.JWSAuthenticationStrategy = JWSAuthenticationStrategy = JWSAuthenticationStrategy_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({
-        key: ignis_inversion_1.BindingKeys.build({
-            namespace: ignis_kernel_2.BindingNamespaces.SERVICE,
-            key: services_1.JWSTokenService.name,
-        }),
-    })),
-    __metadata("design:paramtypes", [services_1.JWSTokenService])
-], JWSAuthenticationStrategy);
-//# sourceMappingURL=jws.strategy.js.map

package/dist/components/auth/authenticate/strategies/jws.strategy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jws.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/jws.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,0CAA8C;AAE9C,IAAa,yBAAyB,iCAAtC,MAAa,yBACX,SAAQ,iBAAU;IAMlB,YAOE,OAAmC;QAEnC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAAyB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFzC,YAAO,GAAP,OAAO,CAAoB;QAVrC,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,GAAG,CAAC;IAY7B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,8DAAyB;oCAAzB,yBAAyB;IAQjC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,0BAAe,CAAC,IAAI;SAC1B,CAAC;KACH,CAAC,CAAA;qCACe,0BAAe;GAdvB,yBAAyB,CAuBrC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n  JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWSTokenService } from '../services';\n\nexport class JWSAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_JWT;\n  standard = JOSEStandards.JWS;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: JWSTokenService.name,\n      }),\n    })\n    private service: JWSTokenService<E>,\n  ) {\n    super({ scope: JWSAuthenticationStrategy.name });\n  }\n\n  authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const token = this.service.extractCredentials(context);\n    return this.service.verify(token);\n  }\n}\n"]}

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts

@@ -1,19 +0,0 @@
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import type { Env } from 'hono';
-import type { IAuthUser, IAuthenticationStrategy, IServiceAuthOptions, TContext } from '@venizia/ignis-kernel';
-import { ServiceAssertionVerifierService } from '../services/service/verifier.service';
-/**
- * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's
- * own JWKS. No identity round trip and no shared password.
- *
- * It proves which service called, never which user. `resolvePrincipal` is where the application
- * turns a caller name into one of its own principals.
- */
-export declare class ServiceAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
-    private readonly verifier;
-    private readonly options;
-    name: string;
-    constructor(verifier: ServiceAssertionVerifierService, options: IServiceAuthOptions<E>);
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-//# sourceMappingURL=service.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.strategy.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAShC,OAAO,KAAK,EACV,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAEvF;;;;;;GAMG;AACH,qBAAa,6BAA6B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC5D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAWnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,IAAI,SAAmC;gBASpB,QAAQ,EAAE,+BAA+B,EAEzC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAK5C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CA8BrE"}

package/dist/components/auth/authenticate/strategies/service.strategy.js

@@ -1,73 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var ServiceAuthenticationStrategy_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAuthenticationStrategy = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const verifier_service_1 = require("../services/service/verifier.service");
-/**
- * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's
- * own JWKS. No identity round trip and no shared password.
- *
- * It proves which service called, never which user. `resolvePrincipal` is where the application
- * turns a caller name into one of its own principals.
- */
-let ServiceAuthenticationStrategy = ServiceAuthenticationStrategy_1 = class ServiceAuthenticationStrategy extends core_1.BaseHelper {
-    constructor(verifier, options) {
-        super({ scope: ServiceAuthenticationStrategy_1.name });
-        this.verifier = verifier;
-        this.options = options;
-        this.name = ignis_kernel_1.Authentication.STRATEGY_SERVICE;
-    }
-    async authenticate(context) {
-        const token = context.req.header(ignis_kernel_1.ServiceAssertion.HEADER);
-        if (!token) {
-            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_MISSING });
-        }
-        // The raw url, NOT `context.req.path`: Hono hands that back percent-DECODED, so a route carrying
-        // a space or a non-ASCII slug would never match the encoded path the caller signed.
-        const { issuer } = await this.verifier.verify({
-            token,
-            method: context.req.method,
-            path: new URL(context.req.url).pathname,
-        });
-        const principal = await this.options.resolvePrincipal({ issuer, context });
-        // Validated rather than trusted. `executeAnyMode` calls `setCurrentUser` unconditionally, so an
-        // application returning a principal without a `userId` would authenticate the request and then
-        // fail at the first write, far from here. `executeAllMode` already refuses it; this closes the
-        // gap between the two modes.
-        if (!principal?.userId) {
-            this.logger
-                .for(this.authenticate.name)
-                .warn('resolvePrincipal returned no usable principal | iss: %s', issuer);
-            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.PRINCIPAL_UNRESOLVED });
-        }
-        // Which service called is audit-relevant even when the principal is shared across callers.
-        return { ...principal, callerService: issuer };
-    }
-};
-exports.ServiceAuthenticationStrategy = ServiceAuthenticationStrategy;
-exports.ServiceAuthenticationStrategy = ServiceAuthenticationStrategy = ServiceAuthenticationStrategy_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({
-        key: ignis_inversion_1.BindingKeys.build({
-            namespace: ignis_kernel_1.BindingNamespaces.SERVICE,
-            key: verifier_service_1.ServiceAssertionVerifierService.name,
-        }),
-    })),
-    __param(1, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
-    __metadata("design:paramtypes", [verifier_service_1.ServiceAssertionVerifierService, Object])
-], ServiceAuthenticationStrategy);
-//# sourceMappingURL=service.strategy.js.map

