ddd-ts-kit 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -4,6 +4,27 @@ What each version changes for someone who uses the kit. The packages of `package
 together, under one version; the notes of each [GitHub release](https://github.com/gbourgeat/ddd-ts-kit/releases)
 list the pull requests behind it.
 
+## 0.20.0
+
+**A permission no role holds is said.** In a project whose rights are roles (`stack.authz`
+`rbac`), `authz/granted` (`ddd-ts-kit check`) reports each permission a context declares that no
+role names in `platform/auth/roles.ts`, nor `platform/auth/signed-in-grants.ts`: the super-admin
+`*` was the only one to reach it, so the checks stayed green and every other person was refused
+at run time. It is a warning: `check` does not fail on it. A grant counts by the entry of the set
+(`billingPermissions['invoice.issue']`), by the id (`'billing:invoice.issue'`) or by the wildcard
+of the context (`'billing:*'`); a grant to `Role.System`, written by `generate job`, counts too.
+The rule is silent under attributes, relationships or an authorizer of the project's own.
+
+**`generate command`, `query` and `file-upload` take `--grant <role>`.** With `--permission`, it
+writes the grant in `platform/auth/roles.ts` and adds the role to `platform/auth/role.ts` when it
+is new. It is refused with `--public`, and when the rights are not roles. Without it, a `next`
+step points at the roles to edit. `init --force` writes the roles from their template again, and
+the warning names the grants to give back. To move, run `ddd-ts-kit check --rule authz/granted`
+and grant each permission it lists to the roles that hold it, by the entry of its set, in
+`roles.ts`; a permission meant for administrators only is granted to `Role.Admin` by name. A
+context worker never passes `--grant` (`--local-only` refuses it): the conductor grants on the
+trunk.
+
 ## 0.19.0
 
 **`status` and `worker-scope` read every slices table.** `docs/architecture/slices.md` may plan

package/README.fr.md

@@ -1,5 +1,5 @@
 [English](README.md) · **Français**
-<!-- translation-of: README.md sha256:fa841c4ea81f2c5d -->
+<!-- translation-of: README.md sha256:18321b84fdc49821 -->
 