package/dist/components/auth/authenticate/strategies/service.strategy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmE;AACnE,8DAAuD;AAEvD,wDAO+B;AAO/B,2EAAuF;AAEvF;;;;;;GAMG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BACX,SAAQ,iBAAU;IAKlB,YAOE,QAA0D,EAE1D,OAAgD;QAEhD,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAJpC,aAAQ,GAAR,QAAQ,CAAiC;QAEzC,YAAO,GAAP,OAAO,CAAwB;QAXlD,SAAI,GAAG,6BAAc,CAAC,gBAAgB,CAAC;IAcvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,+BAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,iGAAiG;QACjG,oFAAoF;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC3B,IAAI,CAAC,yDAAyD,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,2FAA2F;QAC3F,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAlDY,sEAA6B;wCAA7B,6BAA6B;IAOrC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,kDAA+B,CAAC,IAAI;SAC1C,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;qCAD9B,kDAA+B;GAbjD,6BAA6B,CAkDzC","sourcesContent":["import { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport type { Env } from 'hono';\nimport {\n  AuthenticateBindingKeys,\n  Authentication,\n  AuthenticationErrors,\n  BindingNamespaces,\n  ServiceAssertion,\n  inject,\n} from '@venizia/ignis-kernel';\nimport type {\n  IAuthUser,\n  IAuthenticationStrategy,\n  IServiceAuthOptions,\n  TContext,\n} from '@venizia/ignis-kernel';\nimport { ServiceAssertionVerifierService } from '../services/service/verifier.service';\n\n/**\n * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's\n * own JWKS. No identity round trip and no shared password.\n *\n * It proves which service called, never which user. `resolvePrincipal` is where the application\n * turns a caller name into one of its own principals.\n */\nexport class ServiceAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_SERVICE;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: ServiceAssertionVerifierService.name,\n      }),\n    })\n    private readonly verifier: ServiceAssertionVerifierService,\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions<E>,\n  ) {\n    super({ scope: ServiceAuthenticationStrategy.name });\n  }\n\n  async authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const token = context.req.header(ServiceAssertion.HEADER);\n    if (!token) {\n      throw getError({ error: AuthenticationErrors.ASSERTION_MISSING });\n    }\n\n    // The raw url, NOT `context.req.path`: Hono hands that back percent-DECODED, so a route carrying\n    // a space or a non-ASCII slug would never match the encoded path the caller signed.\n    const { issuer } = await this.verifier.verify({\n      token,\n      method: context.req.method,\n      path: new URL(context.req.url).pathname,\n    });\n\n    const principal = await this.options.resolvePrincipal({ issuer, context });\n\n    // Validated rather than trusted. `executeAnyMode` calls `setCurrentUser` unconditionally, so an\n    // application returning a principal without a `userId` would authenticate the request and then\n    // fail at the first write, far from here. `executeAllMode` already refuses it; this closes the\n    // gap between the two modes.\n    if (!principal?.userId) {\n      this.logger\n        .for(this.authenticate.name)\n        .warn('resolvePrincipal returned no usable principal | iss: %s', issuer);\n      throw getError({ error: AuthenticationErrors.PRINCIPAL_UNRESOLVED });\n    }\n\n    // Which service called is audit-relevant even when the principal is shared across callers.\n    return { ...principal, callerService: issuer };\n  }\n}\n"]}

package/dist/components/auth/authorize/adapters/base-filtered.d.ts

@@ -1,31 +0,0 @@
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type FilteredAdapter, type Model } from 'casbin';
-import type { SQL } from 'drizzle-orm';
-import type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './common';
-/** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */
-export declare abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter> extends BaseHelper implements FilteredAdapter {
-    protected readonly dataSource: ICasbinPolicySource;
-    constructor(opts: {
-        scope: string;
-        dataSource: ICasbinPolicySource;
-    });
-    protected get connector(): TCasbinPolicyConnector;
-    /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */
-    protected query<TRow>(opts: {
-        statement: SQL;
-    }): Promise<TRow[]>;
-    /** Load ONLY the policies matching `filter` into `model` (the store is read for one principal). */
-    abstract loadFilteredPolicy(model: Model, filter: TFilter): Promise<void>;
-    isFiltered(): boolean;
-    loadPolicy(): Promise<void>;
-    savePolicy(): Promise<boolean>;
-    addPolicy(): Promise<void>;
-    removePolicy(): Promise<void>;
-    removeFilteredPolicy(): Promise<void>;
-    /** Parse + load casbin policy lines into a model. Shared by subclasses' loadFilteredPolicy. */
-    protected loadLines(opts: {
-        model: Model;
-        lines: string[];
-    }): Promise<void>;
-}
-//# sourceMappingURL=base-filtered.d.ts.map

package/dist/components/auth/authorize/adapters/base-filtered.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-filtered.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGvC,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAEjG,0LAA0L;AAC1L,8BAAsB,mBAAmB,CAAC,OAAO,GAAG,mBAAmB,CACrE,SAAQ,UACR,YAAW,eAAe;IAE1B,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;gBAEvC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,CAAA;KAAE;IAKpE,SAAS,KAAK,SAAS,IAAI,sBAAsB,CAKhD;IAED,2LAA2L;cAC3K,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAKtE,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAEzE,UAAU,IAAI,OAAO;IAKf,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAG9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAC7B,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3C,+FAA+F;cAC/E,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlF"}

package/dist/components/auth/authorize/adapters/base-filtered.js

@@ -1,45 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseFilteredAdapter = void 0;
-const utilities_1 = require("../../../../utilities");
-const core_1 = require("@venizia/ignis-helpers/core");
-const casbin_module_1 = require("../enforcers/casbin-module");
-const connector_1 = require("./connector");
-/** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */
-class BaseFilteredAdapter extends core_1.BaseHelper {
-    constructor(opts) {
-        super({ scope: opts.scope });
-        this.dataSource = opts.dataSource;
-    }
-    get connector() {
-        return connector_1.PolicyConnectorResolver.resolve({
-            source: this.dataSource,
-            caller: 'BaseFilteredAdapter',
-        });
-    }
-    /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */
-    async query(opts) {
-        const result = await this.connector.execute(opts.statement);
-        return (0, utilities_1.readResultRows)({ result });
-    }
-    isFiltered() {
-        return true;
-    }
-    // Read-only adapter - write methods are intentional no-ops.
-    async loadPolicy() { }
-    async savePolicy() {
-        return true;
-    }
-    async addPolicy() { }
-    async removePolicy() { }
-    async removeFilteredPolicy() { }
-    /** Parse + load casbin policy lines into a model. Shared by subclasses' loadFilteredPolicy. */
-    async loadLines(opts) {
-        const { Helper } = await casbin_module_1.CasbinModule.load();
-        for (const line of opts.lines) {
-            Helper.loadPolicyLine(line, opts.model);
-        }
-    }
-}
-exports.BaseFilteredAdapter = BaseFilteredAdapter;
-//# sourceMappingURL=base-filtered.js.map