 # ddd-ts-kit
 
@@ -30,7 +30,7 @@ Aucune dépendance d'exécution. Node 22.12 ou ultérieur.
 npx ddd-ts-kit init
 npx ddd-ts-kit generate context billing --classification core --term "Invoice=A request for payment"
 npx ddd-ts-kit generate aggregate billing Invoice
-npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --term "Issue=To make an invoice final"
+npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --grant accountant --term "Issue=To make an invoice final"
 npx ddd-ts-kit generate route billing IssueInvoice --method POST --path /invoices
 npx ddd-ts-kit check
 ```
@@ -642,12 +642,12 @@ Next, in this order: the language of the context first, then the business decisi
 | `domain-service` | `<context> <Name>` | service, *spec* |
 | `state-machine` | `<context> <Aggregate> [--value <state>]... [--transition "<intention>:<from>[,<from>]...[><to>]"]...` | le vocabulaire `<Aggregate>Status` (créé depuis `--value`, deux états au moins, ou complété des valeurs qui lui manquent), `domain/state-machines/<aggregate>.state-machine.ts` (`<aggregate>Lifecycle` : chaque valeur un état, la première initiale, les transitions demandées, un `TODO(domain)` pour le refus de l'erreur du concept) et `test/unit/<aggregate>.state-machine.spec.ts` (chaque transition là où elle mène, un refus depuis un état qu'elle ne quitte pas) ; c'est à l'agrégat de l'utiliser |
 | `repository` | `<context> <Aggregate> [--tenant-scoped]` | le port `domain/repositories/<name>.repository.ts` (`abstract class <Name>Repository extends Repository<<Name>>`), l'adaptateur de l'ORM du projet (qui `implements` le port) avec son *mapper* et sa table (ou son modèle), un *fake*, une *spec* `repositoryContract` exécutée sur les deux, l'enregistrement |
-| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` sur `AuthorizedCommand` (simple `Command` quand elle est publique), `<use-case>.handler.ts` (il construit l'agrégat, le sauvegarde et répond : les événements partent avec la sauvegarde), une *spec* par le bus avec le refus d'un acteur à qui manque la permission, l'enregistrement avec `.requires(...)` ou `.public()` (et le *repository* s'il manque). Une commande générée répond `void` ou l'identifiant de son agrégat, si bien qu'aucun `<use-case>.result.ts` n'est écrit |
-| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--search]` | `<use-case>.query.ts` sur `AuthorizedQuery` (simple `Query` quand elle est publique), `<use-case>.result.ts`, `<use-case>.handler.ts`, le port de lecture `application/ports/<use-case>-reader.port.ts` (une classe abstraite), son adaptateur en mémoire, un *fake*, une *spec*, l'enregistrement sur le bus de requêtes. Avec `--search` (demande `--permission`) : une `PageRequest` du kernel dans la requête, l'élément, le tri et `Page<Item>` dans le fichier de résultat, un gestionnaire qui demande `Access.scope` et remet le périmètre au port de lecture, un lecteur en mémoire qui pagine par décalage ou par curseur |
+| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` sur `AuthorizedCommand` (simple `Command` quand elle est publique), `<use-case>.handler.ts` (il construit l'agrégat, le sauvegarde et répond : les événements partent avec la sauvegarde), une *spec* par le bus avec le refus d'un acteur à qui manque la permission, l'enregistrement avec `.requires(...)` ou `.public()` (et le *repository* s'il manque). Une commande générée répond `void` ou l'identifiant de son agrégat, si bien qu'aucun `<use-case>.result.ts` n'est écrit |
+| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--search]` | `<use-case>.query.ts` sur `AuthorizedQuery` (simple `Query` quand elle est publique), `<use-case>.result.ts`, `<use-case>.handler.ts`, le port de lecture `application/ports/<use-case>-reader.port.ts` (une classe abstraite), son adaptateur en mémoire, un *fake*, une *spec*, l'enregistrement sur le bus de requêtes. Avec `--search` (demande `--permission`) : une `PageRequest` du kernel dans la requête, l'élément, le tri et `Page<Item>` dans le fichier de résultat, un gestionnaire qui demande `Access.scope` et remet le périmètre au port de lecture, un lecteur en mémoire qui pagine par décalage ou par curseur |
 | `port` | `<context> <Name>` | `application/ports/<name>.port.ts`, une classe abstraite, et son *fake* |
 | `route` | `<context> <UseCaseName> --method <GET\|POST\|PUT\|PATCH\|DELETE> --path <p> [--command\|--query] [--group <Name>] [--mapper] [--serializer] [--cache public\|private\|no-store]` | sous `"stack.routes": "controllers"` : une classe contrôleur dans `presentation/http/<resource>/<use-case>/` (la ressource est le premier segment du chemin), qui dépend de `CommandBus` ou de `QueryBus`, derrière le groupe de routes de sa ressource, écrit avec elle quand il est nouveau (`<resource>.routes.ts` : préfixe, étiquette, `Authenticated`) ; un cas d'usage public ne se tient dans aucun groupe et dit `guards: [Public]` ; avec class-validator, une classe par fichier (`<use-case>.params.ts`, `.body.ts`, `.answer.ts`, `.accepted.ts`, `.line.ts`) ; `--mapper` et `--serializer` ajoutent un *mapper* de requête HTTP et un sérialiseur que reçoit le contrôleur ; une *spec* ; aucun enregistrement dans un projet déclaré, un contrôleur construit à la main dans `<context>.routes.ts` (le fichier de module en câblage manuel) dans un projet explicite. Sous `"functions"` : une fonction `defineRoute`, sa *spec*, son enregistrement dans `<context>.routes.ts`, et des classes `<use-case>-<role>.dto.ts` |
 | `controller` | les mêmes arguments que `route` | la classe contrôleur, quoi que dise `stack.routes` : pour un projet de routes en fonctions qui écrit sa prochaine route comme une classe. `--cache` écrit sa politique de cache : `private` (un `GET` d'un appelant, `max-age=0`, `must-revalidate`, `ETag` fort), `public` (un `GET` d'un cas d'usage public, `max-age` 1m, `s-maxage` 5m, étiqueté avec les ressources de son chemin), `no-store` ; refusé sur une écriture, et `public` derrière un groupe de routes |
-| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> \| --public) [--method POST\|PUT] [--group <Name>]` | un téléversement : un contrôleur qui déclare le fichier qu'il reçoit (sa taille et ses types de média dans le contrat, vérifiés au fil du flux), la commande qui le porte comme un `FileUpload`, mis en attente par le bus de commandes avant la transaction, le gestionnaire qui l'enregistre et le promeut avec la validation (commit), et leurs *specs*. Refusé sans `stack.storage` ou sans *stack* HTTP, avec le `init --force --storage local` à lancer |
+| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--method POST\|PUT] [--group <Name>]` | un téléversement : un contrôleur qui déclare le fichier qu'il reçoit (sa taille et ses types de média dans le contrat, vérifiés au fil du flux), la commande qui le porte comme un `FileUpload`, mis en attente par le bus de commandes avant la transaction, le gestionnaire qui l'enregistre et le promeut avec la validation (commit), et leurs *specs*. Refusé sans `stack.storage` ou sans *stack* HTTP, avec le `init --force --storage local` à lancer |
 | `route-group` (`group`) | `<context> <Name> [--prefix <path>] [--group <ParentName>] [--public \| --role <role>]` | `presentation/http/<name>.routes.ts` : une classe vide qui porte `@RouteGroup`, derrière `Authenticated` sauf si `--public` ou `--role` dit autre chose (`HasRole(Role.Admin)`, le rôle lu dans le vocabulaire de la plateforme, `<platformDir>/auth/role.ts`, qui le reçoit s'il ne le contient pas) ; avec `--group`, il affine ce groupe et en hérite |
 | `guard` | `<context> <Name>` | `presentation/http/guards/<name>.guard.ts` : une classe de garde déclarée à remplir, et sa *spec* |
 | `representation` | `<context> <UseCase> <xml\|csv\|media/type>[,...]` | ajoute `produces` au `@Controller` du cas d'usage, et `consumes: ['application/xml']` à celui qui reçoit un corps quand XML est demandé ; dit quand CSV a besoin d'une page ou d'une liste en flux, et quand `stack.representations` n'est pas `negotiated` |
@@ -739,7 +739,10 @@ Next, in this order: the language of the context first, then the business decisi
 - **Refus par défaut.** `command` et `query` sont refusés sans `--permission` ou `--public`. Une
   nouvelle permission rejoint `<context>.permissions.ts` ; ses mots sont vérifiés dans le
   glossaire comme tout autre nom. Avec `--authz rebac`, l'exigence nomme le contexte comme sa
-  ressource, un point de départ à remplacer par l'élément sur lequel porte le droit.
+  ressource, un point de départ à remplacer par l'élément sur lequel porte le droit. Avec
+  `--authz rbac`, `--grant <role>` accorde la permission au rôle dans `platform/auth/roles.ts`
+  (le rôle rejoint `role.ts` s'il est nouveau) ; sans lui, une étape `next` dit que
+  l'attribution reste à faire (`authz/granted`).
 - `route` remet `actorOf(context.principal)` à un cas d'usage protégé et pose `security` (le
   schéma de `--authn`, ou `false` pour un cas d'usage public). `integration-handler` porte
   `systemActor('<context>.<name>')` pour la commande qu'il construit ; derrière un *broker*, il
@@ -1291,6 +1294,7 @@ règle.
 | `config/valid` | un amont, une classification, une relation, un identifiant de règle, un mode de `guard` ou un `importExtension` inconnu ; un contexte absent du disque ou de la configuration ; une limite de `commit` qui n'est pas un entier positif |
 | `config/suppression-needs-reason` | une désactivation sans identifiant de règle ou sans raison (gardée comme alias à côté de `governance/recorded-deviation`, qui juge la raison) |
 | `authz/declared` | dans un fichier de module, `builder.command(X)` ou `builder.query(X)` sans `.requires(` ni `.public(` dans sa chaîne, sauf si la classe du message porte `@Requires` ou `@Public` de `@ddd-ts-kit/kernel/declarations` ; en câblage manuel ou nest, une classe de commande ou de requête absente de tous les `requires(X, ...)` et `publicUseCase(X)` du fichier de module et de `application/authorization/` ; un `defineRoute` sans `security` (le type de la route le refuse déjà, et une liste vide aussi : c'est le filet au niveau du texte pour une définition construite de façon lâche) ; dans le style déclaré, la classe exportée d'un fichier `*.command.ts` ou `*.query.ts` qui ne porte ni `@Requires` ni `@Public` |
+| `authz/granted` | avec `stack.authz` `rbac`, une permission du `definePermissions` d'un contexte que ni `platform/auth/roles.ts` ni `platform/auth/signed-in-grants.ts` n'accorde par son nom (par l'entrée de son ensemble, son identifiant ou `<contexte>:*`) ; le `*` du super-administrateur ne compte pas (un avertissement) |
 | `authz/in-application` | `presentation/` : un test sur les rôles, `isAdmin`, l'import d'un autorisateur ou de `Access` ; `infrastructure/` : `authorize(` ou `check(` sur un autorisateur ou un accès, `ForbiddenError` ; `domain/` : tout import de `@ddd-ts-kit/auth`, des types d'acteur du kernel (`Actor`, `ActorContext`, `Session`, `ExecutionContext`, les messages autorisés), une lecture de `.roles` ou `.permissions` sur un acteur. La glu de requête HTTP de `@ddd-ts-kit/auth` (`actorOf`, `sessionOf`, `resolveSession`, `SessionAuthenticator`) est libre dans `presentation/`. `presentation/` et `infrastructure/` : l'import de `Requires`, `Public` ou `Policy` depuis `@ddd-ts-kit/kernel/declarations`, ou des ports `Access` et `PolicyAccess` depuis `@ddd-ts-kit/auth` ; ils sont libres dans `application/` |
 | `authz/actor-explicit` | dans `domain/` et `application/` : `ActorContext`, `ExecutionScope` (comme type ou comme valeur : la classe est le jeton d'une liste de dépendances), `AsyncLocalStorageExecutionScope`, `ScopedActorContext`, `AsyncLocalStorage` ; `.current()` ou `.require()` sur un contexte d'acteur ou sur quelque chose nommé `scope`, `scopes` ou `...executionScope` ; un import de `stampCreation`, `stampUpdate` ou `tenantScopeOf` |