package/dist/components/auth/authorize/adapters/base-filtered.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAC7C,sDAAyD;AAGzD,8DAA0D;AAC1D,2CAAsD;AAGtD,0LAA0L;AAC1L,MAAsB,mBACpB,SAAQ,iBAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,mCAAuB,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAA,0BAAc,EAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AA/CD,kDA+CC","sourcesContent":["import { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { type FilteredAdapter, type Model } from 'casbin';\nimport type { SQL } from 'drizzle-orm';\nimport { CasbinModule } from '../enforcers/casbin-module';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './common';\n\n/** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */\nexport abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter>\n  extends BaseHelper\n  implements FilteredAdapter\n{\n  protected readonly dataSource: ICasbinPolicySource;\n\n  constructor(opts: { scope: string; dataSource: ICasbinPolicySource }) {\n    super({ scope: opts.scope });\n    this.dataSource = opts.dataSource;\n  }\n\n  protected get connector(): TCasbinPolicyConnector {\n    return PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: 'BaseFilteredAdapter',\n    });\n  }\n\n  /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */\n  protected async query<TRow>(opts: { statement: SQL }): Promise<TRow[]> {\n    const result = await this.connector.execute(opts.statement);\n    return readResultRows<TRow>({ result });\n  }\n\n  /** Load ONLY the policies matching `filter` into `model` (the store is read for one principal). */\n  abstract loadFilteredPolicy(model: Model, filter: TFilter): Promise<void>;\n\n  isFiltered(): boolean {\n    return true;\n  }\n\n  // Read-only adapter - write methods are intentional no-ops.\n  async loadPolicy(): Promise<void> {}\n  async savePolicy(): Promise<boolean> {\n    return true;\n  }\n  async addPolicy(): Promise<void> {}\n  async removePolicy(): Promise<void> {}\n  async removeFilteredPolicy(): Promise<void> {}\n\n  /** Parse + load casbin policy lines into a model. Shared by subclasses' loadFilteredPolicy. */\n  protected async loadLines(opts: { model: Model; lines: string[] }): Promise<void> {\n    const { Helper } = await CasbinModule.load();\n    for (const line of opts.lines) {\n      Helper.loadPolicyLine(line, opts.model);\n    }\n  }\n}\n"]}

package/dist/components/auth/authorize/adapters/common/index.d.ts

@@ -1,2 +0,0 @@
-export * from './types';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/common/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}

package/dist/components/auth/authorize/adapters/common/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./types"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/common/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB","sourcesContent":["export * from './types';\n"]}