 | `authz/fields-by-schema` | sous `application/queries/` : `roles.includes(`, `.some(`, `.every(`, `.find(`, `.indexOf(`, une comparaison avec un `role`, `isAdmin` |

package/README.md

@@ -28,7 +28,7 @@ No runtime dependency. Node 22.12 or later.
 npx ddd-ts-kit init
 npx ddd-ts-kit generate context billing --classification core --term "Invoice=A request for payment"
 npx ddd-ts-kit generate aggregate billing Invoice
-npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --term "Issue=To make an invoice final"
+npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --grant accountant --term "Issue=To make an invoice final"
 npx ddd-ts-kit generate route billing IssueInvoice --method POST --path /invoices
 npx ddd-ts-kit check
 ```
@@ -622,12 +622,12 @@ Next, in this order: the language of the context first, then the business decisi
 | `domain-service` | `<context> <Name>` | service, spec |
 | `state-machine` | `<context> <Aggregate> [--value <state>]... [--transition "<intention>:<from>[,<from>]...[><to>]"]...` | the vocabulary `<Aggregate>Status` (created from `--value`, two states at least, or given the values it misses), `domain/state-machines/<aggregate>.state-machine.ts` (`<aggregate>Lifecycle`: every value a state, the first one initial, the transitions asked, a `TODO(domain)` for the refusal of the concept error) and `test/unit/<aggregate>.state-machine.spec.ts` (each transition where it leads, a refusal from a state it does not leave); the aggregate is left to use it |
 | `repository` | `<context> <Aggregate> [--tenant-scoped]` | the port `domain/repositories/<name>.repository.ts` (`abstract class <Name>Repository extends Repository<<Name>>`), the adapter of the project's ORM (`implements` the port) with its mapper and table (or model), a fake, one `repositoryContract` spec run on both, registration |
-| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` on `AuthorizedCommand` (plain `Command` when public), `<use-case>.handler.ts` (it builds the aggregate, saves it and answers: the events leave with the save), spec through the bus with the refusal of an actor who lacks the permission, registration with `.requires(...)` or `.public()` (and the repository when missing). A generated command answers `void` or the identifier of its aggregate, so no `<use-case>.result.ts` is written |
-| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--search]` | `<use-case>.query.ts` on `AuthorizedQuery` (plain `Query` when public), `<use-case>.result.ts`, `<use-case>.handler.ts`, the read port `application/ports/<use-case>-reader.port.ts` (an abstract class), its in-memory adapter, fake, spec, registration on the query bus. With `--search` (needs `--permission`): a kernel `PageRequest` in the query, the item, the sort and `Page<Item>` in the result file, a handler that asks `Access.scope` and hands the scope to the read port, an in-memory reader paging by offset or cursor |
+| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` on `AuthorizedCommand` (plain `Command` when public), `<use-case>.handler.ts` (it builds the aggregate, saves it and answers: the events leave with the save), spec through the bus with the refusal of an actor who lacks the permission, registration with `.requires(...)` or `.public()` (and the repository when missing). A generated command answers `void` or the identifier of its aggregate, so no `<use-case>.result.ts` is written |
+| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--search]` | `<use-case>.query.ts` on `AuthorizedQuery` (plain `Query` when public), `<use-case>.result.ts`, `<use-case>.handler.ts`, the read port `application/ports/<use-case>-reader.port.ts` (an abstract class), its in-memory adapter, fake, spec, registration on the query bus. With `--search` (needs `--permission`): a kernel `PageRequest` in the query, the item, the sort and `Page<Item>` in the result file, a handler that asks `Access.scope` and hands the scope to the read port, an in-memory reader paging by offset or cursor |
 | `port` | `<context> <Name>` | `application/ports/<name>.port.ts`, one abstract class, and its fake |
 | `route` | `<context> <UseCaseName> --method <GET\|POST\|PUT\|PATCH\|DELETE> --path <p> [--command\|--query] [--group <Name>] [--mapper] [--serializer] [--cache public\|private\|no-store]` | under `"stack.routes": "controllers"`: a controller class in `presentation/http/<resource>/<use-case>/` (the resource is the first segment of the path), depending on `CommandBus` or `QueryBus`, behind the route group of its resource, written with it when it is new (`<resource>.routes.ts`: prefix, tag, `Authenticated`); a public use case stands in no group and says `guards: [Public]`; with class-validator one class per file (`<use-case>.params.ts`, `.body.ts`, `.answer.ts`, `.accepted.ts`, `.line.ts`); `--mapper` and `--serializer` add a request mapper and a serializer the controller is given; a spec; no registration in a declared project, a controller built by hand in `<context>.routes.ts` (the module file with hand wiring) in an explicit one. Under `"functions"`: a `defineRoute` function, its spec, its registration in `<context>.routes.ts`, and `<use-case>-<role>.dto.ts` classes |
 | `controller` | the same arguments as `route` | the controller class, whatever `stack.routes` says: for a project of function routes that writes its next route as a class. `--cache` writes its cache policy: `private` (a `GET` of a caller, `max-age=0`, `must-revalidate`, strong `ETag`), `public` (a `GET` of a public use case, `max-age` 1m, `s-maxage` 5m, tagged with the resources of its path), `no-store`; refused on a write, and `public` behind a route group |
-| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> \| --public) [--method POST\|PUT] [--group <Name>]` | an upload: a controller that declares the file it receives (its size and media types in the contract, checked as it streams), the command that carries it as a `FileUpload`, staged by the command bus before the transaction, the handler that records it and promotes it with the commit, and their specs. Refused without `stack.storage` or without an HTTP stack, with the `init --force --storage local` to run |
+| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--method POST\|PUT] [--group <Name>]` | an upload: a controller that declares the file it receives (its size and media types in the contract, checked as it streams), the command that carries it as a `FileUpload`, staged by the command bus before the transaction, the handler that records it and promotes it with the commit, and their specs. Refused without `stack.storage` or without an HTTP stack, with the `init --force --storage local` to run |
 | `route-group` (`group`) | `<context> <Name> [--prefix <path>] [--group <ParentName>] [--public \| --role <role>]` | `presentation/http/<name>.routes.ts`: an empty class carrying `@RouteGroup`, behind `Authenticated` unless `--public` or `--role` says otherwise (`HasRole(Role.Admin)`, the role read from the vocabulary of the platform, `<platformDir>/auth/role.ts`, which gets it when it does not hold it); with `--group` it refines that group and inherits from it |
 | `guard` | `<context> <Name>` | `presentation/http/guards/<name>.guard.ts`: a declared guard class to fill, and its spec |
 | `representation` | `<context> <UseCase> <xml\|csv\|media/type>[,...]` | adds `produces` to the `@Controller` of the use case, and `consumes: ['application/xml']` to one that receives a body when XML is asked; says when CSV needs a page or a streamed list, and when `stack.representations` is not `negotiated` |
@@ -713,7 +713,9 @@ Next, in this order: the language of the context first, then the business decisi
 - **Deny by default.** `command` and `query` are refused without `--permission` or `--public`. A new
   permission joins `<context>.permissions.ts`; its words are checked against the glossary like any
   other name. With `--authz rebac` the requirement names the context as its resource, a starting
-  point to replace by the element the right bears on.
+  point to replace by the element the right bears on. With `--authz rbac`, `--grant <role>` gives
+  the permission to the role in `platform/auth/roles.ts` (the role joins `role.ts` when it is
+  new); without it, a `next` step says the grant is left to do (`authz/granted`).
 - `route` hands `actorOf(context.principal)` to a protected use case and sets `security` (the scheme
   of `--authn`, or `false` for a public one). `integration-handler` carries `systemActor('<context>.<name>')`
   for the command it builds; behind a broker it listens on the subscriber of its context
@@ -1234,6 +1236,7 @@ const due = handler.isDueNow(new Reminder(new Date('2026-03-01T09:00:00Z'))); //
 | `config/valid` | unknown upstream, classification, relationship, rule id, `guard` mode or `importExtension`; a context missing on disk or in the config; a `commit` limit that is not a positive integer |
 | `config/suppression-needs-reason` | a suppression without a rule id or a reason (kept as an alias next to `governance/recorded-deviation`, which judges the reason) |
 | `authz/declared` | in a module file, `builder.command(X)` or `builder.query(X)` without `.requires(` or `.public(` in its chain, unless the message class carries `@Requires` or `@Public` of `@ddd-ts-kit/kernel/declarations`; with manual or nest wiring, a command or query class absent from every `requires(X, ...)` and `publicUseCase(X)` of the module file and of `application/authorization/`; a `defineRoute` without `security` (the route type refuses it already, and an empty list too: this is the text-level net for a definition built loosely); in the declared style, the exported class of a `*.command.ts` or `*.query.ts` file carrying neither `@Requires` nor `@Public` |
+| `authz/granted` | with `stack.authz` `rbac`, a permission of a context's `definePermissions` that neither `platform/auth/roles.ts` nor `platform/auth/signed-in-grants.ts` grants by name (by the entry of its set, its id or `<context>:*`); the super-admin `*` does not count (a warning) |
 | `authz/in-application` | `presentation/`: a test on roles, `isAdmin`, the import of an authorizer or of `Access`; `infrastructure/`: `authorize(` or `check(` on an authorizer or access, `ForbiddenError`; `domain/`: any import of `@ddd-ts-kit/auth`, of the actor types of the kernel (`Actor`, `ActorContext`, `Session`, `ExecutionContext`, the authorized messages), a read of `.roles` or `.permissions` on an actor. The request glue of `@ddd-ts-kit/auth` (`actorOf`, `sessionOf`, `resolveSession`, `SessionAuthenticator`) is free in `presentation/`. `presentation/` and `infrastructure/`: the import of `Requires`, `Public` or `Policy` from `@ddd-ts-kit/kernel/declarations`, or of the ports `Access` and `PolicyAccess` from `@ddd-ts-kit/auth`; they are free in `application/` |
 | `authz/actor-explicit` | in `domain/` and `application/`: `ActorContext`, `ExecutionScope` (as a type or as a value: the class is the token of a dependency list), `AsyncLocalStorageExecutionScope`, `ScopedActorContext`, `AsyncLocalStorage`; `.current()` or `.require()` on an actor context or on something named `scope`, `scopes` or `...executionScope`; an import of `stampCreation`, `stampUpdate` or `tenantScopeOf` |
 | `authz/fields-by-schema` | under `application/queries/`: `roles.includes(`, `.some(`, `.every(`, `.find(`, `.indexOf(`, a comparison with a `role`, `isAdmin` |