package/dist/components/auth/authorize/adapters/common/types.d.ts

@@ -1,49 +0,0 @@
-import type { IdType } from '../../../../../base';
-import type { AnyType } from '@venizia/ignis-helpers/common';
-import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-/** Filter passed to loadFilteredPolicy: which principal's policies to load. */
-export interface ICasbinPolicyFilter {
-    principal: {
-        type: string;
-        id: IdType;
-    };
-}
-/** Drizzle connector for policy queries, typed on the shared `PgDatabase` base so postgres-js fits too. Declared here rather than imported from `@/connectors/postgres`: components depend on a minimal local contract, never a connector class. */
-export type TCasbinPolicyConnector = PgDatabase<PgQueryResultHKT, Record<string, AnyType>>;
-/** Minimal source the adapters depend on - any drizzle-backed datasource satisfies it. */
-export interface ICasbinPolicySource {
-    /** Preferred: lazily wires the driver on first read and survives pool rotation, mirroring repositories. */
-    getConnector?(): TCasbinPolicyConnector;
-    /** Back-compat: a pre-wired connector. Prefer getConnector on a real datasource. */
-    connector?: TCasbinPolicyConnector;
-}
-/** Maps a logical table onto its physical name + schema. */
-export interface IScopedCasbinTable {
-    tableName: string;
-    schemaName?: string;
-}
-/** All physical mapping the ScopedCasbinAdapter needs. App provides this; framework stays decoupled. */
-export interface IScopedCasbinEntities {
-    policyDefinition: IScopedCasbinTable & {
-        metadata?: {
-            columnName: string;
-        };
-    };
-    /** Permission catalog (id, code, ...). */
-    permission: IScopedCasbinTable;
-    /** Principal type labels used as casbin name prefixes. */
-    principals: {
-        user: string;
-        role: string;
-    };
-    /** Domain type labels (e.g. ['Merchant', 'Organizer']). */
-    domainTypes: string[];
-    /** Soft-delete handling for both tables. */
-    softDelete?: {
-        use: false;
-    } | {
-        use: true;
-        columnName: string;
-    };
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/components/auth/authorize/adapters/common/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAExE,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,oPAAoP;AACpP,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,2GAA2G;IAC3G,YAAY,CAAC,IAAI,sBAAsB,CAAC;IAExC,oFAAoF;IACpF,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wGAAwG;AACxG,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,kBAAkB,GAAG;QACrC,QAAQ,CAAC,EAAE;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACnC,CAAC;IAEF,0CAA0C;IAC1C,UAAU,EAAE,kBAAkB,CAAC;IAE/B,0DAA0D;IAC1D,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAE3C,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,4CAA4C;IAC5C,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/components/auth/authorize/adapters/common/types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/dist/components/auth/authorize/adapters/common/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { AnyType } from '@venizia/ignis-helpers/common';\nimport type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';\n\n/** Filter passed to loadFilteredPolicy: which principal's policies to load. */\nexport interface ICasbinPolicyFilter {\n  principal: { type: string; id: IdType };\n}\n\n/** Drizzle connector for policy queries, typed on the shared `PgDatabase` base so postgres-js fits too. Declared here rather than imported from `@/connectors/postgres`: components depend on a minimal local contract, never a connector class. */\nexport type TCasbinPolicyConnector = PgDatabase<PgQueryResultHKT, Record<string, AnyType>>;\n\n/** Minimal source the adapters depend on - any drizzle-backed datasource satisfies it. */\nexport interface ICasbinPolicySource {\n  /** Preferred: lazily wires the driver on first read and survives pool rotation, mirroring repositories. */\n  getConnector?(): TCasbinPolicyConnector;\n\n  /** Back-compat: a pre-wired connector. Prefer getConnector on a real datasource. */\n  connector?: TCasbinPolicyConnector;\n}\n\n/** Maps a logical table onto its physical name + schema. */\nexport interface IScopedCasbinTable {\n  tableName: string;\n  schemaName?: string;\n}\n\n/** All physical mapping the ScopedCasbinAdapter needs. App provides this; framework stays decoupled. */\nexport interface IScopedCasbinEntities {\n  policyDefinition: IScopedCasbinTable & {\n    metadata?: { columnName: string };\n  };\n\n  /** Permission catalog (id, code, ...). */\n  permission: IScopedCasbinTable;\n\n  /** Principal type labels used as casbin name prefixes. */\n  principals: { user: string; role: string };\n\n  /** Domain type labels (e.g. ['Merchant', 'Organizer']). */\n  domainTypes: string[];\n\n  /** Soft-delete handling for both tables. */\n  softDelete?: { use: false } | { use: true; columnName: string };\n}\n"]}

package/dist/components/auth/authorize/adapters/connector.d.ts

@@ -1,10 +0,0 @@
-import type { ICasbinPolicySource, TCasbinPolicyConnector } from './common';
-/** Connector-resolution logic shared by every adapter/loader reading the casbin policy store. */
-export declare class PolicyConnectorResolver {
-    /** Resolve the wired connector off a policy datasource. */
-    static resolve(opts: {
-        source: ICasbinPolicySource;
-        caller: string;
-    }): TCasbinPolicyConnector;
-}
-//# sourceMappingURL=connector.d.ts.map

package/dist/components/auth/authorize/adapters/connector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/connector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE5E,iGAAiG;AACjG,qBAAa,uBAAuB;IAClC,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;CAY9F"}