package/dist/check/authz/is-granted.d.ts

@@ -0,0 +1,8 @@
+import type { Scan } from '../scan/scan.js';
+import type { PermissionSet } from './permission-sets.js';
+/**
+ * Whether code grants a permission by name: by the entry of its set, `billingPermissions['invoice.issue']`;
+ * by its id, `'billing:invoice.issue'`; or by the wildcard of its context, `'billing:*'`. A comment grants nothing.
+ */
+export declare function isGranted({ code, strings }: Scan, { set, context }: Omit<PermissionSet, 'keys'>, key: string): boolean;
+//# sourceMappingURL=is-granted.d.ts.map

package/dist/check/authz/is-granted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-granted.d.ts","sourceRoot":"","sources":["../../../src/check/authz/is-granted.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EACvB,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAC7C,GAAG,EAAE,MAAM,GACV,OAAO,CAST"}

package/dist/check/authz/is-granted.js

@@ -0,0 +1,11 @@
+import { escapeRegExp } from '../text/escape-reg-exp.js';
+/**
+ * Whether code grants a permission by name: by the entry of its set, `billingPermissions['invoice.issue']`;
+ * by its id, `'billing:invoice.issue'`; or by the wildcard of its context, `'billing:*'`. A comment grants nothing.
+ */
+export function isGranted({ code, strings }, { set, context }, key) {
+    const ids = new Set([`${context}:${key}`, `${context}:*`]);
+    const entries = [...code.matchAll(new RegExp(`(?<![\\w$.])${escapeRegExp(set)}\\s*\\[\\s*`, 'g'))];
+    return (entries.some((entry) => strings.some(({ start, value }) => start === entry.index + entry[0].length && value === key)) || strings.some(({ value }) => ids.has(value)));
+}
+//# sourceMappingURL=is-granted.js.map

package/dist/check/authz/is-granted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-granted.js","sourceRoot":"","sources":["../../../src/check/authz/is-granted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,EAAE,IAAI,EAAE,OAAO,EAAQ,EACvB,EAAE,GAAG,EAAE,OAAO,EAA+B,EAC7C,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,eAAe,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEnG,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,CAC7F,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/dist/check/authz/permission-sets.d.ts

@@ -0,0 +1,13 @@
+import type { SourceFile } from '../model/source-file.js';
+import type { StringRecord } from '../scan/string-record.js';
+/** `export const billingPermissions = definePermissions('billing', { 'invoice.issue': .. })`, as the checker reads it. */
+export interface PermissionSet {
+    /** The name code reads the set by: `billingPermissions`. */
+    readonly set: string;
+    readonly context: string;
+    /** The key of each permission, where it is written. */
+    readonly keys: readonly StringRecord[];
+}
+/** The permission sets a file declares, each with the keys of its first level. */
+export declare function permissionSets(file: SourceFile): PermissionSet[];
+//# sourceMappingURL=permission-sets.d.ts.map

package/dist/check/authz/permission-sets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-sets.d.ts","sourceRoot":"","sources":["../../../src/check/authz/permission-sets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAM7D,0HAA0H;AAC1H,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACxC;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,EAAE,CAqBhE"}

package/dist/check/authz/permission-sets.js

@@ -0,0 +1,19 @@
+import { depthAt } from '../text/depth-at.js';
+import { matchingBracket } from '../text/matching-bracket.js';
+const PERMISSION_SET = /export\s+const\s+([a-z][\w$]*)\s*=\s*definePermissions\(\s*/g;
+/** The permission sets a file declares, each with the keys of its first level. */
+export function permissionSets(file) {
+    const { code, strings } = file.scan;
+    return [...code.matchAll(PERMISSION_SET)].flatMap((found) => {
+        const at = found.index + found[0].length;
+        const context = strings.find(({ start }) => start === at)?.value;
+        const open = code.indexOf('{', at);
+        if (context === undefined || open === -1) {
+            return [];
+        }
+        const close = matchingBracket(code, open);
+        const keys = strings.filter(({ start, end }) => start > open && end < close && /^\s*:/.test(code.slice(end)) && depthAt(code, open, start) === 1);
+        return [{ set: found[1] ?? '', context, keys }];
+    });
+}
+//# sourceMappingURL=permission-sets.js.map

package/dist/check/authz/permission-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-sets.js","sourceRoot":"","sources":["../../../src/check/authz/permission-sets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,cAAc,GAAG,8DAA8D,CAAC;AAWtF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAEpC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEnC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CACzB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CACjB,KAAK,GAAG,IAAI,IAAI,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CACnG,CAAC;QAEF,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/check/catalogue/architecture-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"architecture-rules.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoF7C,gHAAgH;AAChH,eAAO,MAAM,kBAAkB,EAAE,SAAS,IAAI,EAmF7C,CAAC"}
+{"version":3,"file":"architecture-rules.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAqF7C,gHAAgH;AAChH,eAAO,MAAM,kBAAkB,EAAE,SAAS,IAAI,EAoF7C,CAAC"}

package/dist/check/catalogue/architecture-rules.js

@@ -2,6 +2,7 @@ import { aspectsOutsideIn } from '../rules/aspects-outside-in.js';
 import { authzActorExplicit } from '../rules/authz-actor-explicit.js';
 import { authzFieldsBySchema } from '../rules/authz-fields-by-schema.js';
 import { authzDeclared } from '../rules/authz-declared.js';
+import { authzGranted } from '../rules/authz-granted.js';
 import { authzInApplication } from '../rules/authz-in-application.js';
 import { authzPolicyAsked } from '../rules/authz-policy-asked.js';
 import { cleanBlankLines } from '../rules/clean-blank-lines.js';
@@ -138,6 +139,7 @@ export const ARCHITECTURE_RULES = [
     authzActorExplicit,
     authzFieldsBySchema,
     authzPolicyAsked,
+    authzGranted,
     aspectsOutsideIn,
     tracingPlatformOnly,
     tenancyScopedStatement,

package/dist/check/catalogue/architecture-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"architecture-rules.js","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sDAAsD,CAAC;AAC3G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,kCAAkC,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gHAAgH;AAChH,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,iBAAiB;IACjB,sBAAsB;IACtB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,2BAA2B;IAC3B,mCAAmC;IACnC,cAAc;IACd,UAAU;IACV,cAAc;IACd,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,gCAAgC;IAChC,WAAW;IACX,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;IACnB,aAAa;IACb,iBAAiB;IACjB,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,4BAA4B;IAC5B,qCAAqC;IACrC,yBAAyB;IACzB,sBAAsB;IACtB,kCAAkC;IAClC,mCAAmC;IACnC,6BAA6B;IAC7B,kBAAkB;IAClB,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;IACxB,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,oBAAoB;IACpB,yBAAyB;IACzB,gBAAgB;IAChB,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;CACtB,CAAC"}
+{"version":3,"file":"architecture-rules.js","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sDAAsD,CAAC;AAC3G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,kCAAkC,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gHAAgH;AAChH,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,iBAAiB;IACjB,sBAAsB;IACtB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,2BAA2B;IAC3B,mCAAmC;IACnC,cAAc;IACd,UAAU;IACV,cAAc;IACd,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,gCAAgC;IAChC,WAAW;IACX,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;IACnB,aAAa;IACb,iBAAiB;IACjB,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,4BAA4B;IAC5B,qCAAqC;IACrC,yBAAyB;IACzB,sBAAsB;IACtB,kCAAkC;IAClC,mCAAmC;IACnC,6BAA6B;IAC7B,kBAAkB;IAClB,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;IACxB,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,oBAAoB;IACpB,yBAAyB;IACzB,gBAAgB;IAChB,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;CACtB,CAAC"}

package/dist/check/catalogue/default-severities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-severities.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAQjE,CAAC"}
+{"version":3,"file":"default-severities.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CASjE,CAAC"}

package/dist/check/catalogue/default-severities.js

@@ -1,5 +1,6 @@
 /** Rules that advise instead of blocking unless the config says otherwise (ARCHITECTURE.md section 3). */
 export const DEFAULT_SEVERITIES = {
+    'authz/granted': 'warn',
     'test/no-mocks': 'warn',
     'test/builder-required': 'warn',
     'clean/function-size': 'warn',

package/dist/check/catalogue/default-severities.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-severities.js","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAEA,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,eAAe,EAAE,MAAM;IACvB,uBAAuB,EAAE,MAAM;IAC/B,qBAAqB,EAAE,MAAM;IAC7B,wBAAwB,EAAE,MAAM;IAChC,wBAAwB,EAAE,MAAM;IAChC,sCAAsC,EAAE,MAAM;IAC9C,gCAAgC,EAAE,MAAM;CACzC,CAAC"}
+{"version":3,"file":"default-severities.js","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAEA,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,eAAe,EAAE,MAAM;IACvB,eAAe,EAAE,MAAM;IACvB,uBAAuB,EAAE,MAAM;IAC/B,qBAAqB,EAAE,MAAM;IAC7B,wBAAwB,EAAE,MAAM;IAChC,wBAAwB,EAAE,MAAM;IAChC,sCAAsC,EAAE,MAAM;IAC9C,gCAAgC,EAAE,MAAM;CACzC,CAAC"}

package/dist/check/explain/authz-docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-docs.d.ts","sourceRoot":"","sources":["../../../src/check/explain/authz-docs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqExD,CAAC"}
+{"version":3,"file":"authz-docs.d.ts","sourceRoot":"","sources":["../../../src/check/explain/authz-docs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoFxD,CAAC"}

package/dist/check/explain/authz-docs.js

@@ -27,6 +27,21 @@ await this.access.authorize(command.actor, billingPermissions['invoice.void'], i
 // application/authorization/only-issuer-voids.policy.ts
 @Policy(billingPermissions['invoice.void'], { name: 'billing.only-issuer-voids' })
 export class OnlyIssuerVoidsPolicy {}`,
+    },
+    'authz/granted': {
+        why: "In a project whose rights are roles (stack.authz rbac), a permission does two things: a use case requires it, and a role holds it. The generator declares the first; the grant lives in the roles of the platform. The super-admin holds the wildcard `*`, so a permission no role names is reachable by administrators only, the checks stay green and the people the use case was written for are refused at run time. It fails closed, which is safe, but silently. Judged: every key of every `definePermissions` set of a context is named in `<platformDir>/auth/roles.ts` or in what every signed-in person holds (`signed-in-grants.ts`, which a context preset writes), by the entry of its set (`billingPermissions['invoice.issue']`), by its id (`'billing:invoice.issue'`) or by the wildcard of its context (`'billing:*'`); the bare `*` does not count, and a grant to `Role.System` does. A permission meant for administrators only is granted to `Role.Admin` by name, so that the intent is read in review. Silent when the rights are attributes, relationships or an authorizer of the project, and when the platform has no roles file. A warning: it fails closed.",
+        bad: `// contexts/billing/application/authorization/billing.permissions.ts
+export const billingPermissions = definePermissions('billing', {
+  'invoice.void': { description: 'Void invoice' },
+});
+// platform/auth/roles.ts
+export const roles = { [Role.Admin]: ['*'] };`,
+        good: `// platform/auth/roles.ts
+export const roles = {
+  [Role.Admin]: ['*'],
+  [Role.Accountant]: [billingPermissions['invoice.void']],
+};
+// or, when generating the use case: --permission invoice.void --grant accountant`,
     },
     'authz/policy-asked': {
         why: 'The bus checks the permission of a use case before its handler runs, with the identifier of the element at most: it cannot read the element. A policy is the part of the right that needs the element (only the issuer, not after closing), and it is evaluated only when the handler asks Access once the element is loaded. A handler that forgets to ask leaves the policy declared, tested and never applied, and nothing at run time says so. Judged: for every permission refined by a policy (@Policy or definePolicy in application/authorization/), the handlers in the folder of each command or query that requires it (@Requires, .requires(...) or requires(X, ...)) call authorize, decide or decideOn and name that permission in their code. The TODO(domain) the generator leaves in such a handler, naming the permission, is accepted: `ddd-ts-kit todo` lists it, and until it is done the authorization module refuses the result of the handler at run time (PolicyNotAskedError).',

package/dist/check/explain/authz-docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-docs.js","sourceRoot":"","sources":["../../../src/check/explain/authz-docs.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,UAAU,GAAsC;IAC3D,gBAAgB,EAAE;QAChB,GAAG,EAAE,mvBAAmvB;QACxvB,GAAG,EAAE;;;mEAG0D;QAC/D,IAAI,EAAE;;;;;mEAKyD;KAChE;IACD,sBAAsB,EAAE;QACtB,GAAG,EAAE,q0BAAq0B;QAC10B,GAAG,EAAE;;;;;4DAKmD;QACxD,IAAI,EAAE;;;;;;sCAM4B;KACnC;IACD,oBAAoB,EAAE;QACpB,GAAG,EAAE,08BAA08B;QAC/8B,GAAG,EAAE;;;;;gCAKuB;QAC5B,IAAI,EAAE;;;gCAGsB;KAC7B;IACD,sBAAsB,EAAE;QACtB,GAAG,EAAE,ykBAAykB;QAC9kB,GAAG,EAAE;;;;qDAI4C;QACjD,IAAI,EAAE;;;;;2GAKiG;KACxG;IACD,wBAAwB,EAAE;QACxB,GAAG,EAAE,i1BAAi1B;QACt1B,GAAG,EAAE;;+FAEsF;QAC3F,IAAI,EAAE;;;;;IAKN;KACD;CACF,CAAC"}
+{"version":3,"file":"authz-docs.js","sourceRoot":"","sources":["../../../src/check/explain/authz-docs.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,UAAU,GAAsC;IAC3D,gBAAgB,EAAE;QAChB,GAAG,EAAE,mvBAAmvB;QACxvB,GAAG,EAAE;;;mEAG0D;QAC/D,IAAI,EAAE;;;;;mEAKyD;KAChE;IACD,sBAAsB,EAAE;QACtB,GAAG,EAAE,q0BAAq0B;QAC10B,GAAG,EAAE;;;;;4DAKmD;QACxD,IAAI,EAAE;;;;;;sCAM4B;KACnC;IACD,eAAe,EAAE;QACf,GAAG,EAAE,4nCAA4nC;QACjoC,GAAG,EAAE;;;;;8CAKqC;QAC1C,IAAI,EAAE;;;;;kFAKwE;KAC/E;IACD,oBAAoB,EAAE;QACpB,GAAG,EAAE,08BAA08B;QAC/8B,GAAG,EAAE;;;;;gCAKuB;QAC5B,IAAI,EAAE;;;gCAGsB;KAC7B;IACD,sBAAsB,EAAE;QACtB,GAAG,EAAE,ykBAAykB;QAC9kB,GAAG,EAAE;;;;qDAI4C;QACjD,IAAI,EAAE;;;;;2GAKiG;KACxG;IACD,wBAAwB,EAAE;QACxB,GAAG,EAAE,i1BAAi1B;QACt1B,GAAG,EAAE;;+FAEsF;QAC3F,IAAI,EAAE;;;;;IAKN;KACD;CACF,CAAC"}