package/dist/components/auth/authorize/adapters/connector.js

@@ -1,20 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyConnectorResolver = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-/** Connector-resolution logic shared by every adapter/loader reading the casbin policy store. */
-class PolicyConnectorResolver {
-    /** Resolve the wired connector off a policy datasource. */
-    static resolve(opts) {
-        const { source, caller } = opts;
-        const resolved = source.getConnector?.() ?? source.connector;
-        if (!resolved) {
-            throw (0, core_1.getError)({
-                message: `[${caller}] datasource exposes neither a getConnector() accessor nor a wired connector - pass a datasource whose getConnector() lazily wires the driver.`,
-            });
-        }
-        return resolved;
-    }
-}
-exports.PolicyConnectorResolver = PolicyConnectorResolver;
-//# sourceMappingURL=connector.js.map

package/dist/components/auth/authorize/adapters/connector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/connector.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAGvD,iGAAiG;AACjG,MAAa,uBAAuB;IAClC,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAqD;QAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,MAAM,gJAAgJ;aACpK,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAdD,0DAcC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport type { ICasbinPolicySource, TCasbinPolicyConnector } from './common';\n\n/** Connector-resolution logic shared by every adapter/loader reading the casbin policy store. */\nexport class PolicyConnectorResolver {\n  /** Resolve the wired connector off a policy datasource. */\n  static resolve(opts: { source: ICasbinPolicySource; caller: string }): TCasbinPolicyConnector {\n    const { source, caller } = opts;\n    const resolved = source.getConnector?.() ?? source.connector;\n\n    if (!resolved) {\n      throw getError({\n        message: `[${caller}] datasource exposes neither a getConnector() accessor nor a wired connector - pass a datasource whose getConnector() lazily wires the driver.`,\n      });\n    }\n\n    return resolved;\n  }\n}\n"]}

package/dist/components/auth/authorize/adapters/custom-grant-expander.d.ts

@@ -1,52 +0,0 @@
-import type { IdType } from '../../../../base';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type TCustomGrantMetadata } from '@venizia/ignis-kernel';
-import type { ICasbinPolicySource, IScopedCasbinEntities } from './common';
-/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */
-export type TCustomGrantRow = {
-    subjectId: IdType;
-    objectSubject: string;
-    ops: string[];
-    domain: string;
-    effect: string;
-};
-/**
- * Expands "custom" operation-subset grants (`metadata.ops`) into one casbin line per catalogued
- * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL
- * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.
- */
-export declare class CustomGrantExpander extends BaseHelper {
-    protected readonly dataSource: ICasbinPolicySource;
-    protected readonly permission: IScopedCasbinEntities['permission'];
-    protected readonly softDelete: IScopedCasbinEntities['softDelete'];
-    constructor(opts: {
-        dataSource: ICasbinPolicySource;
-        entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;
-    });
-    /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */
-    rejectCustomRow(opts: {
-        row: {
-            subjectId: IdType;
-            objectCode: string;
-            objectMethod: string;
-        };
-        parsed: TCustomGrantMetadata | null;
-        isCustomAction: boolean;
-        metadataColumnName?: string;
-    }): string | null;
-    /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */
-    expandCustomGrants(opts: {
-        subjectType: string;
-        customRows: TCustomGrantRow[];
-    }): Promise<{
-        lines: string[];
-        rejections: string[];
-    }>;
-    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
-    private qualifiedTable;
-    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
-    private softDeleteClause;
-    /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */
-    private queryOperationCatalog;
-}
-//# sourceMappingURL=custom-grant-expander.d.ts.map

package/dist/components/auth/authorize/adapters/custom-grant-expander.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"custom-grant-expander.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAI3E,kHAAkH;AAClH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACnE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAEvD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC;KACpE;IAOD,yFAAyF;IACzF,eAAe,CAAC,IAAI,EAAE;QACpB,GAAG,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QACrE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,MAAM,GAAG,IAAI;IAsBjB,4NAA4N;IACtN,kBAAkB,CAAC,IAAI,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,eAAe,EAAE,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAoDtD,uGAAuG;IACvG,OAAO,CAAC,cAAc;IAMtB,4LAA4L;IAC5L,OAAO,CAAC,gBAAgB;IASxB,sGAAsG;YACxF,qBAAqB;CA6BpC"}