package/dist/check/fixtures/authz-granted-fixtures.d.ts

@@ -0,0 +1,3 @@
+import type { Fixture } from './fixture.js';
+export declare const AUTHZ_GRANTED_FIXTURES: readonly Fixture[];
+//# sourceMappingURL=authz-granted-fixtures.d.ts.map

package/dist/check/fixtures/authz-granted-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-granted-fixtures.d.ts","sourceRoot":"","sources":["../../../src/check/fixtures/authz-granted-fixtures.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA+B5C,eAAO,MAAM,sBAAsB,EAAE,SAAS,OAAO,EAuDpD,CAAC"}

package/dist/check/fixtures/authz-granted-fixtures.js

@@ -0,0 +1,71 @@
+import { CONFIG_FILE } from '../../config/index.js';
+import { config } from './config.js';
+import { PATHS } from './paths.js';
+import { project } from './project.js';
+import { source } from './source.js';
+const { BILLING } = PATHS;
+const PERMISSIONS = `${BILLING}/application/authorization/billing.permissions.ts`;
+const ROLES = 'src/platform/auth/roles.ts';
+const ROLE = 'src/platform/auth/role.ts';
+const SIGNED_IN = 'src/platform/auth/signed-in-grants.ts';
+const DECLARED = source("import { definePermissions } from '@ddd-ts-kit/auth';", '', "export const billingPermissions = definePermissions('billing', {", "  'invoice.issue': { description: 'Issue invoice' },", '});');
+const ROLE_VOCABULARY = source('export const Role = {', "  Admin: 'admin',", "  Accountant: 'accountant',", '} as const;', '', 'export type Role = (typeof Role)[keyof typeof Role];');
+const rule = 'authz/granted';
+export const AUTHZ_GRANTED_FIXTURES = [
+    {
+        ruleId: rule,
+        name: 'a permission granted to a role by the entry of its set',
+        expect: 'pass',
+        files: granting("[Role.Accountant]: [billingPermissions['invoice.issue']],"),
+    },
+    {
+        ruleId: rule,
+        name: 'a permission granted through the wildcard of its context',
+        expect: 'pass',
+        files: granting("[Role.Accountant]: ['billing:*'],"),
+    },
+    {
+        ruleId: rule,
+        name: 'a permission granted by its id',
+        expect: 'pass',
+        files: granting("[Role.Accountant]: ['billing:invoice.issue'],"),
+    },
+    {
+        ruleId: rule,
+        name: 'a permission every signed-in person holds through the wildcard of its context',
+        expect: 'pass',
+        files: {
+            ...granting(),
+            [SIGNED_IN]: source('export const signedInGrants: readonly string[] = [', '  // ddd-ts-kit:signed-in-grants', "  'billing:*',", '  // /ddd-ts-kit:signed-in-grants', '];'),
+        },
+    },
+    {
+        ruleId: rule,
+        name: 'a permission no role names, in a project whose rights are attributes',
+        expect: 'pass',
+        files: {
+            ...granting(),
+            [CONFIG_FILE]: config({ stack: { authz: 'abac' } }),
+        },
+    },
+    {
+        ruleId: rule,
+        name: 'a permission only the super-admin wildcard reaches',
+        expect: { file: PERMISSIONS },
+        files: granting(),
+    },
+    {
+        ruleId: rule,
+        name: 'a permission granted in a comment only',
+        expect: { file: PERMISSIONS },
+        files: granting("// [Role.Accountant]: [billingPermissions['invoice.issue']],"),
+    },
+];
+function granting(...grants) {
+    return project({ [PERMISSIONS]: DECLARED, [ROLE]: ROLE_VOCABULARY, [ROLES]: roles(...grants) });
+}
+/** A roles file of the platform whose grants are the lines given, after the super-admin. */
+function roles(...grants) {
+    return source("import type { Grant } from '@ddd-ts-kit/auth';", "import { billingPermissions } from '@/contexts/billing/application/authorization/billing.permissions.js';", "import { Role } from '@/platform/auth/role.js';", '', 'export const roles: Readonly<Record<string, readonly Grant[]>> = {', "  [Role.Admin]: ['*'],", ...grants.map((grant) => `  ${grant}`), '};', '', 'export const issuing = billingPermissions;');
+}
+//# sourceMappingURL=authz-granted-fixtures.js.map

package/dist/check/fixtures/authz-granted-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-granted-fixtures.js","sourceRoot":"","sources":["../../../src/check/fixtures/authz-granted-fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;AAC1B,MAAM,WAAW,GAAG,GAAG,OAAO,mDAAmD,CAAC;AAClF,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAC3C,MAAM,IAAI,GAAG,2BAA2B,CAAC;AACzC,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D,MAAM,QAAQ,GAAG,MAAM,CACrB,uDAAuD,EACvD,EAAE,EACF,kEAAkE,EAClE,sDAAsD,EACtD,KAAK,CACN,CAAC;AAEF,MAAM,eAAe,GAAG,MAAM,CAC5B,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,aAAa,EACb,EAAE,EACF,sDAAsD,CACvD,CAAC;AAEF,MAAM,IAAI,GAAG,eAAe,CAAC;AAE7B,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,wDAAwD;QAC9D,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,QAAQ,CAAC,2DAA2D,CAAC;KAC7E;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,0DAA0D;QAChE,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,QAAQ,CAAC,mCAAmC,CAAC;KACrD;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,QAAQ,CAAC,+CAA+C,CAAC;KACjE;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,+EAA+E;QACrF,MAAM,EAAE,MAAM;QACd,KAAK,EAAE;YACL,GAAG,QAAQ,EAAE;YACb,CAAC,SAAS,CAAC,EAAE,MAAM,CACjB,oDAAoD,EACpD,kCAAkC,EAClC,gBAAgB,EAChB,mCAAmC,EACnC,IAAI,CACL;SACF;KACF;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,sEAAsE;QAC5E,MAAM,EAAE,MAAM;QACd,KAAK,EAAE;YACL,GAAG,QAAQ,EAAE;YACb,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;SACpD;KACF;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,oDAAoD;QAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC7B,KAAK,EAAE,QAAQ,EAAE;KAClB;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC7B,KAAK,EAAE,QAAQ,CAAC,8DAA8D,CAAC;KAChF;CACF,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAG,MAAyB;IAC5C,OAAO,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,4FAA4F;AAC5F,SAAS,KAAK,CAAC,GAAG,MAAyB;IACzC,OAAO,MAAM,CACX,gDAAgD,EAChD,2GAA2G,EAC3G,iDAAiD,EACjD,EAAE,EACF,oEAAoE,EACpE,wBAAwB,EACxB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EACtC,IAAI,EACJ,EAAE,EACF,4CAA4C,CAC7C,CAAC;AACJ,CAAC"}

package/dist/check/fixtures/fixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fixtures.d.ts","sourceRoot":"","sources":["../../../src/check/fixtures/fixtures.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EA0CtC,CAAC"}
+{"version":3,"file":"fixtures.d.ts","sourceRoot":"","sources":["../../../src/check/fixtures/fixtures.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,EA2CtC,CAAC"}

package/dist/check/fixtures/fixtures.js

@@ -2,6 +2,7 @@ import { ALIAS_DECLARED_FIXTURES } from './alias-declared-fixtures.js';
 import { BUSINESS_NAME_FIXTURES } from './business-name-fixtures.js';
 import { AUTHZ_DECLARED_FIXTURES } from './authz-declared-fixtures.js';
 import { AUTHZ_FIXTURES } from './authz-fixtures.js';
+import { AUTHZ_GRANTED_FIXTURES } from './authz-granted-fixtures.js';
 import { AUTHZ_POLICY_FIXTURES } from './authz-policy-fixtures.js';
 import { CLEAN_FIXTURES } from './clean-fixtures.js';
 import { COMPOSITION_FIXTURES } from './composition-fixtures.js';
@@ -49,6 +50,7 @@ export const FIXTURES = [
     ...AUTHZ_DECLARED_FIXTURES,
     ...AUTHZ_FIXTURES,
     ...AUTHZ_POLICY_FIXTURES,
+    ...AUTHZ_GRANTED_FIXTURES,
     ...CLEAN_FIXTURES,
     ...COMPOSITION_FIXTURES,
     ...CONFIG_FIXTURES,

package/dist/check/fixtures/fixtures.js.map

@@ -1 +1 @@
-{"version":3,"file":"fixtures.js","sourceRoot":"","sources":["../../../src/check/fixtures/fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAG7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAuB;IAC1C,GAAG,uBAAuB;IAC1B,GAAG,uBAAuB;IAC1B,GAAG,cAAc;IACjB,GAAG,qBAAqB;IACxB,GAAG,cAAc;IACjB,GAAG,oBAAoB;IACvB,GAAG,eAAe;IAClB,GAAG,8BAA8B;IACjC,GAAG,iBAAiB;IACpB,GAAG,gBAAgB;IACnB,GAAG,iBAAiB;IACpB,GAAG,qBAAqB;IACxB,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,eAAe;IAClB,GAAG,uBAAuB;IAC1B,GAAG,eAAe;IAClB,GAAG,kBAAkB;IACrB,GAAG,oBAAoB;IACvB,GAAG,cAAc;IACjB,GAAG,mBAAmB;IACtB,GAAG,gBAAgB;IACnB,GAAG,iBAAiB;IACpB,GAAG,mBAAmB;IACtB,GAAG,cAAc;IACjB,GAAG,eAAe;IAClB,GAAG,kBAAkB;IACrB,GAAG,eAAe;IAClB,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,oBAAoB;IACvB,GAAG,cAAc;IACjB,GAAG,eAAe;IAClB,GAAG,mBAAmB;IACtB,GAAG,iBAAiB;IACpB,GAAG,gBAAgB;IACnB,GAAG,aAAa;IAChB,GAAG,gBAAgB;IACnB,GAAG,aAAa;IAChB,GAAG,0BAA0B;IAC7B,GAAG,uBAAuB;CAC3B,CAAC"}
+{"version":3,"file":"fixtures.js","sourceRoot":"","sources":["../../../src/check/fixtures/fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAG7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAuB;IAC1C,GAAG,uBAAuB;IAC1B,GAAG,uBAAuB;IAC1B,GAAG,cAAc;IACjB,GAAG,qBAAqB;IACxB,GAAG,sBAAsB;IACzB,GAAG,cAAc;IACjB,GAAG,oBAAoB;IACvB,GAAG,eAAe;IAClB,GAAG,8BAA8B;IACjC,GAAG,iBAAiB;IACpB,GAAG,gBAAgB;IACnB,GAAG,iBAAiB;IACpB,GAAG,qBAAqB;IACxB,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,eAAe;IAClB,GAAG,uBAAuB;IAC1B,GAAG,eAAe;IAClB,GAAG,kBAAkB;IACrB,GAAG,oBAAoB;IACvB,GAAG,cAAc;IACjB,GAAG,mBAAmB;IACtB,GAAG,gBAAgB;IACnB,GAAG,iBAAiB;IACpB,GAAG,mBAAmB;IACtB,GAAG,cAAc;IACjB,GAAG,eAAe;IAClB,GAAG,kBAAkB;IACrB,GAAG,eAAe;IAClB,GAAG,sBAAsB;IACzB,GAAG,eAAe;IAClB,GAAG,oBAAoB;IACvB,GAAG,cAAc;IACjB,GAAG,eAAe;IAClB,GAAG,mBAAmB;IACtB,GAAG,iBAAiB;IACpB,GAAG,gBAAgB;IACnB,GAAG,aAAa;IAChB,GAAG,gBAAgB;IACnB,GAAG,aAAa;IAChB,GAAG,0BAA0B;IAC7B,GAAG,uBAAuB;CAC3B,CAAC"}

package/dist/check/fixtures/vocabulary-fixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vocabulary-fixtures.d.ts","sourceRoot":"","sources":["../../../src/check/fixtures/vocabulary-fixtures.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAyC5C,eAAO,MAAM,mBAAmB,EAAE,SAAS,OAAO,EAwFjD,CAAC"}
+{"version":3,"file":"vocabulary-fixtures.d.ts","sourceRoot":"","sources":["../../../src/check/fixtures/vocabulary-fixtures.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAyC5C,eAAO,MAAM,mBAAmB,EAAE,SAAS,OAAO,EA4FjD,CAAC"}

package/dist/check/fixtures/vocabulary-fixtures.js

@@ -87,6 +87,8 @@ export const VOCABULARY_FIXTURES = [
         ruleId: rule,
         name: 'a role of the platform written in a file of the platform',
         expect: { file: GRANTS },
+        // This roles file grants nothing by name: the permission of billing is reached by no role.
+        also: ['authz/granted'],
         files: named({ [GRANTS]: raw('ISSUER', 'admin') }),
     },
     {
@@ -111,6 +113,8 @@ export const VOCABULARY_FIXTURES = [
         ruleId: rule,
         name: 'a value of a vocabulary of the shared kernel, in the platform',
         expect: { file: GRANTS },
+        // This roles file grants nothing by name: the permission of billing is reached by no role.
+        also: ['authz/granted'],
         files: named({ [GRANTS]: raw('PRICED_IN', 'EUR') }),
     },
 ];

package/dist/check/fixtures/vocabulary-fixtures.js.map

@@ -1 +1 @@
-{"version":3,"file":"vocabulary-fixtures.js","sourceRoot":"","sources":["../../../src/check/fixtures/vocabulary-fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;AACjF,MAAM,MAAM,GAAG,GAAG,OAAO,mDAAmD,CAAC;AAC7E,MAAM,WAAW,GAAG,GAAG,OAAO,mDAAmD,CAAC;AAClF,MAAM,MAAM,GAAG,4BAA4B,CAAC;AAC5C,MAAM,IAAI,GAAG,2BAA2B,CAAC;AACzC,MAAM,OAAO,GAAG,GAAG,OAAO,qCAAqC,CAAC;AAChE,MAAM,eAAe,GAAG,GAAG,OAAO,qCAAqC,CAAC;AACxE,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAE5D,MAAM,KAAK,GAAG;IACZ,CAAC,GAAG,OAAO,oCAAoC,CAAC,EAAE,kEAAkE;IACpH,CAAC,GAAG,OAAO,oCAAoC,CAAC,EAAE,iEAAiE;CACpH,CAAC;AAEF,MAAM,QAAQ,GAAG;IACf,CAAC,MAAM,CAAC,EACN,0KAA0K;IAC5K,CAAC,WAAW,CAAC,EACX,2LAA2L;IAC7L,CAAC,IAAI,CAAC,EACJ,iHAAiH;IACnH,CAAC,QAAQ,CAAC,EACR,uHAAuH;CAC1H,CAAC;AAEF,oHAAoH;AACpH,MAAM,UAAU,GACd,8UAA8U,CAAC;AAEjV,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE,CACzC,mPAAmP,MAAM,aAAa,CAAC;AAEzQ,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,gBAAgB,IAAI,OAAO,KAAK,MAAM,CAAC;AAE5F,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,sFAAsF;QAC5F,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC;YACX,GAAG,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC7C,CAAC,cAAc,CAAC,EAAE,uEAAuE;YACzF,CAAC,SAAS,CAAC,EAAE,yEAAyE;YACtF,CAAC,MAAM,CAAC,EACN,2NAA2N;SAC9N,CAAC;KACH;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,oEAAoE;QAC1E,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC;KACpH;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,6CAA6C;QACnD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;KAC7C;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,mEAAmE;QACzE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,oDAAoD,EAAE,CAAC;KACjF;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;KAC3E;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,8EAA8E;QACpF,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC;YACX,CAAC,MAAM,CAAC,EAAE,oEAAoE;YAC9E,GAAG,SAAS,CAAC,4DAA4D,CAAC;SAC3E,CAAC;KACH;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,6FAA6F;QACnG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;KACtF;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,uDAAuD;QAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACzB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;KACzE;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,0DAA0D;QAChE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACnD;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,sFAAsF;QAC5F,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACnD;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,4GAA4G;QAClH,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;KAChG;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,4DAA4D;QAClE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;QACjC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;KAC7D;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,+DAA+D;QACrE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;KACpD;CACF,CAAC;AAEF,8DAA8D;AAC9D,SAAS,KAAK,CAAC,KAAmB;IAChC,OAAO,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC"}
+{"version":3,"file":"vocabulary-fixtures.js","sourceRoot":"","sources":["../../../src/check/fixtures/vocabulary-fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;AACjF,MAAM,MAAM,GAAG,GAAG,OAAO,mDAAmD,CAAC;AAC7E,MAAM,WAAW,GAAG,GAAG,OAAO,mDAAmD,CAAC;AAClF,MAAM,MAAM,GAAG,4BAA4B,CAAC;AAC5C,MAAM,IAAI,GAAG,2BAA2B,CAAC;AACzC,MAAM,OAAO,GAAG,GAAG,OAAO,qCAAqC,CAAC;AAChE,MAAM,eAAe,GAAG,GAAG,OAAO,qCAAqC,CAAC;AACxE,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAE5D,MAAM,KAAK,GAAG;IACZ,CAAC,GAAG,OAAO,oCAAoC,CAAC,EAAE,kEAAkE;IACpH,CAAC,GAAG,OAAO,oCAAoC,CAAC,EAAE,iEAAiE;CACpH,CAAC;AAEF,MAAM,QAAQ,GAAG;IACf,CAAC,MAAM,CAAC,EACN,0KAA0K;IAC5K,CAAC,WAAW,CAAC,EACX,2LAA2L;IAC7L,CAAC,IAAI,CAAC,EACJ,iHAAiH;IACnH,CAAC,QAAQ,CAAC,EACR,uHAAuH;CAC1H,CAAC;AAEF,oHAAoH;AACpH,MAAM,UAAU,GACd,8UAA8U,CAAC;AAEjV,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE,CACzC,mPAAmP,MAAM,aAAa,CAAC;AAEzQ,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,gBAAgB,IAAI,OAAO,KAAK,MAAM,CAAC;AAE5F,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,sFAAsF;QAC5F,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC;YACX,GAAG,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC7C,CAAC,cAAc,CAAC,EAAE,uEAAuE;YACzF,CAAC,SAAS,CAAC,EAAE,yEAAyE;YACtF,CAAC,MAAM,CAAC,EACN,2NAA2N;SAC9N,CAAC;KACH;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,oEAAoE;QAC1E,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC;KACpH;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,6CAA6C;QACnD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;KAC7C;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,mEAAmE;QACzE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,oDAAoD,EAAE,CAAC;KACjF;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;KAC3E;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,8EAA8E;QACpF,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC;YACX,CAAC,MAAM,CAAC,EAAE,oEAAoE;YAC9E,GAAG,SAAS,CAAC,4DAA4D,CAAC;SAC3E,CAAC;KACH;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,6FAA6F;QACnG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;KACtF;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,uDAAuD;QAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACzB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;KACzE;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,0DAA0D;QAChE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,2FAA2F;QAC3F,IAAI,EAAE,CAAC,eAAe,CAAC;QACvB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACnD;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,sFAAsF;QAC5F,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACnD;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,4GAA4G;QAClH,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;KAChG;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,4DAA4D;QAClE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;QACjC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;KAC7D;IACD;QACE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,+DAA+D;QACrE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACxB,2FAA2F;QAC3F,IAAI,EAAE,CAAC,eAAe,CAAC;QACvB,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;KACpD;CACF,CAAC;AAEF,8DAA8D;AAC9D,SAAS,KAAK,CAAC,KAAmB;IAChC,OAAO,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC"}

package/dist/check/language/declared-vocabularies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declared-vocabularies.d.ts","sourceRoot":"","sources":["../../../src/check/language/declared-vocabularies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQzD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAU/F"}
+{"version":3,"file":"declared-vocabularies.d.ts","sourceRoot":"","sources":["../../../src/check/language/declared-vocabularies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOzD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAU/F"}

package/dist/check/language/declared-vocabularies.js

@@ -1,10 +1,9 @@
-import { BRACKETS } from '../text/brackets.js';
+import { permissionSets } from '../authz/permission-sets.js';
 import { matchingBracket } from '../text/matching-bracket.js';
 const AS_CONST = /export\s+const\s+([A-Z][\w$]*)\s*=\s*\{/g;
 const CONST_ASSERTION = /^\s*as\s+const\b/;
 const ENTRY = /^\s*(?:([A-Za-z_$][\w$]*)|#(\d+)#)\s*:\s*#(\d+)#\s*$/;
 const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
-const PERMISSION_SET = /export\s+const\s+([a-z][\w$]*)\s*=\s*definePermissions\(\s*/g;
 /**
  * The closed vocabularies the project declares, by value: every object `as const` of string
  * values next to the union type of the same name (`export type AppointmentStatus = (typeof
@@ -69,31 +68,12 @@ function hasUnionType(text, name) {
     return new RegExp(`export\\s+type\\s+${name}\\s*=\\s*\\(\\s*typeof\\s+${name}\\s*\\)\\s*\\[\\s*keyof\\s+typeof\\s+${name}\\s*\\]`).test(text);
 }
 function permissionValues(file) {
-    const { code, strings } = file.scan;
-    return [...code.matchAll(PERMISSION_SET)].flatMap((found) => {
-        const at = found.index + found[0].length;
-        const context = strings.find(({ start }) => start === at)?.value;
-        const open = code.indexOf('{', at);
-        const close = matchingBracket(code, open);
-        const keys = strings.filter(({ start, end }) => start > open && end < close && /^\s*:/.test(code.slice(end)) && depthAt(code, open, start) === 1);
-        return context === undefined || open === -1
-            ? []
-            : keys.map(({ value: key }) => ({
-                value: `${context}:${key}`,
-                written: `${found[1] ?? ''}['${key}'].id`,
-                vocabulary: found[1] ?? '',
-                file: file.path,
-                readBy: 'everywhere',
-            }));
-    });
-}
-/** How many brackets are open at an offset, counted from the one at `from`. */
-function depthAt(code, from, offset) {
-    let depth = 0;
-    for (let i = from; i < offset; i += 1) {
-        const char = code.charAt(i);
-        depth += BRACKETS.openers.includes(char) ? 1 : BRACKETS.closers.includes(char) ? -1 : 0;
-    }
-    return depth;
+    return permissionSets(file).flatMap(({ set, context, keys }) => keys.map(({ value: key }) => ({
+        value: `${context}:${key}`,
+        written: `${set}['${key}'].id`,
+        vocabulary: set,
+        file: file.path,
+        readBy: 'everywhere',
+    })));
 }
 //# sourceMappingURL=declared-vocabularies.js.map